Privacy Policy

1. Overview & Scope

This Policy applies to personal information we collect from customers, Group Order participants, and individuals who submit a corporate catering Inquiry through the Platform. It does not cover the separate agreement and data practices that apply to Vendors and Partners using the CaterDash partner portal, which are addressed in their partner agreement.

2. Who We Are

CaterDash Services Inc. is the organization responsible for the personal information collected through the Platform. Questions about this Policy or our privacy practices can be directed to our privacy contact using the details in Section 16.

3. Information We Collect

4. How We Collect Information

We collect information directly from you when you create an account, place an Order, participate in a Group Order, submit an Inquiry, or contact us. We also collect information automatically through cookies and similar technologies when you use the Platform (see Section 13), and, where you complete a payment, we receive limited transaction confirmation data from Stripe.

5. How We Use Your Information

Consistent with PIPEDA's purpose-specification and reasonableness principles, we use personal information only for purposes a reasonable person would consider appropriate in the circumstances, including to:

• Create and manage your account, Order, Group Order, or Inquiry;
• Route order details to the fulfilling Vendor and coordinate delivery;
• Process payments through Stripe and maintain order and billing records;
• Send transactional communications (order confirmations, status updates such as preparing, out for delivery, delivered, or cancelled);
• Provide customer support and respond to inquiries;
• Send marketing communications where you have consented (Section 6);
• Detect, investigate, and prevent fraud, abuse, or security incidents; and
• Comply with legal obligations, including tax and financial record-keeping requirements.

6. Consent & Marketing Communications

We rely on your consent, express or implied by context, to collect, use, and disclose personal information as described in this Policy. Placing an Order implies consent to the processing necessary to fulfill it (for example, sharing your order details with the relevant Vendor).

Where we send commercial electronic messages (such as promotional emails about new vendors or offers), we do so in accordance with Canada's Anti-Spam Legislation (CASL), with your express or implied consent, clear sender identification, and a working unsubscribe mechanism in every message. You may withdraw marketing consent at any time using the unsubscribe link or by contacting us; this will not affect transactional messages related to an active Order.

7. When We Share Information

We disclose personal information only as needed, including to:

• Vendors, so they can prepare and fulfill your Order (name, delivery address, order contents, and contact details relevant to delivery);
• Stripe, to process payments securely;
• Resend, our transactional email provider, to deliver order and account emails;
• AWS, which hosts our database (RDS) and stores images and documents such as invoices (S3 / CloudFront) associated with your Orders;
• Google Analytics, which helps us understand how visitors use the Platform (pages visited, device and browser information, and approximate location derived from IP address). You can opt out at any time via the Cookie Settings link in our site footer (see Section 13);
• other service providers who perform functions on our behalf (e.g. hosting, analytics), under contractual obligations to protect your information; and
• regulators, law enforcement, or other parties where required by law, or to protect the rights, safety, or property of CaterDash, our users, or the public.

We do not sell personal information. Anyone with a Group Order link or an Inquiry access token can view the information associated with it; treat these links as confidential.

8. Cross-Border Data Transfers

Some of our service providers, including our cloud hosting and payment processing providers, may store or process personal information on servers located outside Canada, including in the United States. That information may be accessible to courts, law enforcement, and national security authorities of those jurisdictions under their local laws. By using the Platform, you acknowledge this cross-border processing, as required for transparency under PIPEDA.

9. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this Policy, including to maintain order and financial records for tax and accounting purposes, resolve disputes, and comply with legal obligations. Group Order participant data and Inquiry records are retained for as long as needed to support the associated order or quote, and for a reasonable period afterward for support and record-keeping purposes. When no longer needed, information is securely deleted or anonymized.

10. Security Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information involved, including encryption of data in transit, hashed password storage, access controls limiting internal access to personal information on a need-to-know basis, and reliance on PCI-compliant processors (Stripe) for payment data. No method of transmission or storage is completely secure; if we become aware of a breach involving personal information that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law.

11. Your Privacy Rights

Subject to limited exceptions permitted by law, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Withdraw consent for a particular use (such as marketing), subject to legal or contractual restrictions and reasonable notice; and
• Ask questions about our collection, use, and disclosure practices, or file a complaint (Section 16).

To exercise these rights, contact us using the details in Section 16. We may need to verify your identity before fulfilling a request, and may charge a minimal fee for extensive requests where permitted by law (after providing you with an estimate).

12. Additional Rights for Quebec Residents

If you reside in Quebec, you have additional rights under Quebec's Act respecting the protection of personal information in the private sector (Law 25), including the right to:

• Be informed of, and object to, any automated decision-making that produces legal or similarly significant effects concerning you, and to obtain an explanation of the decision;
• Request the portability of personal information you have provided us, in a structured, commonly used technology format, where technically feasible;
• Request that we cease disseminating personal information about you, or de-index a link to it, in the circumstances provided for by law; and
• Be notified of any confidentiality incident that creates a serious risk of injury.

We do not use personal information to make solely automated decisions that produce legal or similarly significant effects about individuals.

13. Cookies & Similar Technologies

We use cookies and similar technologies to keep you signed in, remember your city and cart contents, and understand how the Platform is used so we can improve it. Specifically:

• Essential cookies and local storage support core features such as authentication, your selected city, your cart, and your cookie preferences;
• Analytics cookies are set by Google Analytics (cookies beginning with _ga) to measure how visitors use the Platform. You can decline or withdraw consent to analytics cookies at any time using the Cookie Settings link in our site footer; declining removes existing Google Analytics cookies and stops further analytics collection on your device.

You can also control cookies through your browser settings; disabling them may affect features such as staying signed in or maintaining your cart between visits.

14. Children's Privacy

The Platform is not directed to children and is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us so we can delete it.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will update the “Effective” date above and, for material changes, provide additional notice such as an email or in-Platform banner.

16. Contact Us & Complaints

For questions, requests, or complaints about our privacy practices, contact our privacy team at team@caterdash.ca or by phone at +1 (778) 223-9032. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or, if you reside in Quebec, the Commission d'accès à l'information du Québec.