Last updated: October 5, 2026

Privacy Policy

This privacy policy (the “Policy”) applies to Mandy’s Salads Inc. and its subsidiaries and affiliated entities under its direct or indirect control (individually or collectively, “Mandy’s,” “we,” “us” or “our”). It explains what personal information we collect, how and why we use it, with whom we share it, how long we keep it, and the rights you have, including under Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) and Canada’s Anti-Spam Legislation (“CASL”).

This Policy applies to individuals who:

use our websites and web applications (collectively, the “Website”);
buy or consume products sold, supplied or made by us, directly or indirectly;
enter our contests;
interact with us online, offline or in person at our premises.

These individuals are referred to as “you” or “your.” Your use of the Website is also subject to our Legal Notice. If you have any questions about this Policy or wish to exercise your rights, please contact us using the information in section 14.

1. Definitions

Personal information means any information about an individual that allows that individual to be identified, directly or indirectly, such as a name, address, telephone number or email address.
Sensitive personal information means personal information that, because of its nature (for example, health information) or the context in which it is used or communicated, gives rise to a high level of reasonable expectation of privacy.

2. Personal information we collect

Depending on how you interact with us, we may collect the following categories of personal information:

Category	Details
Contact and identity data	Name, email address and telephone number.
Email marketing data	Subscription status, consent records (date, source and language), preferred language, favourite restaurant, and unsubscribe records.
Sales data	Details of your purchases, such as the date, restaurant, items ordered, billing and delivery information. Payment card details are processed by our payment providers and are not stored by us.
Business contact data	Name, job title, business contact details, correspondence history, order and sales history, and preferences (including marketing preferences).
Profile data	Interests, preferences and survey responses.
Correspondence data	Records of your communications with us, such as emails or messages sent through social media.
Contest data	Information you provide when entering a contest, such as your name and address and, for winners, proof of identity.
Health data	Information about food allergies or dietary restrictions that you choose to share with us so that we can accommodate you or comply with legal requirements.
Technical data	IP address, browser type, operating system and related technical details when you use our Website.
Usage data	Information about how you interact with our Website or our social media pages.
Visitor data	Information about visits to our premises, such as access logs and the purpose of the visit.
Video surveillance data	Images recorded by security cameras at our premises, used only for security purposes (incidents, theft prevention and the safety of customers and staff), in accordance with our internal policy.

We may anonymize personal information so that it irreversibly no longer allows anyone to be identified, and use the anonymized information for statistical analysis, research and improving our services, as permitted by law.

3. Sensitive personal information

We collect sensitive personal information, such as allergy or dietary information, only when it is necessary to provide the service you request or when required by law, and only with your express consent. We apply additional safeguards to this information.

4. How we collect personal information

4.1 Directly from you

When you contact us by mail, telephone, email, through our Website or social media, or when you take part in surveys, contests, events or meetings at our premises.

4.2 Through our Website and online services

For example, when you:

subscribe to our newsletter or update your email preferences;
place an order through our online ordering or buy gift cards;
create an online account for take-out or delivery;
join a loyalty program;
enter an online contest;
ask about franchise opportunities or apply for a job;
send us a question, comment or complaint.

4.3 From third parties

Service providers that operate services on our behalf, such as online ordering and payment providers.
Business partners, with your consent.
Your employer or organization, for business contact data.
Payment providers and fraud-prevention services, for sales and fraud-prevention data.
Analytics services (such as Google Analytics), for technical and usage data, with your consent.

4.4 Automatically, with your consent

Through cookies and similar technologies when you visit our Website (see section 5).

5. Cookies and similar technologies

We use cookies and similar technologies to operate our Website, remember your preferences and understand how the Website is used.

Necessary cookies are required for the Website to function and are always active.
Functional, analytics and advertising cookies, including those of third parties, are used only if you consent. They are turned off by default.

You can accept, refuse or customize these cookies through the banner shown on your first visit, and change your choice at any time through the cookie settings on our Website. Refusing some cookies may affect certain features. We do not sell personal information collected through cookies.

6. Why we use personal information

We use personal information only for the following purposes, for other purposes with your consent, or as otherwise permitted or required by law:

Orders and accounts: to process online orders and gift card purchases, manage your accounts, and provide take-out, delivery and loyalty services.
Inquiries and complaints: to respond to your questions, comments and complaints, and to investigate and follow up on them.
Marketing and promotions: to send newsletters, updates and offers by email or mail (see section 7), to offer loyalty benefits, and to publish marketing content.
Improvement: to monitor quality, improve our products, services and Website, and develop new products, including through analytics.
Relationship management: to inform you of changes to this Policy, and to ask for reviews or survey participation.
Contests: to run contests, contact winners and deliver prizes.
Accommodations: to accommodate food allergies and dietary or religious requirements.
Employment and franchising: to process job and franchise applications.
Security and fraud prevention: to protect our premises, systems, customers and staff, enforce our terms, and prevent fraud.
Business operations and legal compliance: to administer our business, comply with our legal obligations, and establish, exercise or defend legal claims.

7. Email communications

We send our newsletter and offers by email in two situations:

You subscribed. When you sign up through one of our sign-up forms, we send you a confirmation email, and you are only added once you confirm. We keep the date, the page or channel, and your language choice as a record of your consent.
You recently ordered from us. If you placed an order directly with Mandy’s through our own online ordering within the last two years, we may occasionally email you about our products, restaurants and offers, as permitted by CASL. For this, we use your name, email address, and the date and restaurant of your most recent order. This ends two years after your last order, or as soon as you unsubscribe. We never use information from third-party delivery apps (such as Uber Eats or DoorDash) for this purpose.

Personalization. We may combine your email preferences (language, favourite restaurant) with your order history with us to send you relevant content, such as news from the restaurant you visit most.

Email statistics. We measure opens and clicks on our emails in aggregate to improve them. We do not track individual recipients’ activity.

Unsubscribing. Every email includes an unsubscribe link and a link to your preferences page, where you can change your language or favourite restaurant, or request the deletion of your data. You can also contact our Privacy Officer (section 14). Unsubscribe requests take effect immediately and, in all cases, within 10 business days.

Where this information is stored. Our email service is hosted in Canada, on servers located in Montréal, Quebec.

8. Sharing of personal information

We do not sell your personal information. We share it only as necessary for the purposes described in this Policy, with your consent, or as required or permitted by law, with:

Service providers acting on our behalf, such as online ordering and payment providers, our email service, website hosting, IT services, analytics providers and marketing agencies. They are bound by contract to protect your information and to use it only to provide their services to us.
Professional advisers, such as lawyers and auditors.
Financial institutions, to process payments.
Public authorities and law enforcement, when required by law.
Our affiliates, for business reporting, data hosting, and audit and legal services.
A purchaser or successor in the event of a merger, sale of assets or similar transaction, subject to an agreement that protects your information.

9. Information processed outside Quebec

Some of our service providers may store or process personal information outside Quebec, in other provinces or in other countries such as the United States, where privacy laws may differ. Before communicating personal information outside Quebec, we assess the privacy impacts and ensure, through contracts and other measures, that the information will receive adequate protection, as required by Quebec law. Our email marketing data is hosted in Montréal, Quebec.

10. Retention

We keep personal information only as long as necessary for the purposes for which it was collected, or as required by law. Then we securely destroy or anonymize it. In particular:

Newsletter subscribers: as long as you remain subscribed.
Customers emailed because of a recent order: removed from our mailing lists two years after their last order.
After you unsubscribe: we keep your email address and a record of your consent and unsubscribe for up to three years, only to honour your choice and demonstrate our compliance.
Backups: backup copies of our email service are deleted within 35 days.

11. Security

We take reasonable security measures to protect personal information, including access controls, encryption where appropriate, privacy procedures and staff training. No method of transmission or storage is completely secure. If a confidentiality incident presents a risk of serious injury, we will notify the Commission d’accès à l’information and the affected individuals, as required by law.

12. Children

Our services are not intended for children under 14. We do not knowingly collect personal information from a child under 14 without the consent of a parent or guardian. If you believe a child under 14 has given us personal information, please contact us and we will delete it promptly.

13. Your rights

Subject to applicable law, you have the right to:

access the personal information we hold about you and obtain a copy;
have inaccurate, incomplete or outdated information corrected;
withdraw your consent at any time, including to email marketing;
receive personal information you provided to us in a structured, commonly used technological format, or have it transferred to another organization (data portability);
ask us to stop disseminating your personal information, or to de-index any hyperlink attached to your name, where the law allows;
be informed of the personal information used to make a decision about you based exclusively on automated processing, if we make such a decision;
file a complaint with the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca).

To exercise these rights, contact our Privacy Officer (section 14). We may ask you to verify your identity. We respond to requests within 30 days, at no charge in most cases.

14. Contact us

The person in charge of the protection of personal information at Mandy’s is our Privacy Officer:

Mandy’s Salads Inc.
Attention: Privacy Officer
642 De Courcelle, Suite 304
Montréal, Quebec H4C 3C5
[email protected]

15. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top shows when it was last changed. We will inform you of significant changes by appropriate means, such as a notice on our Website or by email.