Privacy policy

Person responsible

A person in our organization is responsible for the protection of personal information. For any question, or to request access, correction or deletion, write to hotlunchqea@gmail.com.

Information we collect

• Parent or guardian: last name, first name, email address (and any secondary addresses you add), phone number, preferred language. Your password is never stored in plain text, only in an irreversible encrypted form.
• Children: first name, last name, date of birth, school, class and menu type.
• Allergies and dietary restrictions, if you choose to declare them. This is information about your child’s health.
• Orders, payments (amount, Interac transfer reference), credits and donations.
• Reviews you publish: displayed name and comment.
• During sensitive actions (login, payments, team operations): IP address and browser type, for security.

Why we use it

• To prepare and deliver the meals ordered, to the right school and class.
• To confirm Interac payments and keep our accounts.
• To write to you about your orders, the menus and when ordering opens.
• To protect accounts against fraudulent logins.
• We use it for no other purpose and never sell it. The site shows no advertising and uses no audience measurement tool.

Allergies and dietary restrictions

• They are used only for meal safety: they are passed on to the kitchen with the child’s first name, last name and class, and to no one else.
• You can change or remove them at any time in “My children”.

Who has access

• Our team, according to their role: administration; accounting (orders and payments); the kitchen (meals to prepare by class, with the children’s names and allergies).
• OVHcloud hosts the site and the database, in Canada.
• Google: the site’s emails are sent from our Gmail account, and the Interac transfer notices received in that mailbox are read automatically to confirm payments. Signing in with Google, if you choose it, tells Google that you are signing in to the site. Google may process this data outside Canada, including in the United States.
• Cloudflare delivers the site’s icons: your IP address is sent to it when the page loads.
• Approved reviews are public on the site, with the name you chose to display.

Cookies

• A session cookie keeps you signed in; it expires after a period of inactivity or when you sign out.
• A “visitor” cookie remembers for one year the “likes” you gave, so they are not counted twice.
• No advertising or tracking cookies.

Retention

• Your information is kept as long as your account is active.
• On request, we delete your account. If you never ordered, everything is erased. Otherwise, orders and payments are kept for accounting, but without your name, your contact details or your children’s information (date of birth, allergies).
• Removing a child in “My children” erases their information in the same way.
• The host’s backup copies are kept for about 30 days, then erased.

Your rights

• Access: we give you a copy of everything the site stores about you and your children, within 30 days.
• Correction: you can correct most information yourself in “My account” and “My children”, or write to us.
• Announcements: every announcement that ordering is open, or reminder, carries a link to stop receiving them; you can also unsubscribe or subscribe again in “My account”. Emails about your orders still go out.
• Withdrawing consent and deletion: you can ask for your account to be deleted at any time.
• If you are not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner for British Columbia (OIPC, oipc.bc.ca).

Security

Encrypted connection (HTTPS), encrypted passwords, access limited by each team member’s role, a log of sensitive operations and a limit on login attempts.