Privacy Policy

In the context of providing our services and selling our products, we need to collect personal information. This information must be protected against confidentiality incidents, and you must be able to access this personal information at your convenience and, if necessary, have it rectified. The period during which we retain your personal information is not without limitation. Consequently, the personal information which we retain must, at some point, be destroyed.

Given the above, and with an eye to better informing you about the protection of your personal information, your rights and our obligations, we have established this privacy policy.

1. Definitions

1.1. Personal Information

Personal information is information which allows a natural person to be identified. For example, without limiting the generality of the following, the following information is considered personal information:

• First and last name
• Home address
• Telephone number
• Cell phone number
• Email address
• Date of birth / age
• Images captured by video surveillance
• Salary
• Sex
• Revenue
• Cookie preferences
• IP Address
• Function/occupation
• Curriculum Vitae
• Medical information
• Biometric/genetic information
• Educational/academic information
• Banking information
• Financial information
• Credit card numbers
• Security code
• Debit card number
• Credit history
• Cursor movement

The type of personal information collected will depend, in part, on your use of our website and on the services which Poulet Rouge provides you, as well as the manner in which you interact with Poulet Rouge and the Poulet Rouge team.

1.2. Consent

1.2.1. Before collecting your personal information, we are required to identify the purposes for which we are collecting the information in question and ensure that we limit our collection of personal information to that which is necessary for the identified purpose. Any collection of personal information must be based on a serious and legitimate interest.

1.2.2. When you transmit personal information to us, you consent to our use and disclosure of such information for the purposes identified to you at the time of collection. Examples of such purposes include collection for the purposes of making a delivery, fulfilling an order, operating our loyalty program and for contest purposes.

1.2.3. The validity of your consent is conditional upon the person collecting your personal information informing you of (i) the purposes for which the information is collected, (ii) the means by which the information is collected, (iii) your right to withdraw your consent to the disclosure or use of the personal information collected, and (iv) your right to access or rectify personal information contained in your file.

1.2.4. In all other cases, your consent to the collection, communication or use of your personal information must be manifest, free, informed and given for specific purposes. Such consent will often be required when we need to obtain information from a third party. When we require such personal information from a third party, we will request your consent.

1.2.5. Your presumed or express consent may be revoked at any time by sending us a notice of revocation of consent. This notice may be sent to the person responsible for personal information, whose title and contact information appear in paragraph 2.2.1. of this policy. Such revocation of consent may, however, prevent us from sending you offers, advertisements, or other special promotions.

1.3. Third party communications

We may disclose your personal information to a third party without your prior consent in the following circumstances:

• 1.3.1. The information is disclosed to our marketing, social network management and advertising teams, as well as to the managers of our social network platforms;
• 1.3.2. The disclosure had to be made by virtue of an emergency situation endangering your life, health or safety;
• 1.3.3. The information is communicated to a person who may use it for educational, research or statistical purposes in accordance with the law;
• 1.3.4. The information is transmitted to one of our service providers, such as a delivery company.

2. Access to Your File and the Right to Rectification

If you wish to correct, amend or update your personal information as it appears in our files and which we are capable of amending, you may submit a written request to this effect in accordance with section 2.2.

2.1. When?

As long as we have a file on you, you may request that we disclose to you the personal information of yours contained therein.

2.2. How?

You must send a written request to one of the following persons:

• 2.2.1. The Privacy Officer at the following address: privacy@poulet-rouge.ca
• 2.2.2. By mail to the following address:

  2950 Rue Lucien-Lallier, local 210

  Laval , Québec H7P0H8, CA

• 2.2.3. By telephone: _____________________

2.3. Response Time

We have thirty (30) days from the reception of your request to provide you with a response.

2.4. Costs

You may access your personal information free of charge. However, a reasonable fee may be charged for the transcription, reproduction or transmission of such information. If such a fee is required, we will inform you of the approximate amount payable prior to transcribing, reproducing or transmitting the information.

2.5. Remedies

In the event that you are not satisfied within the prescribed time period or that you are denied access to your personal information or to the rectification thereof, you may make a request to the Commission d'accès à l'information for review within thirty (30) days of the denial of access or following the expiry of the thirty (30) day period prescribed for responding to your request.

2.6. Major Changes

In order to optimize our services, it is important that the information we hold in respect of you is accurate and up to date. We therefore invite you to inform us of any changes to your contact information or other personal information.

3. Collection of Personal Information

3.1. When?

• 3.1.1. While using Poulet Rouge’s website, its loyalty program, its mobile app, while making orders, when you participate in our contests, and while using our digital platforms.
• 3.1.2. Some personal information is also collected when you use a computer, tablet, phone or other technological device that allows for the automatic collection of personal information.
• 3.1.3. In some cases, we may need to collect personal information from third parties, including suppliers, in which case we will ask for your prior consent, unless you have already consented to such disclosures. It is further possible that third parties, such as delivery platforms, partners, advertising platforms, advertising agencies and social networks, may provide us with personal information such as your address, order details, telephone number, first and last name, delivery address. When you visit our website and are redirected to the website of another service provider or partner, we invite you to read their privacy and confidentiality policy.
• 3.1.4. When you provide us with your personal information, you consent to its use for the purposes identified in section 3.2.

3.2. Why?

The personal information we collect from you or from third parties enables us to serve you better. We only require personal information that is necessary for the performance of our services and for the purposes that we have identified and for which your personal information is required. At the time of the collection of your personal information, you are informed i) of the purposes for which this information is collected, namely the provision of the services which you’ve requested, ii) of the means by which this information is collected, iii) of your right to withdraw your consent to the disclosure or use of the personal information collected, and iv) of your right to access or rectify your personal information contained in your file. The purposes for which personal information may be collected are, without limiting the generality of the following:

• 3.2.2. for advertising, promotional and research purposes;
• 3.2.3. for the management and administration of our loyalty program and for the management and administration of the Poulet Rouge franchisee network;
• 3.2.4. to comply with legal requirements;
• 3.2.5. to process employment and franchise applications;
• 3.2.6. for administrative and operational purposes.

3.3. By whom?

By you when you transmit your personal information directly to Poulet Rouge, when it is collected automatically on our website, or though our applications.

3.4. From Whom?

• 3.4.2. We collect personal information relating to you from you, our service partners such as, without limiting the generality of the foregoing, delivery platforms, advertising platforms, advertising agencies and social networks.
• 3.4.3. We respect the privacy of children. We will not intentionally collect, use or share personal information regarding children under the age of 14 without the permission of their authorized legal representative. If a child under the age of 14 has provided us with personal information without the consent of his or her authorized representative, Poulet Rouge will delete all such personal information immediately following an indication and request to that effect.

3.5. By technological means

3.5.1. We use cookies to facilitate navigation on our website. These files enable profiling as defined below and, in particular, make it possible to identify your computer each time you visit our website and thereby create a profile for you. The settings of most browsers are configured to accept cookies, but you can reconfigure your computer to automatically reject any cookies that are created. Additionally, we offer you the opportunity to manage the use of cookies when you access our site.

3.5.2. Profiling is defined in the Act as follows:

“Profiling” means the collection and use of personal information to assess certain characteristics of a natural person, in particular for the purpose of analyzing that person’s work performance, economic situation, health, personal preferences, interests or behaviour" (article 8.1 para. 2 of the Act)

4. Retention of Personal Information

4.1. Where?

4.1.1. Your personal information is stored virtually on our servers, in log files contained in our physical files, and in notes and memoranda to files prepared by our employees. The information is stored at our offices located at the following addresses:

●

.

4.2. Personal information retention period

4.2.1. We keep your personal information in physical or digital form for as long as it is needed to fulfill the purposes for which it was provided to us or for as long as required or permitted by law.

4.2.2. In certain circumstances, we may need to keep your personal information for a longer period of time. This may be the case in the event of a dispute or claim. In such an event, we will destroy your personal information as soon as its retention is no longer necessary or permitted by law, and we will do so in a secure manner.

5. Sharing Personal Information (Who Has Access and Why)

5.1. Who?

5.1.1. The following persons may have access to your personal information insofar as such access is required for the accomplishment of identified purposes:

• Management
• Our employees
• Our marketing team
• Our accounting department
• Receptionist
• Our service providers

5.2. With third parties

5.2.1. Barring the exceptional cases already listed in section 1.3 and those specified in the Act, we will not transmit any of your personal information to any other party without first obtaining your express and limited consent for to do so for specific purposes.

6. Destruction of Personal Information

6.1. When:

In compliance with Quebec's Law 25, we ensure that personal information is retained only for as long as necessary to fulfill the purposes for which it was collected. Once these purposes have been achieved, the information will be securely destroyed. If there is a legitimate reason to retain the information, we will consider anonymization to protect your privacy.

6.2. How:

1. Paper Documents: Use a professional shredding service to ensure that paper documents are completely destroyed. Shredding services can provide one-time or regular shredding options, and they often offer secure containers for storing documents until they are shredded.
2. Electronic Data: For digital data, use specialized software to permanently delete files. This software overwrites the data multiple times to ensure it cannot be recovered. Additionally, physically destroying storage devices, such as hard drives, is a highly secure method. Professional services can crush or shred hard drives to ensure data is irretrievable.
3. Anonymization: If there is a legitimate reason to retain the information, consider anonymizing the data. Anonymization involves removing any identifying information so that the data can no longer be linked to an individual.
4. Regular Audits: Conduct regular audits of your data storage to identify and securely delete any information that is no longer needed.

7. Anonymization of Personal Information

7.1. What is anonymization?

7.1.1. Anonymization is a procedure used to render personal information anonymous, thereby removing any possibility of identifying an individual based on the information in question.

7.2. When

7.2.1. When personal information is no longer required for the purposes for which it was collected, or when the prescribed legal retention period has expired.

7.3. How

7.3.1. The selected process must be irreversible and ensure that a person whose personal information has been anonymized can no longer be identified.

8. Confidentiality Incident

8.1. What is a confidentiality incident?

A confidentiality incident occurs:

• 8.1.1. Where personal information is accessed in a manner which is not permitted by law;
• 8.1.2. Where personal information is used in a manner which is not permitted by law;
• 8.1.3. Where personal information is communicated in a manner which is not permitted by law;
• 8.1.4. Where personal information is lost or as a result of any other form of breach in the protection of personal information.

9. Process Following a Confidentiality Incident

We have established a process to be followed in the event a confidentiality incident occurs, with this process notably including:

9.1. Notification of incident to the Privacy Officer

9.1.1. Every individual in our employ who has access to your personal information must notify our company’s Privacy Officer of the occurrence of a confidentiality incident as soon as it occurs or as soon as he or she becomes aware thereof.

9.2. Analysis

9.2.1. Our Privacy Officer will analyze the circumstances of the incident and determine whether it is likely to cause you serious harm.

9.3. Measures

9.3.1. Following receipt of such notice, our Privacy Officer will implement, to the extent possible and as quickly as possible, measures to minimize the harm that could be caused to the person whose personal information is the subject of the confidentiality incident.

9.4. Notification of incident to the Commission d’accès à l’information

9.4.1. In the event that a confidentiality incident is likely to cause serious harm, we will send a confidentiality incident notice to the Commission d'accès à l'information, in accordance with the applicable law and regulations.

9.5. Notification of incident to the concerned person

9.5.1. A notice is also sent to the person whose personal information has been the subject of the confidentiality incident where the incident is deemed likely to cause serious harm. Such notice need not be communicated to the relevant person if doing so would be liable to hinder an investigation by a person or body which, under the law, is responsible for detecting, suppressing or preventing crime or other legal infractions.

9.6. The notice to the person concerned must contain the following information:

• 9.6.1. A description of the personal information involved in the incident or, if this information is not known, the reason why such a description cannot be provided;
• 9.6.2. A brief description of the circumstances of the incident;
• 9.6.3. The date or period in which the incident occurred or, if this is not known, an approximation of this period;
• 9.6.4. A brief description of the measures which we have taken or which we intend to take following the occurrence of the incident, in order to reduce the risk of harm being caused;
• 9.6.5. The measures our company would suggest you undertake in order to reduce the risk of harm being caused to you or to mitigate such harm;
• 9.6.6. Contact details that will enable you to obtain further information regarding the incident.

9.7. Public Notice

In the event of any of the following circumstances, we may be unable to send you the notice directly and would consequently proceed with a public notice instead:

• 9.7.1. When sending you the notice is likely to cause you greater harm;
• 9.7.2. When sending you the notice is likely to cause undue hardship to our company;
• 9.7.3. When our company does not have your contact information.

Thus, in order to act quickly to reduce the risk of serious prejudice being caused or to mitigate such prejudice, notice to the person concerned may also be provided by means of a public notice. In this case, however, our company retains the obligation to transmit a notice to your attention unless one of the circumstances listed above applies to your situation.

9.9. Entry in the Incident Register

Entry of information relevant to the confidentiality incident in our Incident Register.

10. Incident Register

10.1. What is an Incident Register?

The Incident Register is a register in which all confidentiality incidents occurring in our company are recorded, whether or not they are likely to cause harm. The register also includes the measures put in place to minimize the damage caused and to prevent further incidents of a similar nature.

10.2. Retention

Information contained in the Incident Register must be retained for at least five (5) years.

11. Complaints

11.1. Complaint Treatment Process

You may address any written complaint concerning the application of this policy or of the collection, retention and transmission of your personal information to the following persons:

• to the Privacy Officer: Hadi Bassil.

12. Modification of the Privacy Policy

We reserve the right to modify the present policy without prior notice. Any changes made to this policy will not affect our adherence to and compliance with the legislation in force in the province of Quebec, including the laws of Quebec and Canada which govern the protection of personal information in the private sector. A notice of modification will be published on our site.

13. Internal Protection of Personal Information

The security of your personal data is of paramount importance to us. Rigorous security measures, such as encryption and access controls, are in place to protect your personal information. Our business partners and suppliers are contractually bound to guarantee the confidentiality of your data. We will only disclose your personal information in response to duly justified legal requests.