Privacy Policy

Welcome to Toastery (“we,” “our,” or “us”). We are a breakfast and brunch restaurant located in Kingston, Ontario, Canada, operating the website toastery.ca.

We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, make an online reservation, sign up for our newsletter, or interact with us in any other way.

Please read this policy carefully. If you disagree with its terms, please discontinue use of our site.

We collect information you provide directly to us, as well as information gathered automatically when you use our website.

• Full name and email address (newsletter sign-up)
• Name, phone number, email, date, time, and party size (table reservations)
• Message content (contact form submissions)
• Dietary preferences or special requests you choose to share
• Any other information you voluntarily provide to us

• IP address and approximate geographic location
• Browser type, version, and operating system
• Pages visited, time spent on site, and referring URL
• Device type (desktop, mobile, tablet)
• Cookie identifiers and similar tracking data (see Section 7)

We use the information we collect for the following purposes:

• To process and confirm table reservations
• To respond to enquiries submitted through our contact form
• To send you our newsletter, promotional offers, and updates (only if you have opted in)
• To improve our website, menu offerings, and overall customer experience
• To comply with our legal obligations under Canadian law
• To detect, prevent, and address technical issues or fraudulent activity
• To analyse website traffic and usage patterns using aggregated, anonymised data

As a Canadian business, we operate in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25).

We collect and process your personal information only when:

• You have given your express or implied consent (e.g., newsletter sign-up, reservation submission)
• It is necessary to fulfil a contract with you (e.g., to honour your reservation)
• We are required or permitted to do so by law
• It is necessary for our legitimate business interests, provided those interests are not overridden by your privacy rights

We do not sell your personal data. We may share it with trusted third-party service providers who assist us in operating our website and business, under strict data-processing agreements. These may include:

• Reservation management platforms (e.g., OpenTable, Resy, or similar)
• Email marketing service providers (e.g., Mailchimp or equivalent)
• Website hosting and cloud infrastructure providers
• Analytics providers (e.g., Google Analytics, in anonymised form)
• Payment processors, if online payment is offered (PCI-DSS compliant)

We may also disclose your information if required by law, court order, or governmental authority, or to protect the rights and safety of Toastery, our staff, or the public.

All third-party providers are contractually required to handle your data in accordance with applicable Canadian privacy law.

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law:

• Reservation data — retained for 24 months from the date of your visit
• Newsletter subscriber data — retained until you unsubscribe
• Contact form submissions — retained for 12 months
• Website analytics data — retained in aggregated, anonymised form indefinitely

When personal information is no longer needed, we securely delete or anonymise it.

Our website uses cookies and similar tracking technologies to enhance your browsing experience. Cookies are small text files placed on your device by your browser.

• Essential cookies — required for the website to function (cannot be disabled)
• Analytics cookies — help us understand how visitors interact with the site (e.g., Google Analytics)
• Preference cookies — remember your settings and choices (e.g., language preference)
• Marketing cookies — used only if you have consented, to deliver relevant promotions

You may control or disable non-essential cookies through your browser settings or our cookie consent banner. Disabling cookies may affect some website functionality.

For more information on how Google Analytics uses your data, visit policies.google.com/privacy.

Under PIPEDA and applicable provincial law, you have the following rights regarding your personal information:

• Right of access — request a copy of the personal information we hold about you
• Right to correction — request that we correct inaccurate or incomplete information
• Right to withdrawal of consent — withdraw consent for processing at any time (subject to legal exceptions)
• Right to erasure — request deletion of your personal data where we have no legal basis to retain it
• Right to complain — lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

We implement reasonable and appropriate technical and organisational measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction. These include:

• SSL/TLS encryption for all data transmitted via our website
• Access controls limiting data access to authorised personnel only
• Regular security assessments of our website and systems
• Secure deletion procedures when data is no longer needed

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security and encourage you to use the internet responsibly.

Our website may contain links to third-party websites (e.g., social media platforms, Google Maps, delivery partners). We are not responsible for the privacy practices of those websites and encourage you to review their individual privacy policies before providing any personal information.

Our website is not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. When we do, we will revise the “Last Updated” date at the top of this page.

We encourage you to review this policy periodically. Your continued use of our website after any changes constitutes your acceptance of the updated policy. For material changes, we may also notify you by email (if you are a subscriber) or by a prominent notice on our website.

If you have questions, concerns, or requests relating to this Privacy Policy or how we handle your personal information, please reach out to us directly: