Privacy Policy — OCHEF POS (Clover app)

9394-3496 Québec inc., doing business as Ô Chef (“Company”, “we” or “us”), 415 boulevard du Séminaire Nord, Saint-Jean-sur-Richelieu, Québec J3B 5L4, Canada, develops OCHEF POS (Clover App ID 5ED6CY57HJPCM), a semi-integrated point-of-sale application that runs with Clover devices.

This Privacy Policy describes how we process personal data on behalf of the merchants that use OCHEF POS. It does not apply to any other context, such as our public website ochef.ca, which has its own privacy policy.

This Privacy Policy and our agreements with merchants govern our processing of personal data. If this Privacy Policy conflicts with a merchant agreement, the merchant agreement prevails to the extent permitted by applicable law.

This Privacy Policy does not replace any privacy notice that a merchant must provide to its own customers or personnel.

1. Information we collect

Merchants determine which data is transferred to or collected through the app, so the scope may vary from one merchant to another.

1a. Payment transactions

When a sale is paid on a Clover device, OCHEF POS sends the amount to the device through the Clover REST Pay Display API and receives the result from Clover: transaction status, amount, date and time, Clover payment and order identifiers, card brand, last four digits of the card, card entry method, authorization code and, when Clover returns it, the cardholder name read by the device. The items sold and the store location are recorded with the sale.

The full card number, expiry date, security code and PIN are entered only on the Clover device. OCHEF POS never receives or stores them.

1b. Ancillary customer information

Only when the customer chooses to provide it:

email address, to send an electronic receipt;
phone number, to send order notifications;
loyalty program activity (points earned and redeemed);
delivery address, for delivery orders.

1c. Merchant personnel information

OCHEF POS does not manage tips.

employee name or identifier linked to each sale, refund and cash report;
log-in times on the point of sale.

1d. Information merchants provide

Product catalogue, prices and taxes, as well as the customer and personnel records the merchant enters in the app (for example name, email, phone number and purchase or sales history).

2. How we use the information

We do not use this data for our own advertising and we do not sell it.

To provide the app: start payments on the Clover device, record sales, process refunds and voids, print or email receipts, produce sales and cash reports and manage loyalty points.
To send app updates, changes and security alerts.
To measure and improve the app.
To respond to inquiries, complaints and support requests.
To comply with the law and legal requests, enforce our terms, protect rights and safety, and prevent or investigate fraud and illegal activity.

3. How we share information

We may also disclose data to government authorities, law enforcement or private parties when required by law, or when needed to comply with legal requests, enforce our terms, protect rights or prevent fraud.

In a business transaction (merger, acquisition, reorganization, sale of assets or bankruptcy), data may be transferred; we will make reasonable efforts to require the recipient to honour this Privacy Policy.

With the merchant from whom, or on whose behalf, the data was collected.
With Clover, the platform the app runs on. Clover’s privacy notice: https://www.clover.com/privacy-policy
With third parties the merchant directs us to share it with.
With service providers that help us host and operate the app: DigitalOcean (hosting and database, Toronto region, Canada) and Brevo (sending of email receipts and SMS notifications).
With our subsidiaries and corporate affiliates, for the purposes described in this Privacy Policy.

4. Your rights and choices

Customers and personnel of a merchant should contact that merchant about its use of OCHEF POS. Requests about Clover’s own responsibilities should be sent to Clover, as explained in its privacy notice. We assist the merchant or Clover as required by our agreements.

You may send us a complaint using the contact details in section 5.

We may update this Privacy Policy at any time. Changes are shown by updating the effective date above.

5. Contact us

Person in charge of the protection of personal information: De Gaulle Hélou, 9394-3496 Québec inc. (Ô Chef), 415 boulevard du Séminaire Nord, Saint-Jean-sur-Richelieu, Québec J3B 5L4, Canada.

Email: [email protected] · Phone: 514 357-8397

6. Additional information for Québec and the rest of Canada

We process personal information in accordance with Québec’s Act respecting the protection of personal information in the private sector and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
The app’s data is hosted in Canada (Toronto region).
We keep personal information only as long as needed to provide the services, meet legal, tax and accounting obligations, resolve disputes and enforce our agreements.
Access to the app is protected by employee PIN codes, and all connections are encrypted (HTTPS). Clover access tokens are never displayed or logged.
You may ask to access or correct your personal information by contacting the merchant or us (section 5).

7. Additional information for merchants in Europe

OCHEF POS is not currently offered to merchants in the European Economic Area or the United Kingdom. If it were:

7a. Controller and processor

We act as a processor on behalf of the merchant, who is the controller of the data. Clover may act as a controller in some circumstances, as described in its privacy notice. We have not appointed a Data Protection Officer or an EU representative.

7b. Legal basis

The merchant is responsible for establishing the legal basis for processing.

7c. Cross-border transfers

When data is transferred out of Europe or the United Kingdom to a country without an adequacy decision, the transfer relies on EU-approved standard contractual clauses, binding corporate rules, the individual’s consent or another lawful ground under European law.

7d. Data retention

Data is kept as long as needed to provide the services, meet legal obligations, resolve disputes and enforce agreements.

7e. Rights of data subjects

Individuals have the right to access, correct, erase, restrict and port their data, to object to processing, to withdraw consent (without affecting prior lawful processing) and to lodge a complaint with a supervisory authority. Requests should be sent to the controller (the merchant).

8. Your California privacy rights

OCHEF POS is used by merchants in Québec, Canada. This section is provided for completeness.

8a. Rights

Information: the categories of personal information collected, their sources, the purposes, the third parties with whom it is shared, business disclosures and any sales, for the past 12 months.
Access: a copy of the personal information we hold about you.
Deletion: deletion of the personal information we hold about you.
Non-discrimination: we will not penalize you for exercising your rights, subject to the limited exceptions allowed by the CCPA.

8b. How to exercise your rights

By phone at 514 357-8397 or by email at [email protected]. We must verify your identity before responding, and your request must contain enough detail for us to evaluate it. A request may be made on behalf of a child under 13. An authorized agent may submit a request with your written authorization.

8c. Sale of personal information

We do not sell personal information to third parties, and we have not sold personal information in the past 12 months.

8d. Collection and sharing

Category	Collected	Shared for a business purpose
Identifiers (name, email, phone number)	Yes	Yes (service providers)
Online identifiers (IP address in server logs)	Yes	Yes (hosting provider)
Protected classification characteristics	No	No
Commercial information (purchases, loyalty)	Yes	Yes (service providers)
Biometric information	No	No
Internet or network activity	Yes	Yes (hosting provider)
Geolocation data	No	No
Sensory information	No	No
Professional or employment information (employee identifier, sales)	Yes	Yes (hosting provider)
Education information	No	No
Inferences	No	No
Financial information (card brand, last four digits, amounts)	Yes	Yes (Clover, hosting provider)
Medical information	No	No

8e. Glossary

Identifiers: name, email address, phone number, postal address or similar.
Online identifiers: IP address, device or session identifiers.
Commercial information: products purchased, transaction and loyalty history.
Financial information: payment card brand, last digits, transaction amounts and status.
Professional or employment information: employee name or identifier, sales and cash reports.

Privacy Policy for OCHEF POS