What we do with
what you tell us.

Who is accountable

The owner of OH! Catering is the person accountable for personal information handled here and answers privacy requests personally on +1 613 710-0554. Our mailbox at the ohcatering.ca domain is still being set up, so the phone is the channel that reaches us today. This page is updated the day email starts working.

What the enquiry form collects

The form on our contact page asks for the details a caterer needs to price and plan a table, and you choose how much of it to give us.

• Your name and email address — required, so a reply has somewhere to go.
• Your phone number — optional, used when a plan is faster to talk through.
• The event type, the date and the guest count.
• The event location. Many events happen at home, so this field often holds a home address.
• A free-text box for the vibe you want. People use it to describe dietary needs and allergies, which is health information. Tell us what we need to plan the food, and hold back anything a caterer has no reason to hold.
• The occasion and any add-ons carried over from the page you came from, so the form arrives already knowing what you were reading.

What arrives without you typing it

• Your IP address, held in the memory of the server for up to an hour so one source cannot flood the form. It is dropped after that and it is never attached to your enquiry.
• Campaign tags on the link you clicked (utm_source, utm_medium, utm_campaign, utm_term, utm_content, fbclid, gclid), the page you landed on and the site you came from. These sit in your browser’s session storage under the key oh:attribution for the length of the visit, and they travel with the enquiry so we know which of our pages brought you.
• Ordinary web-server request records kept by the company that hosts the site, on their own schedule.

Why we hold it

One purpose runs through all of it: to answer you, build a quote, plan the food and deliver the table. The rest is housekeeping — keeping the form usable against automated submissions, and keeping our own record of the quotes and events we have agreed. We sell personal information to nobody, we trade it with nobody, and we run no mailing list you have to escape from.

Who else handles it

Your enquiry is sent to the server that runs this website, recorded there in a private file, and emailed to us. These parties touch it on the way.

• The owner of OH! Catering, who reads and answers it.
• The company that hosts this website and stores that private file for us.
• Resend, the service that carries the notification to us and the acknowledgement to you. Its systems are in the United States, and information that crosses a border can be reached by the courts and authorities of the country it sits in.
• Meta, on a deployment where advertising measurement is switched on and only after you have accepted it. What travels is the fact that an enquiry happened, the page it came from, and a one-way-hashed form of your name, email address and phone number. Section 06 describes that path in full.

Beyond those, an enquiry stays with us. Public authorities receive it only where Canadian law obliges us to hand it over.

Cookies, analytics and advertising

This site is built to run two measurement tools: Google Analytics 4 and the Meta pixel, alongside Meta’s Conversions API, which reports the same enquiry a second time from our own server. Each one is switched on by configuration, and a deployment with neither of them configured loads no analytics or advertising script of any kind.

Where they are switched on, nothing loads until you agree. A banner asks first, and until you press Accept no tag is fetched, no advertising cookie is written and no identifier leaves your browser. Your answer is kept in your own browser under the key oh:consent:v1 and mirrored into a first-party cookie named oh_consent, which is how our server knows whether an enquiry you send may be reported onward.

Accepting lets those tools set their own cookies on this domain — the familiar _ga, _ga_*, _fbp and _fbc — which count visits and show us which pages and adverts lead to an enquiry. With advertising measurement running, a submitted enquiry is also reported to Meta from our server: the event, the page, and a one-way-hashed form of your name, email address and phone number. The hashing happens here, before anything is sent, so Meta can match the event against an account it already holds without receiving those details in readable form.

Change your mind whenever you like through the “Cookie settings” link in the footer, which reopens the banner. Refusing, or withdrawing after accepting, clears those cookies from this domain and stops both the browser tags and the server-side report. The attribution entry in section 03 behaves the same either way: it stays in your browser’s session storage, it travels only with an enquiry you send us yourself, and closing the tab clears it.

How long it stays

• An enquiry that never becomes a booking is deleted 24 months after our last contact about it.
• A booked event keeps its quote, invoice and supporting records for six years, the period Canadian tax rules require a business to keep its books.
• Session storage in your browser clears when you close the tab.
• Rate-limiting records of your IP address expire within the hour.

Ask us to delete an enquiry sooner and we do it, keeping only what tax law obliges us to keep about an event we actually catered.

Your rights, and how to use them

An Ontario resident dealing with a private business here is covered by PIPEDA, the federal privacy law. It gives you the right to ask for a copy of what we hold about you, to have a mistake in it corrected, to withdraw your consent and have your enquiry deleted, and to be told how we handled it.

Call +1 613 710-0554 and say it is a privacy request. Tell us the email address or phone number you used, so we can find the right enquiry. We answer within 30 days, the period PIPEDA sets, and we say plainly what we found, what we sent and what we deleted.

Where our answer leaves you unsatisfied, the Office of the Privacy Commissioner of Canada takes complaints about businesses like ours, at priv.gc.ca or 1-800-282-1376.

Keeping it safe

The site is served over HTTPS, the form posts to our own endpoint, and the enquiry file sits where only we can read it. This website takes no payment details of any kind: deposits and balances are arranged with us directly. Should personal information held here ever be lost or exposed in a way that creates a real risk of significant harm, we report it to the Privacy Commissioner and tell the people affected, as PIPEDA requires.

Changes to this page

We reviewed this page on 26 August 2026. Every future change is dated here, and any change that widens what we collect or who handles it is described in this section before it takes effect.