Privacy Policy

Our privacy contact is Emile Roy-Foster, Director, Operations & Systems. Email hello@pelicanseafood.ca, or write to us at the address above.

When you order online or at the kiosk, we ask for your name, your email address and your mobile number, and we keep the items, the pickup date and time, the tip (if you add one) and the total. We use your name to hand you the right order, your phone number to call or text you if something about your order changes, and your email to send your receipt. The receipt is also your copy of what you agreed to. We do not ask you to create an account and there are no passwords.

If your order includes alcohol, we ask you to confirm that you are 19 or older, and we check ID at pickup. We use the tick box only to let the order go through.

For School of Fish classes, we also ask for the name of every guest, and optionally each guest's email so they get their own class notes. We use guest names to keep the class list, greet people at the door, and manage allergies and seating. If you tell us about an allergy or a dietary need, we use it only to look after that guest.

For deliveries (orders from our online store and Lobster Dinner To Go), we also ask for the delivery address, apartment or unit, the buzzer code, an optional note for the driver (for example "leave with the concierge"), and, if the order is for someone else, that person's name and phone number. We use these only to deliver the order. Please only give us another person's details if they know and are happy for us to use them to deliver.

For Pelican Points (our loyalty program), your mobile number is your account. If you are already a member, your points are added to your number on every order. If you are new, we create an account only when you tick the box that says so. You can leave the program at any time.

If you write to us through the website contact form or by email, we keep your name, email, phone number (if you give it) and your message so we can reply.

If you sign up for our newsletter, we keep your email address and the date you signed up, and we use it to send you news and offers from Pelican. See "Newsletter and consent" below.

If you book a table, you do it with Resy, a separate company, and Resy collects your details (see "Who handles your information"). Resy passes the booking to us: your name, email address and phone number, the date, time and party size, any special requests and notes about the booking, how often you have visited, and any rating or comment you leave after your visit.

If you buy a gift card online, you do it with Loopz, a separate company.

We also record where you came from when you reach our store: the campaign tag on the link you clicked (for example an email newsletter or an advertisement) and the website you came from. This is attached to your order so we can tell which of our marketing works. It does not include anything about what you did on other sites.

To protect the card form from automated card-testing, we keep a scrambled one-way code of your internet address, not the address itself, along with a count of failed card attempts. It is deleted after two days.

We never receive or store your card number, expiry date or security code. When you pay online, the card form on our page is Square's, and your card details go straight to Square. We get back a single-use token and the result: approved or declined. At the kiosk, you tap or insert your card on Square's card reader.

We count what happens on our store, for example how many people opened the lobster page today and how many orders were placed. These are plain totals by day. They are not linked to you: no visitor ID, no session, no internet address, no device information.

We do not use Google Analytics, Google Ads, the Meta (Facebook) pixel or any other advertising or tracking tool on this website. We advertise on Facebook, Instagram and Google, but our website does not report your visit to them.

Our web server keeps a standard log of each page request (the time, the page address without anything after a "?", your internet address, the kind of browser you use, and the site you came from, with anything after a "?" removed). We use it to keep the site secure and to fix faults. See "How long we keep it".

Our website and store do not set cookies. We use your browser's temporary tab storage (sessionStorage) to keep your cart and the details you have typed while you are checking out, so a refresh does not lose them. It stays on your device, we do not read it from our servers, and it clears when you finish the order or close the tab.

Square's card form, which appears when you pay online, is run by Square and sets two cookies from Square's own domain: one for security and fraud prevention (called _savt, lasts about 13 months) and one that tells people from bots (called __cf_bm, lasts about 30 minutes). We have no control over them.

Videos, reservations and gift cards are loaded only when you press play or press the button. Until you do, nothing is requested from YouTube, Resy or Loopz. When you do, that company may set its own cookies; see its privacy policy.

We ask for your agreement, in a way you can see and understand, before we collect or use your information. When you order, you agree to our using your details to prepare and deliver your order and to send your receipt. That is what the details are for, and we do not use them for anything unrelated.

Placing an order does not sign you up for our newsletter. We send newsletters and offers by email only if you have signed up for them, or if you have bought from us in the last two years and not unsubscribed, as Canada's anti-spam law (CASL) allows.

Every newsletter has an unsubscribe link, and we act on it within 10 business days (usually at once). You can also write to us, and we will take you off. We keep your address on a "do not email" list afterwards so that you are not added again by mistake.

Our order receipts are not marketing. If we ever add a "Order this again" or similar link to a receipt, the receipt will carry an unsubscribe link as well.

You can withdraw consent to anything we do with your information, subject to legal and contract limits, by contacting us. If you do, we will tell you what that means (for example, we cannot deliver a dinner without an address).

We use these companies to run the business. Each one handles your information only to do its job for us, and each has its own privacy policy.

- Square (Block, Inc.) takes card payments, holds our orders, class bookings and customer records, runs Pelican Points (Square Loyalty), supplies the card reader and holds our sales records. Square stores and processes information in the United States, Japan and other countries. Square's card form may also send technical error reports to Square's service providers.

- Google (Google Workspace) sends our emails, including your receipt, and holds the emails we send and receive. Its servers are in the United States and other countries.

- Mailchimp (Intuit) sends our newsletter and holds the newsletter list. It is based in the United States.

- Resy (an American Express company) runs table reservations, and its booking window appears on our site only when you open it. It is based in the United States.

- Loopz (Loopz Technologies, Inc., of Round Rock, Texas) sells and manages gift cards, and its window appears on our site only when you open it. Loopz stores information in the United States.

- Trexity delivers the orders you choose to have delivered, from our online store and Lobster Dinner To Go. We give it your name, phone number, delivery address, unit, buzzer code, driver's note and the delivery window, only for those orders. Trexity is an Ottawa company; its privacy policy says it processes information in the United States and keeps it only as long as it needs it.

- Uber (Uber Direct) also delivers some orders from our online store, mainly those close to the store. We give it your name, phone number, delivery address, unit, buzzer code, driver's note, the delivery window and the list of items, only for those orders. Uber's courier takes a photo of the order when collecting it and when leaving it with you, as proof of delivery. Uber is based in the United States and processes information there.

- OVH hosts our website and store on a server in Beauharnois, Quebec, Canada. We also run our staff tools on an OVH server in Beauharnois.

- Hetzner holds encrypted backup copies of our systems, in Germany. They are encrypted on our server before they are sent, so Hetzner cannot read them.

- Twilio sends text-message alerts to our own staff when a system has a fault. These texts contain no customer information and are never sent to customers.

- YouTube (Google) shows videos if you press play.

- Our accountants and bookkeepers see sales and tax records.

We do not sell your information, and we do not give it to anyone for their own marketing. We may disclose it where the law requires, for example in answer to a court order.

Some of your information is held in Canada (our web server and our staff tools) and some outside it: in the United States (Square, Google, Mailchimp, Resy, Loopz, Trexity, Uber) and in Germany (encrypted backups). When your information is in another country, it can be accessed by courts and law-enforcement agencies in that country under its laws. We use companies that protect your information with contracts and security measures, and we tell you about this before you order.

At checkout there is a one-line notice saying that your payment and order details are processed by Square in the United States and other countries, with a link to this policy.

We keep information only as long as we need it for the purpose we gave, or as long as the law requires.

- Orders, class bookings and sales records (in Square): six years from the end of the tax year in which they were made, because Canadian tax law requires us to keep business records for six years.

- Emails we send and receive, including receipts and messages you send us (in Google Workspace): six years, the same as our order records, because receipts are part of them.

- Delivery details (the address, unit, buzzer code and driver's note) are part of the order and are kept with it in Square. The copies on our own server, used to book and follow the courier, are cleared 30 days after the delivery, and the lists we send to Trexity for Lobster Dinner To Go are deleted within 30 days after the event. Uber and Trexity keep their own records of each delivery, including Uber's proof-of-delivery photos, under their own privacy policies.

- Reservation details from Resy: six years after the booking. We use past bookings to plan staffing and seating.

- Newsletter list: until you unsubscribe. Your address then stays on our "do not email" list.

- Pelican Points: while your account is open, and until you ask us to close it. Points do not expire.

- Website visit counts: kept as totals. They contain no personal information.

- Failed-payment records (the scrambled code of your internet address): two days.

- Web server logs: 14 days. Application logs: at most 30 days.

- Backups: up to 12 months. Information we delete from our live systems stays in the backups until they age out.

- Records of security breaches: 24 months, as the law requires.

When we no longer need information we delete it or make it anonymous.

We protect your information with measures that fit how sensitive it is.

- The website and store are served over encrypted connections (HTTPS). - Card details never reach us, and the store loads from other companies only Square's payment form, fonts and Square's own product photos. - The page where you pay is watched for unexpected changes, and the store has limits on repeated failed card attempts. - Staff tools require sign-in, and only the staff who need customer information to do their job can see it. - Our backups are encrypted. - The public web server does not hold the keys to our email account; a separate, protected server sends our email. - We keep a record of every security breach. If a breach involving your information creates a real risk of significant harm to you, we will tell you as soon as we can, and we will report it to the Privacy Commissioner of Canada, as the law requires.

No system is perfectly secure. If you think your information has been misused, contact us straight away.

You can ask us:

- what information we hold about you and what we have done with it; - to correct anything that is wrong; - to stop using or to delete your information, where we are not required to keep it; - to take you off the newsletter or leave Pelican Points.

Email hello@pelicanseafood.ca or write to us at the address above. We may need to confirm who you are first, usually by asking for details only you would know. We answer within 30 days and normally do not charge. If we must refuse a request, we will tell you why. If we need more time, we will tell you before the 30 days are up.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

Our website and store are for adults. We do not knowingly collect personal information from children. Our cooking classes are for guests 19 and older.

If we change how we handle your information, we will update this page and its date. If a change is significant, for example a new company handling your information, or a new reason for using it, we will tell you before we start, and we will ask for your agreement if the law requires it. Earlier versions are available on request.

This policy was last updated on November 2, 2026.