What we do with
what you tell us.

Who is accountable

The owner of OH! Catering is the person accountable for personal information handled here and answers privacy requests personally on +1 613 710-0554. Our mailbox at the ohcatering.ca domain is still being set up, so the phone is the channel that reaches us today. This page is updated the day email starts working.

What the enquiry form collects

The form on our contact page asks for the details a caterer needs to price and plan a table, and you choose how much of it to give us.

• Your name and email address — required, so a reply has somewhere to go.
• Your phone number — optional, used when a plan is faster to talk through.
• The event type, the date and the guest count.
• The event location. Many events happen at home, so this field often holds a home address.
• A free-text box for the vibe you want. People use it to describe dietary needs and allergies, which is health information. Tell us what we need to plan the food, and hold back anything a caterer has no reason to hold.
• The occasion and any add-ons carried over from the page you came from, so the form arrives already knowing what you were reading.

What arrives without you typing it

• Your IP address, held in the memory of the server for up to an hour so one source cannot flood the form. It is dropped after that and it is never attached to your enquiry.
• Campaign tags on the link you clicked (utm_source, utm_medium, utm_campaign, utm_term, utm_content, fbclid, gclid), the page you landed on and the site you came from. These sit in your browser’s session storage under the key oh:attribution for the length of the visit, and they travel with the enquiry so we know which of our pages brought you.
• Ordinary web-server request records kept by the company that hosts the site, on their own schedule.

Why we hold it

One purpose runs through all of it: to answer you, build a quote, plan the food and deliver the table. The rest is housekeeping — keeping the form usable against automated submissions, and keeping our own record of the quotes and events we have agreed. We sell personal information to nobody, we trade it with nobody, and we run no mailing list you have to escape from.

Who else handles it

Your enquiry is sent to the server that runs this website, recorded there in a private file, and emailed to us. These parties touch it on the way.

• The owner of OH! Catering, who reads and answers it.
• The company that hosts this website and stores that private file for us.
• Resend, the service that carries the notification to us and the acknowledgement to you. Its systems are in the United States, and information that crosses a border can be reached by the courts and authorities of the country it sits in.
• Meta, on a deployment where advertising measurement is switched on and as long as you have not turned it off with “Only necessary”. What travels is the fact that an enquiry happened, the page it came from, and a one-way-hashed form of your name, email address and phone number. Section 06 describes that path in full.

Beyond those, an enquiry stays with us. Where you have pressed “Accept all”, Microsoft and Yandex also hold a recording of the visit the form was filled in during, which section 06 describes. Public authorities receive it only where Canadian law obliges us to hand it over.

Cookies, analytics and advertising

This site is built to run five measurement tools: Google Analytics 4, the Google Tag Manager container that carries it, the Meta pixel alongside Meta’s Conversions API — which reports the same enquiry a second time from our own server — Microsoft Clarity and Yandex Metrica. Clarity and Metrica are session recorders: with your consent they record a video of your visit — the pages you open, where your pointer moves, what you click, how far you scroll — and play it back to us. Metrica’s recorder also captures the keys you press in a form, the enquiry form included. Each tool is switched on by configuration, and a deployment with none of them configured loads no analytics or advertising script of any kind. Microsoft and Yandex handle those recordings outside Canada, and information that crosses a border can be reached by the courts and authorities of the country it sits in.

The tools come in two groups. Google Analytics 4 and the Meta pixel measure visits and tell us which pages and adverts lead to an enquiry; they start with the page while a notice says so, and one click on “Only necessary” turns them off for good. Google Tag Manager and the two recorders, Microsoft Clarity and Yandex Metrica, load only after you press “Accept all”. On a French page, or in a browser set to Canadian French, nothing from either group loads until you press Accept, which is how Quebec law asks for it. Your answer is kept in your own browser under the key oh:consent:v1 and mirrored into a first-party cookie named oh_consent, which is how our server knows whether an enquiry you send may be reported onward.

Those tools set their own cookies on this domain — _ga, _ga_* and _fbp, _fbc from the measurement group, and _clck, _clsk, _ym_uid, _ym_d, _ym_isad, _ym_visorc and mdd from the recorders after you accept — which count visits, tie a recording to your session and show us which pages and adverts lead to an enquiry. While measurement is on, a submitted enquiry is also reported to Meta from our server: the event, the page, and a one-way-hashed form of your name, email address and phone number. The hashing happens here, before anything is sent, so Meta can match the event against an account it already holds without receiving those details in readable form.

Change your mind whenever you like through the “Cookie settings” link in the footer, which reopens the banner. Refusing, or withdrawing after accepting, takes effect in the visit you are in: the recorders are switched off where they stand, the cookies above are cleared from this domain, and the browser tags and the server-side report both go quiet. Cookies those companies keep on their own domains sit outside this site’s reach, and your browser’s settings are where they are cleared. The attribution entry in section 03 behaves the same either way: it stays in your browser’s session storage, it travels only with an enquiry you send us yourself, and closing the tab clears it.

How long it stays

• An enquiry that never becomes a booking is deleted 24 months after our last contact about it.
• A booked event keeps its quote, invoice and supporting records for six years, the period Canadian tax rules require a business to keep its books.
• Session storage in your browser clears when you close the tab.
• Rate-limiting records of your IP address expire within the hour.

Ask us to delete an enquiry sooner and we do it, keeping only what tax law obliges us to keep about an event we actually catered.

Your rights, and how to use them

An Ontario resident dealing with a private business here is covered by PIPEDA, the federal privacy law. It gives you the right to ask for a copy of what we hold about you, to have a mistake in it corrected, to withdraw your consent and have your enquiry deleted, and to be told how we handled it.

Call +1 613 710-0554 and say it is a privacy request. Tell us the email address or phone number you used, so we can find the right enquiry. We answer within 30 days, the period PIPEDA sets, and we say plainly what we found, what we sent and what we deleted.

Where our answer leaves you unsatisfied, the Office of the Privacy Commissioner of Canada takes complaints about businesses like ours, at priv.gc.ca or 1-800-282-1376.

Keeping it safe

The site is served over HTTPS, the form posts to our own endpoint, and the enquiry file sits where only we can read it. This website takes no payment details of any kind: deposits and balances are arranged with us directly. Should personal information held here ever be lost or exposed in a way that creates a real risk of significant harm, we report it to the Privacy Commissioner and tell the people affected, as PIPEDA requires.

Changes to this page

We reviewed this page on 30 September 2026. On that day Google Analytics 4 and the Meta pixel began running on notice for visitors outside Quebec, with one click to turn them off; the recorders and the tag container still wait for your Accept. Every future change is dated here, and any change that widens what we collect or who handles it is described in this section before it takes effect.