Privacy Policy
Express Indien · 6579 Avenue Somerled, Montréal (Québec) H4V 1T1 · Last updated: October 19, 2026
At Express Indien, we respect your privacy. This policy explains, in plain language, what personal information we collect when you visit our website, order food, book a table or request catering, why we collect it, and how you can control it. It follows Québec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's anti-spam law (CASL).
1. Person in charge of protecting your information
Email: expressindien@gmail.com
Phone: 514-489-5250
Mail: 6579 Avenue Somerled, Montréal (Québec) H4V 1T1
The Privacy Officer oversees how Express Indien protects personal information. Contact them for any question, request or complaint about your personal information.
2. What we collect and why
| When you… | We collect | Why |
|---|---|---|
| Order online (pickup or delivery) | Name, phone number, email (optional), delivery address and postal code, order details, special instructions, payment method (cash or Interac e-Transfer) | To prepare and deliver your order, call you about it, calculate the delivery fee and send your receipt or order updates |
| Book a table | Name, phone, date, time, number of guests, your request | To hold and confirm your table |
| Request catering | Name, phone, email, company (optional), event date, number of guests, address, details | To prepare and send your quote |
| Join our loyalty program | Phone number, order history, points | To give you points and first-order offers |
| Subscribe to our emails | Email, date and way you gave consent | To send offers and news, only if you checked the box |
| Visit our website | IP address (kept 24 hours to block abuse), and statistics described in section 4 | Security, and to understand how our website is used |
We only collect what we need. Our own ordering system does not collect or store credit card numbers. If you pay by card through GloriaFood or a delivery app, the payment is handled by their payment provider. We never sell or rent your personal information.
3. Who we share it with
- Our staff and delivery driver, only what they need to prepare and deliver your order.
- Our web hosting provider, which stores our website and order system. Its servers may be located outside Québec, including in the United States.
- GloriaFood, when you order or book through the GloriaFood buttons on some of our pages. Your order is then handled under GloriaFood's own privacy policy.
- Uber Eats, DoorDash and other delivery apps, if you order through them. Their own privacy policies apply.
- Google (Analytics, Fonts, Maps) and Meta (Facebook Pixel), as described in section 4.
- Government authorities, only when the law requires it.
Some of these companies store information outside Québec. Before sharing, we check that your information will be adequately protected.
4. Cookies, statistics and tracking
- Google Analytics helps us understand website traffic and how visitors use our pages. It may process device and cookie identifiers and browsing or interaction data. It does not give us your name.
- Meta (Facebook) Pixel on some pages measures visits coming from our Facebook and Instagram posts and ads.
- Your device: our order page remembers your name, phone and address on your own phone or computer so you don't have to type them again. You can delete this anytime by clearing your browser data.
Google Analytics and the Meta Pixel are off by default. They only turn on if you click "Accept" in the cookie banner. You can change your choice anytime with the "Cookie settings" link at the bottom of every page. You can also block or delete cookies in your browser settings. You can also opt out of Google Analytics with Google's browser add-on (tools.google.com/dlpage/gaoptout) and manage Facebook ads in your Facebook settings. The website will still work.
5. Emails and offers (CASL)
We send commercial emails only when we have valid express or implied consent under Canada's Anti-Spam Legislation (CASL). Express consent is the box you check when ordering. Where the law allows, an existing business relationship can give implied consent for a limited period: generally 2 years after a purchase, or 6 months after an inquiry (for example, a catering quote request). Express consent lasts until you withdraw it. Every email identifies Express Indien and has a working unsubscribe link, and you can also call or email us. We process unsubscribe requests within 10 business days and keep a record of when and how you agreed.
6. How long we keep it
- Orders and receipts: 6 years, as required by tax law.
- Customer and loyalty profile: kept while needed to run the loyalty program and serve you. We review inactive profiles at least once a year and delete information that is no longer necessary (profiles inactive for more than 3 years), subject to our legal obligations.
- Table bookings and catering requests: reviewed at least once a year and removed when no longer needed (no more than 3 years).
- Security logs (IP addresses): 24 hours. Backups: 30 days.
After that, information is deleted or anonymized.
7. How we protect it
Our website uses a secure connection (HTTPS). Customer data is stored outside the public part of our website, staff screens are protected by a PIN, and only people who need the information can see it. We keep a register of confidentiality incidents. If an incident ever creates a risk of serious harm, we will notify you and the Commission d'accès à l'information, as the law requires.
8. How we manage personal information (governance)
- Responsibility: the Privacy Officer (section 1) approves how personal information is collected, used, kept and destroyed at Express Indien.
- Access: staff can only see the information they need for their job (for example, the kitchen sees the order and the driver sees the delivery address). Staff are told to keep customer information confidential.
- Keeping and destroying: we follow the periods in section 6 and review our records at least once a year. Paper receipts are kept in a secure place and shredded when no longer needed.
- Requests and complaints: anyone can send a request or complaint to the Privacy Officer. We record it, answer within 30 days and explain how to reach the Commission d'accès à l'information if needed.
- Incidents: we keep a register of confidentiality incidents, act quickly to reduce any harm, and notify people and the Commission when the law requires it.
- New tools and suppliers: before we use a new system or share information with a supplier outside Québec, we assess the privacy risks.
9. Automatic offers
Our ordering system applies some offers automatically using simple rules, such as a first-order discount, loyalty points or a free item above a certain amount. These rules only give you advantages. No decision that seriously affects you is made only by a computer. If you have a question about an offer, or want us to review it, contact us.
10. Your rights
You can ask us at any time to:
- see the personal information we have about you;
- correct it if it is wrong or incomplete;
- delete it when permitted by law, or stop using it for offers (withdraw your consent);
- receive a copy of it in a common electronic format.
Write or call the person in charge (section 1). We will answer within 30 days, free of charge. Some information, such as receipts, may need to be kept to meet legal or tax obligations. If you are not satisfied with our answer, you can contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
11. Children
Our website is not meant for children under 14, and we do not knowingly collect their information.
12. Changes
If we change this policy, we will update it on this page with a new date. If a change significantly affects how we use your information, we will also inform you, for example by email or a notice on our website, as the law requires.