Data protection for your event.

What we offer

When you order for your staff or guests, you may give us information about them: who is coming, and what they can and cannot eat. Two documents are available to you, at no charge, and both are printed in full on this page.

• The Business Customer Data Protection Terms fit almost every order. Each of us handles the information we hold for our own purposes: you for your people, we for the order, its payment, our accounts and food safety.
• The Data Processing Addendum is for the rarer case in which you ask us to handle information about your people only on your written instructions. It needs a completed schedule and both signatures before any of that information is sent.

How to ask for them

Write to searandshred@gmail.com before you send us any attendee information, with your organization's name and your order or booking reference. We complete the schedule with you, both of us sign, and you receive a copy. A link to this page is not a signed agreement.

The schedule records:

• The legal name and contact of the business customer, and of Sear & Shred
• The order or contract the terms attach to
• What the processing is for, and how long it lasts
• Whose information it is (for example attendees) and which details
• The customer's instructions
• Any sensitive details that are truly needed, and how they are supplied
• The contacts for requests and for incidents
• When the information is returned or deleted

Please send as little as the event needs. A count of meals and a count of each dietary requirement, without names, is usually enough.

Business Customer Data Protection Terms

1. Limited information

   The parties share only the contact, service and attendee information needed for the agreed catering or event. Dietary counts without names are preferred wherever they are enough. Each party gives the notices, and holds the authority or consent, required for the information it supplies.

2. Each party is responsible for its own handling

   Each party decides, and remains responsible for, its own lawful handling of the information. Sear & Shred uses order, payment, accounting and food-safety information to provide its service and meet its legal duties, as its privacy policy describes. The business customer remains responsible for its staff and attendee information. Neither party uses the other's attendee information for unrelated marketing, sells it, or uses it to train artificial intelligence.

3. Sensitive information

   A guest may give allergy details to Sear & Shred directly. Information shared by the organizer is kept to what is necessary and is supplied with the guest's agreement. Health details are restricted to the people assessing, cooking and serving the order and are kept out of general calendars and out of analytics.

4. Safeguards, requests and incidents

   Each party keeps safeguards appropriate to the information. Each helps the other answer a request from a person about their own information. Each tells the other promptly of a confirmed incident affecting shared information where the other needs to act or to notify. Each remains responsible for its own legal duties after a breach. Information is kept only for the stated operational and legal purposes, for the periods in Sear & Shred's privacy policy.

5. Processing on instruction

   If the business customer asks for a distinct activity that Sear & Shred would carry out only on the customer's instructions, the parties complete a schedule and sign the Data Processing Addendum below before that activity begins. These terms do not by themselves make a food order a processing service.

Data Processing Addendum

1. Scope and roles

   This Addendum covers the attendee information listed in its schedule that the business customer provides for Sear & Shred to handle on the customer's documented instructions. Each party remains responsible for information it uses for its own lawful purposes. Sear & Shred handles its own order, payment, accounting and food-safety records under its privacy policy.

2. Lawful instructions

   The customer provides only the information needed for the agreed service and has the authority, and has given the notices or obtained the consent, needed to supply it. Sear & Shred follows the documented instructions, tells the customer if it believes an instruction is unlawful, and does not use the covered information for unrelated marketing, sell it, or use it to train artificial intelligence.

3. Sensitive details

   Full staff lists and medical histories are avoided where meal counts and dietary counts without names meet the need. Allergy information that names a person is collected through a confidential route, for a stated purpose and with that person's agreement. The schedule identifies any sensitive information that is truly needed for safe service.

4. Confidentiality and safeguards

   Access is limited to the people who need the information for the service and who are bound to keep it confidential. Sear & Shred applies the safeguards listed in the security schedule below and keeps them appropriate to the information and the risk.

5. Other providers and transfers

   Only the service providers published on the service providers page handle covered information, each for its stated service. Some process information outside Canada; the countries are disclosed there. Any further transfer terms the law requires are agreed before the transfer.

6. Changes of provider

   Sear & Shred tells the customer by email before a new provider starts to handle covered information. The customer may raise a data protection concern within 14 days. The parties then look for an alternative; if there is none, the affected processing ends under the contract, without affecting any right the law gives.

7. Requests from individuals

   Sear & Shred promptly passes to the customer's contact any request about covered information and gives reasonable help with access, correction and deletion. It answers requests about its own order and legal records itself. Neither party discloses one attendee's information to another without a lawful basis.

8. Security incidents

   Sear & Shred tells the customer without undue delay after confirming a breach of safeguards affecting covered information, shares the facts it has and updates them, and cooperates on containment and on any notice the law requires. This does not move either party's own reporting duty to the other.

9. Return and deletion

   When the covered processing ends, Sear & Shred returns or deletes the covered information, subject to what the law requires it to keep. Anything kept is identified, protected and used only for the purpose it is kept for. Copies in backups expire on the provider's schedule.

10. Evidence and review

    Sear & Shred gives the customer reasonable information to show that it keeps these commitments, by document review first. An agreed inspection must protect other customers' information, security details and the working of the kitchen. No certification is implied by this Addendum.

11. Liability and precedence

    This Addendum adds to the contract for the service and takes precedence over it for covered processing. Any allocation of liability applies subject to law that cannot be waived; it does not waive a privacy obligation or a consumer's rights.

12. Signature

    The parties complete the processing schedule and sign this Addendum before covered information is provided. Where the law of another territory applies, the parties add what that law requires; this Addendum does not by itself promise compliance with the law of every country.

Security schedule

These are the safeguards the Addendum refers to. They are what the website and the business do today.

• Pages, forms and the order service are reached over an encrypted connection only.
• Every order is paid by Interac e-Transfer: Sear & Shred takes, receives and stores no card details.
• Order records can be opened only by the people who run the kitchen, through a separate owner sign-in with Google and a second factor. Session identifiers and recovery codes are kept only as one-way fingerprints, and the authenticator key is stored encrypted.
• The credential that lets the website send email from the business Google account is stored encrypted, and that permission can send email only.
• Allergy and dietary details are not written to the business calendar and are not sent to analytics.
• A paid order's record cannot be altered once it is paid. Records of unpaid requests lose their personal details on the schedule in the privacy policy.
• Forms are rate limited, and the counters hold a one-way fingerprint, never a network address.

We hold no security certification and do not claim one.

Service providers

The providers that handle information for us, what each receives and where it is processed are on the service providers page. Our privacy policy covers the order, payment and accounting records we keep in our own right.