What we collect, and what we do not

Section 01

The short version

DEMES Meat Products makes Halal certified deli meats in Toronto, Ontario, and sells them through this website to households and to wholesale partners. To take an order, deliver it and run the Customer's Club, we need some information about you. This page explains exactly what we collect, why, and what you can ask us to do with it.

We do not sell your personal information. We do not run advertising trackers or analytics scripts on this site. The only cookies we set are the two needed to keep you signed in and to make sign-in secure.

This policy is written to meet our obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how private-sector businesses handle personal information.

Section 02

Who is responsible for your information

DEMES Meat Products, operating from Toronto, Ontario, Canada, is responsible for the personal information described here. If you have a question, a correction or a complaint, write to sales@demesmeats.ca and it will reach the person who handles privacy requests.

Section 03

What we collect and why

We only ask for what a given task actually needs. You can browse the entire catalogue without giving us anything at all.

Customer account

First and last name, email address, password, and optionally a phone number and birthday. The birthday is used only to send your club birthday bonus. Passwords are stored as one-way hashes, never as readable text.

Saved addresses

Street, unit, city, province, postal code and any delivery notes you add, plus an optional label such as Home or Work. Used to deliver your orders.

Orders

The items and sizes you bought, quantities and prices, subtotal, delivery fee, HST, any points discount and the total, your chosen delivery method, the delivery address, your email and phone for that order, and the order status. Guests who check out without an account give an email address and phone number for that order only.

Payments

We never see or store your card number, expiry date or security code. Those go directly to our payment processor. We keep only a transaction reference and, if you save a card with the processor, a customer code that lets us match you to your record with them.

Customer's Club

Your points balance, tier, and a record of each points transaction with the reason it was awarded or redeemed.

Product reviews

Your rating and written comment, linked to your account and the product. Reviews are moderated before they appear.

Newsletter

Your email address and where you subscribed from, so we can honour your preference and stop sending if you unsubscribe.

Contact and wholesale forms

Your name, email, phone, subject and message. Wholesale inquiries also include company name, business type, estimated volume and whether you want samples.

Event signups

If you scan our QR code at a trade show: first and last name, email, optional phone, what you are interested in, and whether you agreed to hear from us.

Section 04

How we rely on your consent

For most of what we do, your consent is obvious from the action: you place an order, so we use your address to deliver it. That is called implied consent, and it covers fulfilling orders, answering your questions and sending the transactional emails listed below.

For marketing we ask you outright. Newsletter and promotional email only goes to people who ticked a box asking for it, which is what Canada's Anti-Spam Legislation (CASL) requires. Every marketing email carries an unsubscribe link, and you can also email us to be removed.

You can withdraw consent at any time. If you withdraw consent for something we need in order to complete a service, for example delivering an order already in progress, we will tell you what that means before acting on it.

Section 05

Emails we send

Transactional email is part of the service and is sent whether or not you subscribe to marketing. These are the messages the site can send you:

• An order confirmation with your receipt when payment succeeds.
• A welcome email when you create an account, by email or through Google.
• A password reset link, only when you ask for one.
• A thank-you when a review you left earns club points.
• A birthday message when your club birthday bonus is added.
• A confirmation if you signed up at an event, sent once, on your first signup.

Order emails come from orders@tm.demesmeats.ca and the rest from noreply@tm.demesmeats.ca. Replies to any of them go to sales@demesmeats.ca, which is a monitored inbox.

Section 06

Cookies

This site sets two cookies. Neither is used for advertising, and neither follows you to other websites.

payload-token

Keeps you signed in to your account. Set when you log in, expires after 14 days, and is removed when you sign out. Marked HttpOnly so scripts cannot read it.

google_oauth

Set only if you choose Sign in with Google. It holds a random value that proves the sign-in request came from you, and it is deleted as soon as sign-in finishes. It expires on its own after 10 minutes.

There is no analytics, advertising, remarketing or social tracking code on this site. If that ever changes, we will update this page and ask for consent where the law requires it.

Section 07

Who else touches your information

We share personal information only with the service providers that make the site work, and only with what each one needs. None of them may use your information for their own marketing.

Helcim

Canadian payment processor. Handles your card details directly so they never reach our systems, and processes the charge for your order.

Neon

Hosts the database holding accounts, orders, addresses and club records. Data is stored in the United States (US East region).

Vercel

Hosts and serves the website and runs the scheduled job that awards club birthday and occasion bonuses.

Resend

Delivers the emails listed above. Sending infrastructure is in the United States (US East region).

Google

Only if you choose Sign in with Google. Google tells us your email address, whether it is verified, and your first and last name. We never receive your Google password.

We will also disclose information if a law, warrant, subpoena or court order requires it, or where it is necessary to establish or defend a legal claim. We are not in the business of selling, renting or trading personal information, and we do not do it.

Section 08

How long we keep things

• Order and payment records are kept for six years after the end of the tax year they relate to, because the Canada Revenue Agency requires businesses to retain sales records for that long.
• Account details, saved addresses and club history are kept while your account is open, and removed when you ask us to close it, apart from anything inside an order record we are required to retain.
• Newsletter subscriptions are kept until you unsubscribe. We keep a record that you unsubscribed so we do not email you again by mistake.
• Contact, wholesale and event signup messages are kept while we are dealing with your inquiry and for a reasonable period afterwards in case you follow up.
• Published reviews stay with the product until you ask us to remove yours.

Section 09

Your rights, and how to use them

Under Canadian privacy law you can ask us to:

• Tell you what personal information we hold about you and what we have done with it.
• Correct anything that is wrong or out of date.
• Delete your account and the information tied to it, subject to the retention rules above.
• Stop sending you marketing email, without affecting your ability to order.
• Explain anything on this page that is not clear.

Some of this you can do yourself: your name, phone, birthday, addresses and newsletter preference are editable in your account settings. For anything else, email sales@demesmeats.ca. We will confirm your identity before acting on a request, and we aim to respond within 30 days, which is the timeline PIPEDA sets.

If you are not satisfied with how we handled your request, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Section 10

How we protect it

• The whole site runs over HTTPS, so traffic between you and us is encrypted.
• Passwords are stored as one-way hashes. Nobody at DEMES can read your password.
• Card details never reach our servers; the payment processor handles them directly.
• The session cookie is HttpOnly, so scripts in your browser cannot read it.
• Access to the admin area, where order and customer records live, is restricted to staff accounts.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your personal information in a way that creates a real risk of significant harm, we will notify you and the Privacy Commissioner as PIPEDA requires.

Section 11

Children

This site is meant for adults buying food. We do not knowingly collect personal information from children. If you believe a child has given us information, email us and we will delete it.

Section 12

Changes to this policy

If we change how we handle personal information, we will update this page and move the date at the top. Where a change is significant, for example adding a new provider that receives your information, we will say so clearly rather than quietly editing a line.