Privacy Policy

We collect only the personal information necessary for the purposes for which it is collected. This may include:

• Identification information: name, first name, email address, phone number, postal code
• Browsing data: IP address, browser type, pages visited, visit duration, cookies and similar technologies
• Communication data: messages sent via our contact form or by email
• Franchise application data: personal and professional information provided when applying for a franchise (desired location, down payment availability, etc.)
• Newsletter data: email address used for promotional communications

We use your personal information for the following purposes:

• Responding to your requests and providing customer service
• Sending you our newsletter and promotional communications (with your consent)
• Improving our website through statistical analysis
• Measuring the effectiveness of our advertising campaigns
• Processing your franchise applications
• Displaying the location of our restaurants and their opening hours
• Complying with our legal obligations

We never sell your personal information. We share your data only with service providers necessary for the operation of our website and our operations, as described below.

Who has access to your information at Poulet Royal?

Access to your personal information is limited to Groupe Limonade staff, agents and representatives who need it in the performance of their duties (customer service, marketing, management).

Our employees are trained on the importance of protecting personal information and have access only to the information necessary to perform their tasks.

Third-party service providers

• Google LLC (United States)
  Google Tag Manager (tag and script management), Google Ads (conversion measurement), Google Maps (map and restaurant locations). Safeguards: Standard Contractual Clauses, EU-U.S. Data Privacy Framework certification, data encryption.
  Google Privacy Policy →
• Meta Platforms Inc. (United States)
  Meta Pixel to measure the effectiveness of our Facebook/Instagram advertising and build audiences. Safeguards: Standard Contractual Clauses, EU-U.S. Data Privacy Framework certification.
  Meta Privacy Policy →
• Microsoft Corporation (United States)
  Microsoft 365 (SMTP) for routing contact and franchise emails. Microsoft acts as a processor and is bound by contractual confidentiality obligations.
  Microsoft Privacy Statement →
• Online ordering platforms
  Some Poulet Royal locations offer online ordering through third-party partner platforms. These platforms manage their own data collection, including payment information. Their own privacy policies apply to these interactions. We encourage you to review them.

Transfers outside Quebec

The providers mentioned above (Google, Meta, Microsoft) process data on servers located mainly in the United States. In accordance with section 17 of the Act respecting the protection of personal information in the private sector, we ensure that these transfers are governed by adequate contractual safeguards (standard contractual clauses, recognized certifications).

In accordance with Bill 25, you have the following rights regarding your personal information:

• The right to request access to the personal information we hold about you
• The right to request the correction of inaccurate, incomplete or ambiguous information
• The right to request the deletion (erasure) of your information in cases provided by law
• The right to withdraw your previously given consent
• The right to object to the processing of your information in certain circumstances
• The right to data portability: to receive your information in a structured, commonly used technological format
• The right to request the cessation of the dissemination of your personal information

To exercise these rights, contact our person in charge of the protection of personal information at [email protected]. We are committed to responding within 30 days of receiving your request. If your request is complex, this deadline may be extended by an additional 30 days, with notice.

Right to file a complaint

If you believe we have not adequately addressed your concerns, you have the right to file a complaint with:

Commission d'accès à l'information du Québec (CAI) — Phone: 1-888-528-7741 — Website: www.cai.gouv.qc.ca

We take the security of your data very seriously. Our protection measures include:

Technical measures:

• Encryption of data in transit (TLS v1.2+)
• HTTPS protocols across the entire site
• Secure authentication and role-based access controls
• Regular data backups

Organizational measures:

• Access to information limited to authorized personnel
• Staff training on the protection of personal data
• Internal access control policies
• Security incident response procedures
• Documentation of all confidentiality incidents for 5 years

Data breach notification

In the event of a breach of the security of your personal data that presents a serious risk of harm, we are committed to:

• Informing you as soon as possible (no later than 72 hours after discovery)
• Notifying the Commission d'accès à l'information du Québec (CAI)
• Recording the incident in our confidentiality incident register

Limitations

No method of transmission over the Internet or electronic storage is completely secure. Although we do our best to protect your information, we cannot guarantee absolute security. We encourage you to exercise caution when transmitting personal information online.

We retain your personal information only as long as necessary to: respond to your request or provide you with the requested service, comply with our legal obligations, resolve any disputes, enforce our agreements.

As a guide:

• Contact requests: 2 years following our last interaction
• Newsletter subscribers: Until unsubscribe
• Franchise applications: 3 years following closure of the file
• Advertising data (Google, Meta): According to each platform's own settings

Secure deletion

When your information is no longer necessary, we delete or anonymize it in a secure manner, in accordance with the requirements of Bill 25 and industry best practices.

We may update this Policy periodically to reflect changes in our practices or applicable legislation. We will inform you of any significant changes by publishing the new version on this page with an updated revision date. Your continued use of our site after the publication of a modified version constitutes your acceptance of the changes.

For any questions regarding this Policy or to exercise your rights, please contact us:

Response time

For any access, correction or deletion request, we are committed to responding within 30 days in accordance with Bill 25. If your request is complex, we may extend this deadline by an additional 30 days, with prior notice.

We are committed to complying with the following legislation:

• Act respecting the protection of personal information in the private sector (CQLR c P-39.1), as amended by Bill 25
• Personal Information Protection and Electronic Documents Act (PIPEDA) — applicable to interprovincial activities