The legal disclaimer

The site accessible at https://www.boulangerie-ange.ca is operated and published by Ange Canada Inc., a corporation (Incorporation), whose head office is located at 1275 Rue Gay-Lussac, Boucherville, QC J4B 7K1, registered with the Quebec Business Register, represented by its President.

The contact information for Ange Canada Inc. is as follows:

• Email: contact@boulangerie-ange.ca
• Phone: 514-974-8940
• Postal address: Ange Canada Inc, 1275 Rue Gay-Lussac, Boucherville, QC J4B 7K1.

The publication and editorial director is Rémi CERVILLA.

The site was created by a web development agency based in France: www.answeb.net.

The site is hosted by OVH, in its Erith data centre, in the United Kingdom. The host can be contacted at the following address: OVH SAS, RCS Lille Métropole 424 761 419, headquartered at 2 rue Kellermann – 59100 Roubaix – abuse@ovh.net.

PRIVACY POLICY

Ange Canada Inc., a corporation (Incorporation) with its head office located at 1275 Rue Gay-Lussac, Boucherville, QC J4B 7K1, represented by its President, operates a network of “ANGE” bakery sales points in Canada, either owned or franchised (hereinafter referred to as “ANGE”).

This privacy policy aims to inform visitors and users of the site and application about the conditions and terms of collection and processing of personal data concerning them, within the framework of their use of the site and the application.

Users are informed that certain personal data is necessary for ANGE to provide its products and services. If users refuse to provide certain data, it may result in ANGE being unable to fulfill its services.

This privacy policy may be modified at any time to comply with legislative changes or technical adjustments. Users are encouraged to consult the latest version before navigating.

1 – DATA CONTROLLERS

The data controller for the personal data collected on the site and the application is:

Ange Canada Inc., a corporation (Incorporation) with its head office located at 1275 Rue Gay-Lussac, Boucherville, QC J4B 7K1, represented by its President – Email: contact@boulangerie-ange.ca – Phone: 514-974-8940.

As the data controller, Ange Canada Inc. collects, stores, and processes personal data in accordance with Law 25 on the protection of personal information in Quebec and the General Data Protection Regulation (GDPR) of the European Union for international transactions.

For any questions regarding this privacy policy or the collected data and related rights, individuals can contact ANGE at the following postal address: 1275 Rue Gay-Lussac, Boucherville, QC J4B 7K1, by email at: contact@boulangerie-ange.ca, or by phone at: +1 514-974-8940.

Depending on the purposes for which personal data collected on the Site or Application is processed, other companies within the ANGE network may have access to the collected personal data as recipients of the data.

Any collection initiated by one of the ANGE network franchisees, on their own initiative, outside the framework set out in this privacy policy, shall be carried out under the responsibility of that franchisee.

2 – PERSONAL DATA COLLECTED

In the context of using the Site and the Application, the following data may be collected, depending on the activities performed:

User Account or Client Account Data:
Essential personal data required for user registration, including the information provided during account creation when filling out the registration form: title, first name, last name, postal address, date of birth, email address, landline and/or mobile phone numbers, username, and password for logging into the client account.

Loyalty Program Data:
Essential personal data required for creating a loyalty account, including information provided during the application for membership in the loyalty program: title, first name, last name, postal address, date of birth, email address, landline and/or mobile phone numbers, loyalty card number, and, if applicable, username and password for logging into the client account.

Transaction Data:
Essential personal data necessary for recording, preparing, and tracking orders made through the client account (pick-up) or loyalty program: amount, date, and details of product purchases within the ANGE network, selected store, emails or SMS, application of promotional offers, responses to satisfaction surveys, information on the type of device used to access online services, IP address, geolocation (if accepted in the user’s browsing settings).

Correspondence Data:
Essential personal data necessary for receiving and processing requests made by users via the “Contact” tab or through customer service (including email): title, first name, last name, postal address, date of birth, email address, landline and/or mobile phone numbers, loyalty card number if applicable, data related to the contact request.

Browsing Data:
Essential personal data necessary for tracking browsing on the Site or Application, including date, time of connection and/or browsing, type of browser, browser language, IP address, location data, and geolocation (if accepted in the user’s browsing settings), display preferences, statistical data (number of pages viewed, number of site visits, etc.). Cookies may be used to enhance user experience and personalize browsing.

When collecting personal data, users will be informed that certain personal data marked with an asterisk (*) must be provided. If users do not wish to provide this data, their request may not be processed or ANGE may not be able to fulfill its services.

3 – PURPOSES AND LEGAL BASES FOR PROCESSING

• Creation and management of the user’s client account on the site or application: In this case, to establish a connection with users and create the ANGE client database, the legal basis for processing is the execution of the contract and/or the user’s consent.
• Loyalty program: In this case, to create an ANGE client database and offer promotional benefits and commercial offers, the legal basis for processing is the execution of the contract and/or the user’s consent.
• Contact form, email correspondence address: In this case, to respond to user requests (satisfaction, information, quality, inquiries, commercial follow-up), the legal basis for processing is the legitimate interest of the data controller and the user’s consent.
• Order management for pickup (order preparation, sale): In this case, for order fulfillment, the legal basis for processing is the execution of the contract and/or compliance with legal or regulatory obligations.
• Commercial prospecting: Sending newsletters and loyalty offers if the user consented during registration on the site or application: In this case, to establish contact or inform users who have consented about ANGE network news and promotional offers, the legal basis for processing is the legitimate interest of the data controller and the user’s consent.
• Site usage: Navigation on the site and cookies: In this case, to ensure the proper functioning of the Site and Application, offer tailored offers, provide a secure site, and personalize content on the Site and Application, the legal basis is the legitimate interest of the data controller or the user’s consent. Only “functional” cookies that improve the functioning of the Site and Application are automatically deposited when the user arrives on the Site or Application. It is specified that the Site and Application may provide links to sites, applications, and services other than those of ANGE, which may be operated by third parties, and in these cases, ANGE is not responsible for the processing of personal data by these third-party sites. The user should consult the personal data protection policies of these third-party sites.
• Response to requests for the exercise of rights: In this case, to respond to requests for exercising the rights described in Article 6, the legal basis for processing is compliance with legal or regulatory obligations.

4 – RECIPIENTS OF PERSONAL DATA

In the context of achieving the purposes described above, user data from the Site and the Application will be exclusively accessible:

• To other companies in the ANGE network, including franchises: This allows for better service and support within the ANGE franchise system.
• To any public or administrative authority, or administrations, if applicable: This may include compliance with legal obligations or responding to governmental requests.
• To ANGE subcontractors, including its data host: This includes entities responsible for hosting the data or the Site, the Application provider, and any external parties needing access to personal data to fulfill the stated purposes. These also include Brevo, which delivers the notification emails sent from the Site, and Adelya, the technical operator of the loyalty program. The third-party services used by the Site are named in section 8.

5 – DURATION OF PERSONAL DATA RETENTION

Personal data is retained for a duration that does not exceed what is necessary for the purposes for which it was collected, as outlined in section 3. This includes, depending on the circumstances, as long as the user’s consent remains in effect, for the time necessary to process requests, the duration of the contractual relationship, or to fulfill legal or regulatory obligations that ANGE is subject to.

ANGE may also retain personal data for longer periods, particularly for archiving purposes.

Regarding cookies, the user’s decision on the optional purposes is kept for six months, after which they are asked again. Cookies strictly necessary for the Site to work last only for the duration of the visit. Details are given in section 8.

6 – RIGHTS OF DATA SUBJECTS

Users of the Site and Application, as data subjects, have the following rights regarding their personal data processed by ANGE:

Right of access
Upon request and free of charge, ANGE can provide the data subject with information regarding their personal data processed and, if applicable, a copy of such data.

Right to rectification
If personal data is inaccurate or incomplete, the data subject has the right to request rectification.

Right to erasure
The data subject can request the deletion of their personal data in certain cases, especially when it is no longer necessary for the purposes for which it was collected, subject to ANGE’s legal obligations regarding the data in question. If the user has the right to delete their personal data and it has been made public, ANGE will take reasonable steps to delete it and, considering available technologies, inform third parties processing the data whose deletion has been requested.

Right to object
The data subject can object to the processing of their personal data, noting that providing certain personal data is essential for the execution of specific services. Such data is marked with an asterisk during consent requests. ANGE may also cease processing certain data unless the processing serves overriding legitimate interests.

Right to restriction
The data subject can request the restriction of processing their personal data in certain situations, such as when contesting the accuracy of the data or objecting to the processing.

Right to withdraw consent
At any time, if data is processed based on consent, the data subject may withdraw their consent for future processing without affecting the legality of the processing carried out prior to withdrawal.

Right to data portability
The data subject has the right, where applicable based on the purpose and legal basis for processing, to obtain personal data in a structured, commonly used, and machine-readable format for reuse or transfer to a third party of their choice.

Right in relation to automated decision-making and profiling
The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them, unless it relates to the execution of a contract or compliance with legal obligations.

Right to digital testament
The data subject can provide general or specific directives regarding the fate of their personal data after their death.

Right to lodge a complaint with the relevant data protection authority
In the event of difficulties regarding personal data processing, the data subject can lodge a complaint with the Commission d’accès à l’information du Québec: https://www.cai.gouv.qc.ca.

Conditions for exercising rights

The data subject can exercise all of these rights at any time by contacting ANGE at the following postal address: 1275 Rue Gay-Lussac, Boucherville, QC J4B 7K1, addressed to the President, or by email at: contact@boulangerie-ange.ca, or by phone at 514-974-8940.

7 – CONFIDENTIALITY AND DATA SECURITY

As data controllers, the ANGE companies commit to taking all necessary precautions to ensure the confidentiality and security of the personal data communicated, particularly to prevent any alteration, distortion, or unauthorized access by third parties.

In this regard, ANGE implements organizational and technical security measures aimed at ensuring the confidentiality and integrity of personal data, including material and electronic protection measures to prevent any loss, misuse, unauthorized access, disclosure, alteration, or potential destruction of data.

Thus, without this list being exhaustive:

• The personal data collected via the Site is hosted by OVH, in its Erith data centre, in the United Kingdom. It is therefore kept outside Quebec. The loyalty program data is hosted in Europe by our technical operator Adelya (see the terms and conditions of use of the loyalty program);
• The pages of the Site are accessible via HTTPS protocol;
• The personal data is stored on servers protected by current security standards.

8 – COOKIES

When navigating the Site, information may be recorded on the user’s device (computer, tablet, mobile phone) through small files called cookies.

The Site places, without asking for permission, only those cookies that are necessary for it to work. They are not used to profile the user or to track them from one site to another, and they never leave www.boulangerie-ange.ca:

• ange_consentement — stores the user’s decision on the purposes described below. Duration: six months.
• PHPSESSID — technical session cookie opened by the Site. Duration: the length of the visit.
• sl_position — remembers the position of the bakery map, in the browser’s local storage.
• If the user signs in to the Site, the authentication cookies of WordPress and of the Wordfence security module are added.

The Site places no advertising cookie and uses no audience measurement tool. It contains no tracking tag and no tracking pixel.

Some features do, however, call on third-party services, which then receive the user’s IP address and the page viewed. None of these features is activated before the user has allowed it, with the exception of form protection:

• Videos (YouTube — Google) — the presentation videos are not loaded until the user asks for them; a placeholder takes their place. Recipient: Google (youtube-nocookie.com, i.ytimg.com). Optional purpose.
• Map background (OpenStreetMap) — the map background on the bakeries page and on the individual bakery pages is only loaded once permission is given. The bakeries, the search by city and the individual listings work without it. Recipient: the OpenStreetMap Foundation (tile.openstreetmap.org), whose tiles are delivered over the Fastly network. Optional purpose.
• Form protection (Cloudflare Turnstile) — checks that the contact and application forms are filled in by a person and not by a robot. Loaded only on pages that carry a form. Recipient: Cloudflare (challenges.cloudflare.com). Required in order to send the forms, and therefore not optional.
• Online ordering (UEAT) — the online ordering pages are provided by UEAT (order.ueat.io), which in turn calls on its own providers, including a payment service. These pages only open if the user chooses to place an order.

On the first visit, a banner lets the user allow or refuse each optional purpose. As long as no decision has been recorded, nothing is allowed: the optional purposes stay inactive. Refusing is as easy as accepting.

The user may change their decision at any time through the cookie management link in the footer, which reopens the settings panel. The decision is kept for six months, after which the user is asked again.

Where permission is not given, users are informed that certain features of the Site are restricted: videos are not displayed, and the bakery map is shown without its map background.

Users can also configure their browser to refuse cookies. The procedure varies by browser.

9 – MODIFICATION OF THIS PRIVACY POLICY

ANGE may make changes to this privacy policy to reflect any developments in the way user data is processed or to comply with changes in applicable regulations.

ANGE will ensure that users are informed of significant modifications. In all cases, users are encouraged to regularly review the applicable privacy policy.