Privacy Policy

Last updated: 26 August 2026 · Version: 1.0

In plain terms

  • Three sets of privacy law protect you here, not one Quebec’s, Canada’s federal law, and European law, because the company behind Hippool is registered in France.
  • You have a named person to write to — our Privacy Officer (responsable de la protection des renseignements personnels) — and three regulators you can escalate to. All of it here →
  • We collect what we need to sell you a pool and get it to your door. Not more.
  • Nothing that could identify you, work out where you are, or build a profile of you runs unless you switch it on. That’s Quebec law, and it’s how the site is built.
  • Your information leaves Quebec — and leaves Europe. Section 6 says exactly where it goes, and what we’ve done about it so far. Including what we haven’t finished.

1. Who handles your information

  • Who we are — Sold by BME Consulting — SARL registered in France, RCS Lyon 754 058 410, trading as Hippool
  • Our role Data controller (GDPR) · the enterprise responsible for your personal information under Quebec law
  • Registered office — 113 rue Marietton, 69009 Lyon, France
  • Privacy Officer (responsable de la protection des renseignements personnels) — Steven Robert
  • How to reach them — contact@hippool.com · BME Consulting, 113 rue Marietton, 69009 Lyon, France
  • Postal address for privacy requests — 113 rue Marietton, 69009 Lyon, France

We’re a French company selling to customers in Canada, and that has a consequence worth knowing: your information is covered several times over.

  • Quebec law. If you’re in Quebec, the province’s private-sector privacy law — the one modernized by what everyone calls Law 25 — applies to your information. It’s the strictest regime on the continent, and this page is written to it.
  • Federal law. Canada’s federal private-sector privacy law covers personal information that crosses provincial or national borders. Ours does, from the first order — so the federal regulator is a real avenue for you (§13).
  • European law. Because we’re established in the European Union, the General Data Protection Regulation applies to everything we do with your information — including yours, in Canada. European data protection law follows the company, not the customer. That gives you a full set of rights and a European regulator (§13).

Where these rules differ, we apply the one that protects you more.

This policy covers hippool.com, our customer emails, and the way we handle enquiries.

2. What we collect

When you buy from us — your name, delivery address, billing address, email address and phone number; what you ordered, when, and for how much; payment confirmation details. We never see or store your full card number — that stays with our payment provider (§5).

When you contact us — your name, your email address or phone number, and whatever you tell us about your enquiry, including photos you send us for a warranty or damage claim.

When you sign up for our emails — your email address, and the fact that you opted in, with the date.

When you browse hippool.com — your device and browser type, the pages you looked at, and how you arrived. This comes from cookies and similar technologies, and none of it runs unless you say yes (§8).

We don’t ask for, and we don’t want: your date of birth, your health information, your government identifiers, or anything about your family. Both Quebec law and European law hold that kind of information to a much higher standard — the simplest way to meet it is not to collect it. If you send us something like that unprompted, we’ll delete it.

Browsing without telling us who you are. You can read every page and ask us a general question without identifying yourself. We only need your identity when we have to do something that requires it — deliver a pool, take a payment, or handle a claim on a specific order.

3. Why we collect it, and what allows us to

We need a specific reason for every single thing we do with your information — and, in Quebec, your consent has to be asked for each purpose separately, not bundled into one click.

  • Take, process and deliver your order — Why: To do what you paid us to do · What allows us to: Performance of our contract with you GDPR Art. 6(1)(b)
  • Contact you about your order — confirmation, dispatch, delays — Why: You’d want to know, and we’d rather tell you · What allows us to: Performance of our contract — Art. 6(1)(b)
  • Handle warranty claims, damage and missing parts — Why: To honour your provincial consumer protection rights · What allows us to: Performance of our contract, and our legal obligations Art. 6(1)(b) and 6(1)(c)
  • Answer your questions — Why: Because you asked · What allows us to: Performance of our contract, or our legitimate interest in answering people who write to us — Art. 6(1)(b) / 6(1)(f)
  • Prevent fraud and keep the shop secure — Why: To protect you and us · What allows us to: Our legitimate interests, and yours — Art. 6(1)(f)
  • Keep accounting and tax records — Why: Because French law requires it of us · What allows us to: Legal obligation Art. 6(1)(c)
  • Send you setup and care guides, and news about our products — Why: Only if you asked for them (§7) · What allows us to: Your consent Art. 6(1)(a), and express consent under Canadian anti-spam law
  • Understand how the site is used, so we can make it better — Why: Only if you turned analytics on (Cookies) · What allows us to: Your consent Art. 6(1)(a)

Where we rely on our legitimate interests, you can object — tell us and we’ll stop unless we have compelling grounds not to, and we’ll explain them to you (§12).

We don’t do anything else with your information. No profiling to decide what you’re shown at a different price, no automated decision that has a legal or similarly significant effect on you, no sale of your details to anyone. Both Quebec law and European law give you a right against that kind of decision — and there simply isn’t one here.

4. Who we share it with

We share your information only with the people who need it to do a job for us, and only for that job. Each of them is bound to us by a written agreement requiring them to act only on our instructions, keep it secure, and delete or return it when the job is done.

  • Shopify — What they do: Runs our online shop and hosts it — orders, accounts, customer records · Where they are: Canada, United States and other locations used by Shopify’s infrastructure
  • Payment providers — What they do: Take your payment securely — card through Shopify Payments, PayPal, or bank transfer
  • Delivery carriers — What they do: Get the pool to your address — they need your name, address and phone number
  • Email platform — What they do: Sends order emails and, if you asked for them, our guides and news
  • Consent management tool — What they do: Records what you agreed to, and what you refused
  • Analytics — What they do: Tells us, in aggregate, how the site is used — only if you agreed

We may also disclose your information where the law requires it, or to establish or defend a legal claim.

We do not sell your personal information. We do not trade it, rent it, or hand it to anyone in exchange for a service, a discount or an advantage.

5. How we protect your payment details

We never see or store your full card number. Payment is handled by our payment provider on their own secure infrastructure, and what we receive back is a confirmation, not your card.

6. Where your information goes

Your information leaves Quebec, and it leaves Europe. We’re not going to dress that up.

  • To us, in France. We process orders and answer you from Lyon.
  • To Shopify, which hosts the shop from Canada, the United States and other locations.
  • To our payment provider, to take your payment.
  • To the carrier that delivers your pool, which needs your name, address and phone number.

Two sets of rules govern that, and they don’t overlap the way you’d expect.

  • Under Quebec law, the reference point is leaving Quebec — and that includes going to another Canadian province, not just another country. Before your information goes anywhere outside Quebec, we have to assess whether it will be adequately protected there, and have a written agreement with whoever receives it.
  • Under European law, the reference point is leaving the European Union. Once your information is with us in France, sending it on to a provider outside the EU is a restricted transfer with its own formalities (Standard Contractual Clauses, or an adequacy decision where one exists).

“Quebec law requires us to assess, before your information goes outside Quebec, whether it will be properly protected there — and to have a written agreement with each provider that receives it. That work is under way and it isn’t finished. We’d rather tell you that than tick a box we haven’t earned. You can ask us where it stands at any time, and we’ll answer you straight.”

You can ask us for a copy of the safeguards we use — write to our Privacy Officer (§14) and we’ll tell you which mechanism covers which provider.

7. Marketing emails

  • We only send you marketing emails if you asked us to. The signup box is never pre-ticked, and buying a pool doesn’t sign you up for anything.
  • Every marketing email identifies us — who sent it, and how to reach us — and has a working unsubscribe link. One click.
  • We keep a record of the consent you gave us, with the date. Canadian law requires us to be able to prove it, and so does European law.
  • Withdrawing your consent is as easy as giving it, and it doesn’t affect anything we did lawfully before you withdrew it.
  • Order emails are different. Confirmation, dispatch and delivery messages aren’t marketing: they’re part of selling you a pool, and you get them either way.

8. Cookies and similar technologies

Some cookies keep the shop running — your cart, your session, secure payment. Those we can’t switch off. Everything else is off, and stays off unless you turn it on. That includes anything that could identify you, work out where you are, or build a profile of you.

And if you do want any of it on, here’s how: open Cookie settings — the link is at the bottom of every page — and switch on the categories you’re comfortable with. You can change that choice at any time, in the same place, and turning something back off is exactly as easy as turning it on.

Full detail, category by category: Cookie Policy.

9. How long we keep it

We keep your information for as long as we need it for the purpose we collected it for, and then we either delete it or move it into restricted archive storage for as long as the law requires us to keep it.

  • Your customer account and order history, in active use — How long: For as long as you’re a customer, and 3 years after our last contact with you · Why: Reference period applied by the French data protection authority to customer and prospect records
  • Invoices, order records and supporting accounting documents, in restricted archive — How long: 10 years from the close of the financial year · Why: French commercial law requires it — Code de commerce, art. L123-22 (tax law requires at least 6 years).
  • Warranty and claim records — How long: For the length of the warranty and a reasonable period afterwards
  • Marketing subscription — How long: Until you unsubscribe, then a short suppression record so we don’t email you again by mistake · Why: Consent — and proof of it
  • Enquiries that don’t lead to an order — How long: 3 years from our last contact with you
  • Records of the consent you gave us — How long: For as long as we need to be able to prove it · Why: GDPR Art. 7(1), and Canadian anti-spam law
  • Website analytics — How long: See Cookie Policy · Why: Consent

10. Keeping it safe, and telling you if something goes wrong

  • The shop runs on Shopify, which handles hosting and payment infrastructure and maintains its own security certifications.
  • Access to customer information inside our team is limited to the people who need it to do their job.
  • Every account that can reach your information is protected by two-factor authentication — a password is not enough on its own. Signing in also requires a code sent to the account holder’s mobile phone.

If something goes wrong. If there’s a breach affecting your personal information:

  • Quebec law requires us to notify the Commission d’accès à l’information and you, if the incident presents a risk of serious injury — and to keep a register of incidents.
  • European law adds a hard deadline: we must report it to the French data protection authority within 72 hours of becoming aware of it, and tell you directly if the risk to you is high.

We will do both. That’s not a promise we’re choosing to make — it’s what the law requires of us.

11. Children

Hippool is sold to adults. We don’t market to children and we don’t knowingly collect their personal information. If you think a child has given us their details, tell our Privacy Officer and we’ll delete them.

12. Your rights

You have rights under Quebec law, under Canadian federal law, and under European law. They overlap — and where they don’t, you get the benefit of all of them. You can ask us to:

  • Give you a copy of what we hold about you (GDPR Art. 15);
  • Correct it if it’s wrong, out of date or incomplete (Art. 16);
  • Delete it, where we don’t have a legal reason to keep it — and we’ll tell you plainly if we do (Art. 17);
  • Restrict what we do with it while a dispute about it is being sorted out (Art. 18);
  • Send you, or another company, a machine-readable copy of the information you gave us — a right you have under both European law (Art. 20) and Quebec law, which has required it since September 2024;
  • Object to processing we base on our legitimate interests (Art. 21);
  • Stop marketing to you — one click in any email, or just tell us. This one is absolute (Art. 21(2));
  • Withdraw a consent you gave us, at any time (Art. 7(3)) — including for cookies;
  • Not be subject to an automated decision that significantly affects you — we don’t make any (Art. 22).

How: write to our Privacy Officer, Steven Robert, at contact@hippool.com, or to BME Consulting, 113 rue Marietton, 69009 Lyon, France.

How long we take: one month. If your request is unusually complex we may take up to two months more, and if we do, we’ll tell you within the first month and explain why (Art. 12(3)).

What it costs you: nothing. We may only charge, or refuse, if a request is manifestly unfounded or excessive — and if we ever did, we’d have to justify it and tell you how to challenge it (Art. 12(5)).

We may need to check it’s really you before we hand over personal information — that’s a protection for you, not an obstacle.

13. If you’re not happy with how we handled your information

Tell us first. Write to our Privacy Officer, Steven Robert, at contact@hippool.com with what happened. We’ll look into it and come back to you.

If you’re not satisfied with our answer, you can complain to a regulator — and you have three.

A cookie here you don’t recognize, or a tracker running before you agreed? Tell our Privacy Officer (responsable de la protection des renseignements personnels): Steven Robert, contact@hippool.com. If we don’t sort it out properly, you can complain to the Commission d’accès à l’information du Québec, to the Office of the Privacy Commissioner of Canada, or to the French data protection authority, the CNIL — the company behind Hippool is registered in France.

  • Commission d’accès à l’information du Québec — Who it is: Quebec’s privacy regulator
  • Office of the Privacy Commissioner of Canada (Commissariat à la protection de la vie privée du Canada) — Who it is: Canada’s federal privacy regulator — one body, two official names
  • CNIL — Commission Nationale de l’Informatique et des Libertés — Who it is: The French data protection authority, which supervises us because we’re established in France · Coordinates: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France · cnil.fr

14. Changes to this policy

If we change this policy, we’ll publish the new version here with a new date at the top. If the change is significant, we’ll tell you — we don’t rewrite the rules quietly. Quebec law requires that notice, and we’d give it anyway.

15. Contact

Privacy Officer (responsable de la protection des renseignements personnels): Steven Robert — contact@hippool.com

We answer general enquiries within 48 hours (Monday to Friday). A formal request about your rights has its own deadline: one month (§12).

BME Consulting — 113 rue Marietton, 69009 Lyon, France · RCS Lyon 754 058 410.

Related pages: Cookie Policy · Terms of Sale · Legal Notice · Politique de confidentialité (français)