Privacy policy

Who is responsible for your personal information?

The person in charge of protecting personal information at Pâtisserie Coco Vanille inc. is named in the “Person in charge” box on this page, with their title and contact details. By default, the law gives this role to the person with the highest authority in the business, who may delegate it in writing.

Business: Pâtisserie Coco Vanille inc., 3 rue Court, Granby, Québec J2G 4Y6, Québec enterprise number 1177082220, phone 450-372-7177.

What information do you collect, and why?

Pâtisserie Coco Vanille only collects what it needs to prepare and hand over your order, and to answer you.

• Order: name, phone, email, products, pickup date and slot, to prepare the order, reach you and send the confirmation.
• Cake request: description, reference photo, number of guests and date, to prepare the quote.
• “Message us” messaging: your messages and, only if you choose to give them, your first name and a phone number or email address, to answer you.
• Allergy note, optional: only used to prepare your order; never copied into an email, a text message or an artificial-intelligence tool.
• Payment: handled by the payment processor; the shop never sees or stores your card number.
• Cookie and message consents: your choice, its date and the version of the text you accepted, to prove your consent.
• Server logs: IP address and pages requested, for the security of the site.

Does your information leave Québec?

Some providers may process information outside Québec, such as the payment processor, the text-message service and, if you turn them on, audience-measurement tools. Before sharing any information with them, the shop carries out a privacy impact assessment and signs a written agreement, as section 17 of the law requires.

Providers and processing countries: Stripe for payments (Canada and the United States), Twilio for text messages (United States), Amazon Web Services for order emails and backups (Montréal), Microsoft for the shop’s email (Canada) and OVHcloud for hosting. A privacy impact assessment is made before each provider that processes information outside Québec is put into service. Hosting of the site and database: OVHcloud, in Beauharnois, Québec.

What are your rights?

You may ask to access your information, to correct it and to receive it in a structured, commonly used technological format, and you may withdraw a consent at any time. Write to the person in charge; response time: 30 days at most.

If you are not satisfied with the answer, you may file a complaint with the Commission d’accès à l’information du Québec.

What happens if there is a confidentiality incident?

The shop records every confidentiality incident in a register. If an incident carries a risk of serious injury, it notifies the Commission d’accès à l’information and the people concerned, and takes steps to limit the harm.

How long do you keep your information?

The shop keeps your information as long as needed for the purposes stated, then destroys it or makes it anonymous.

• Orders and invoices: 6 years after the end of the tax year they relate to, as tax rules require
• Allergy note: 30 days after pickup, then deleted automatically
• Server logs: 90 days
• “Message us” messages: deleted 90 days after the last message
• Abandoned boxes: none is kept on our servers; a box lives in its link and in a cookie on your device, deleted after 30 days