Privacy Policy
This policy explains what personal information we collect, why, who we share it with, and what your rights are. It’s written to be read. If anything here isn’t clear, write to us.
1. Person in charge of protecting personal information
Mohannad Madi, owner and founder, is the person in charge of protecting personal information at BÁYRŪT.
Your requests are handled on his behalf by our agency:
Jad Zoubair, JADX Agency
Email: [email protected] · Phone: 438 809-3867
Write to that address with any question or request about this policy. We answer within 30 days.
2. What we collect, and why
| What you give us | Why | How |
|---|---|---|
| Name, email, phone, date and party size | To take and confirm your reservation | Our online reservation system |
| Name, email, message | To answer an enquiry, a private event, a lunch box order | Site forms |
| Email address, display language | To send you the newsletter you signed up for | Newsletter signup form |
| Name, contact details, CV | To consider a job application | Careers form |
| Pages visited, device, referrer | To understand how the site is used and measure our campaigns | Cookies — see section 5 |
This policy covers the information collected through our website and the channels described above. We don’t use it for anything else without asking you first.
We never sell your personal information.
3. Newsletter
You receive the newsletter only if you signed up for it yourself. Booking a table does not sign you up. Every send carries a one-click unsubscribe link, and we stop sending the moment you use it.
4. Who we share it with
We use suppliers to run the restaurant and the site. They receive only what they need. Apart from the advertising platforms, which also process some information for their own purposes under their own terms, they cannot use it for any purpose but ours:
- Reservations — OpenTable
- Newsletter — Klaviyo
- Website hosting — GoDaddy
- Site security and delivery — Cloudflare
- Site performance — Jetpack (Automattic)
- Site email delivery — Emailit
- Business email — Microsoft 365
- Measurement and advertising — Google Ads, Meta (Facebook pixel)
Outside Quebec. Several of these suppliers process or store information outside Quebec, including in the United States. Before entrusting personal information to them, we assess the protection it will receive and govern the transfer by written agreement.
We may also disclose information where the law requires it.
5. Cookies and tracking
On your first visit, a banner lets you accept or decline the cookies that aren’t necessary to run the site. No cookies, no profiling and no advertising technology run before you accept them. You can change your answer at any time: the Cookie preferences link at the foot of every page reopens the banner and records your new choice.
- Necessary — make the site work and remember your language choice and your answer to the banner. Always on.
- Basic audience measurement — our delivery provider, Cloudflare, measures page speed and volume in aggregate. This measurement is always on, sets no cookies, does not follow you from site to site, and is not used to build a profile. Cloudflare already carries every visit to the site as our infrastructure provider.
- Detailed measurement — tells us which pages get read. On only if you accept.
- Advertising — lets us measure our campaigns. On only if you accept.
6. How long we keep it
- Reservations: 24 months
- Messages received through forms: 24 months
- Newsletter signups: until you unsubscribe, then 24 months to show the request was honoured
- Job applications: 12 months
- Cookies: our site sets no cookies on our servers. Your answer to the banner and your language choice are kept in your browser until you clear the site’s data. Cookies set by Google and Meta, if you accepted them, expire on their own schedules — about 90 days.
After that, the information is destroyed.
7. How we protect it
Inside the business, the people with access are: management; reservation and floor staff, for bookings; whoever is handling hiring, for applications; and our marketing agency, for the newsletter and campaign measurement. Each sees only what their work requires. Traffic to the site is encrypted. Our suppliers are bound to security obligations by agreement. If a confidentiality incident presents a risk of serious injury, we notify the people affected and the Commission d’accès à l’information.
8. Your rights
At any time, you may:
- Access the information we hold about you
- Have it corrected if it’s inaccurate or incomplete
- Withdraw your consent and stop receiving our communications
- Ask for it to be deleted where keeping it is no longer justified
- Receive the information you provided to us in a structured, commonly used technological format, or ask that it be sent to a third party (portability)
- Ask us to stop disseminating an item of information, or to de-index it, where doing so causes you serious injury
Write to the person in section 1. We answer within 30 days.
9. Complaints
Start with the person in section 1. If our answer doesn’t satisfy you, you can complain to the Commission d’accès à l’information du Québec — cai.gouv.qc.ca.
10. Changes
If we change this policy, the new version is published here with its date. Significant changes are announced by a notice on the site and, for subscribers, in the newsletter.