Privacy Policy

We collect personal information that you provide directly to us and information generated automatically when you use our website.

1.1 Information You Provide

• Identity & contact data: Full name, email address, and phone number collected when you place an order or create an account.
• Delivery address: Street address, city, province, and postal code for delivery orders.
• Order information: The items you select, quantities, modifiers, special instructions, and order notes.
• Account credentials: Email address and password (stored as a secure bcrypt hash via Supabase — we never see your plaintext password).
• Communications: Messages, feedback, catering inquiries, or complaints you send to us.
• Promotional data: Promo codes you apply, which may be associated with a marketing campaign.

1.2 Payment Information

All payment transactions are handled by Stripe, Inc. (a PCI-DSS Level 1 certified payment processor). We never receive, store, or transmit your full card number, CVV, or banking credentials. We only store the Stripe session ID and payment intent ID for order reconciliation.

1.3 Automatically Collected Information

• Log data: IP address, browser type and version, pages visited, referring URL, and timestamps.
• Device data: Device type, operating system, and screen resolution.
• Cookies and local storage: Session cookies for authentication, and local storage for your shopping cart (see Section 7).

We use your personal information only for the purposes for which it was collected or for compatible purposes, including:

• Fulfilling orders: Processing and preparing your food order, coordinating pickup or delivery, and communicating your order status.
• Transactional communications: Sending order confirmations, status updates (accepted, ready, delivered), and reselection requests via email.
• Account management: Creating and managing your customer account, enabling order history, and facilitating password resets.
• Customer support: Responding to your inquiries, resolving disputes, and addressing complaints.
• Legal obligations: Complying with applicable laws, including tax obligations, food-safety regulations, and court orders.
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent transactions and other illegal activities.
• Service improvement: Analysing aggregate, anonymised order trends to improve our menu, hours, and operations. We do not build individual profiles for this purpose.
• Marketing (with consent): If you have opted in, sending you promotional emails about new menu items, seasonal specials, or offers. You may withdraw consent at any time (see Section 8).

We will not use your personal information for purposes other than those listed above without first obtaining your consent, unless required by law.

We rely on the following legal grounds to process your personal information:

• Contractual necessity: Processing is required to accept and fulfil your order (our contract with you).
• Legitimate interest: Fraud prevention, website security, and aggregate analytics.
• Consent: Marketing communications and the use of non-essential cookies.
• Legal obligation: Tax records, health and safety compliance, and responses to lawful government requests.

We do not sell, rent, or trade your personal information. We share data only as described below:

• Stripe, Inc. — Payment processing. Stripe may collect additional data directly under their own Privacy Policy.
• Resend — Transactional email delivery. Resend receives your name and email address solely to send order-related emails.
• Supabase — Database and authentication infrastructure, hosted in data centres located in Canada or the United States. Data is encrypted in transit and at rest.
• Legal authorities: When required by law, court order, or regulatory authority, we may disclose your information without prior notice.
• Business transfers: If Ghana Jollof Restaurant is sold or merged, your information may be transferred to the successor entity, subject to the same privacy commitments.

All third-party service providers are contractually required to handle your data in accordance with applicable privacy laws.

• Order records: Retained for 7 years to satisfy Canada Revenue Agency (CRA) tax record-keeping requirements.
• Account data: Retained for as long as your account is active. You may request deletion at any time (see Section 8).
• Log and analytics data: Retained for up to 90 days, then deleted or anonymised.
• Marketing consents: Retained until you withdraw consent or request deletion.

We implement industry-standard technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction, including:

• TLS encryption for all data transmitted between your browser and our servers.
• Encryption at rest for database records containing personal information.
• Row-Level Security (RLS) policies ensuring each user can only access their own data.
• Access controls limiting staff access to data required for their role.
• Regular review of third-party service provider security practices.

No method of transmission over the internet is 100% secure. If you suspect a security breach affecting your data, please contact us immediately at info@ghanajollof.ca.

Our website uses the following types of cookies and similar technologies:

We do not use third-party advertising or tracking cookies. You may disable cookies in your browser settings; however, some site features (such as sign-in) will not function without session cookies.

As a Canadian resident, you have the following rights regarding your personal information:

• Right of access: Request a copy of the personal information we hold about you.
• Right to correction: Request correction of inaccurate or incomplete information.
• Right to withdrawal of consent: Withdraw consent for non-essential processing (e.g. marketing emails) at any time, by clicking "Unsubscribe" in any email or contacting us directly.
• Right to deletion: Request deletion of your account and associated personal data, subject to our legal retention obligations (e.g. tax records).
• Right to lodge a complaint: If you believe we have not handled your data lawfully, you may file a complaint with the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, please contact our Privacy Officer at info@ghanajollof.ca. We will respond within 30 calendar days. We may require proof of identity before processing your request.

Our website and services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information without parental consent, please contact us and we will delete it promptly.

Our website may contain links to external websites (e.g. Stripe, Google Maps). This Privacy Policy does not apply to those sites. We encourage you to read the privacy policies of any third-party services you visit.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. If changes are material, we will notify you by posting a notice on our website or by email. Your continued use of our website after the effective date of any changes constitutes your acceptance of the updated policy.

For all privacy-related inquiries, requests, or complaints, please contact: