Legal · Privacy
Website Privacy Policy
The Oak & Barrel Restaurant · Saskatoon, SK · oakandbarrel.ca
Section 1
Effective Date & Introduction
This Privacy Policy is effective as of June 1, 2026.
The Oak & Barrel Restaurant (“we,” “us,” or “our”), located in Saskatoon, Saskatchewan, is committed to protecting the privacy and personal information of every individual who visits or interacts with our website at oakandbarrel.ca(the “Website”).
This Policy has been prepared in accordance with the Personal Information Protection and Electronic Documents Act(PIPEDA), S.C. 2000, c. 5, and Saskatchewan’s Personal Information Protection Act(PIPA), S.S. 2003, c. P-19.1, both of which govern how private sector organizations collect, use, and disclose personal information in the course of commercial activity.
Accountability.The Oak & Barrel Restaurant is the named organization accountable for all personal information under its custody or control. A designated Privacy Officer oversees our compliance with applicable privacy legislation and can be reached at any time at privacy@oakandbarrel.ca.
We believe privacy is not a legal checkbox — it is a commitment to the dignity and trust of our guests. This Policy explains, in plain language, exactly what information we collect, why we collect it, how we protect it, and what rights you hold over your own data.
Section 2
Meaningful Consent & Reasonable Purpose
Under PIPEDA’s Principle 3 (Consent), The Oak & Barrel Restaurant relies on express consent as the primary basis for collecting your personal information. Consent is obtained at the point of data entry through the following Website interactions:
- ✦Contact Form: Submitting the contact form constitutes your express consent to receive a response and, where applicable, follow-up communications related to your inquiry.
- ✦Interactive Table Booking System: Completing and submitting a reservation request constitutes your express consent to the collection of your reservation details for the purpose of confirming and managing your booking.
- ✦AI Lead-Generation Assistant: Engaging with our AI-powered chat assistant and voluntarily providing personal information during that conversation constitutes your express consent to use that information to respond to your query and, where you have indicated interest, to send you relevant updates.
Consistent with PIPEDA’s requirement that purposes be ones a reasonable person would consider appropriate in the circumstances, data collection is limited exclusively to what is necessary for processing and confirming dining reservations, responding to customer service inquiries, processing payments for deposits or pre-paid bookings, sending transactional SMS reminders, and analysing anonymized traffic patterns to improve Website performance.
We do not collect personal information for undisclosed secondary purposes. We do not sell, trade, or rent personal information to third parties for their own marketing use.
Withdrawing Consent. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal will not affect the legality of any collection, use, or disclosure that occurred prior to withdrawal. To withdraw consent, contact our Privacy Officer at privacy@oakandbarrel.ca.
Section 3
Explicit Data Minimization — What We Collect & Why
The Oak & Barrel Restaurant applies the principle of data minimization: we collect only the information that is directly necessary to deliver the service you are requesting.
Contact Data
| Data Element | Purpose |
|---|---|
| Full name | Identifying the reservation holder; personalizing guest communications. |
| Email address | Sending reservation confirmations, responding to contact form submissions, and — with consent — sharing relevant updates. |
| Phone number | Delivering SMS reservation reminders via Twilio; contacting guests regarding booking changes or cancellations. |
Reservation & Transaction Data
| Data Element | Purpose |
|---|---|
| Reservation date, time, and party size | Creating, managing, and modifying dining reservations. |
| Dietary preferences or special requests (if voluntarily provided) | Accommodating guest requirements and ensuring service quality. |
| Payment information (processed via Stripe) | Securing deposits or processing pre-paid bookings. Full payment card details are never stored on our servers — see Section 5. |
Usage Data
| Data Element | Purpose |
|---|---|
| IP address | Website security monitoring; detecting and preventing fraudulent or unauthorized access. |
| Browser type and version | Optimizing Website compatibility and user experience. |
| Pages visited and session duration | Aggregated analytics via Google Analytics to understand how users interact with the Website and improve its content and performance. |
Google Analytics data is collected in aggregated and anonymized form wherever technically feasible. We have configured Google Analytics to respect applicable privacy settings, including IP anonymization.
Interaction Data (AI Assistant)
| Data Element | Purpose |
|---|---|
| Conversation inputs voluntarily submitted to the AI chat assistant | Generating relevant responses to guest inquiries; routing leads to the appropriate team member; improving chatbot response accuracy over time. |
The AI assistant is instructed not to solicit sensitive personal information such as health information, financial data, or government-issued identification numbers. We encourage you to limit information shared to what is directly relevant to your inquiry.
Section 4
Data Safeguards & Security
The Oak & Barrel Restaurant implements a layered security framework — technical, organizational, and procedural — to protect your personal information from unauthorized access, disclosure, alteration, loss, or destruction.
Technical Safeguards
- ✦SSL/TLS Encryption: All data transmitted between your browser and oakandbarrel.ca is encrypted using Transport Layer Security (TLS 1.2 or higher), ensuring that information submitted through our forms, booking system, or AI assistant cannot be intercepted in transit.
- ✦Firewall Protection: Our hosting environment is protected by active firewall configurations that restrict unauthorized inbound and outbound network traffic.
- ✦Secure Payment Processing: Payment card data submitted through our booking system is processed entirely within Stripe's PCI DSS Level 1 compliant environment. The Oak & Barrel Restaurant does not store, process, or transmit raw payment card numbers on its own servers at any time.
- ✦Database Access Controls: Personal information stored in our databases is protected by role-based access controls, ensuring that only authenticated, authorized systems and personnel can query or modify records.
Organizational Safeguards
- ✦Access on a Need-to-Know Basis: Internal access to personal information is restricted to staff members whose job functions require that access. Access privileges are reviewed periodically and revoked upon role change or departure.
- ✦Staff Privacy Awareness: Employees who handle personal information are informed of their obligations under this Policy and applicable privacy legislation.
- ✦Vendor Due Diligence: Before engaging any third-party service provider that processes personal information on our behalf, we assess their security practices to confirm they meet standards consistent with PIPEDA obligations.
While The Oak & Barrel Restaurant takes all reasonable precautions, no method of electronic transmission or storage is 100% secure. In the event of a breach that poses a real risk of significant harm, we will act in accordance with Section 8 of this Policy.
Section 5
Third-Party Data Handling & Logistics
The Oak & Barrel Restaurant uses the following third-party service providers to deliver core business functions. Each provider receives only the personal information necessary to perform their specific service. We do not authorize these providers to use or disclose your information for their own independent purposes.
| Service Provider | Role | Data Shared | Standard |
|---|---|---|---|
| Stripe, Inc. | Payment processing for deposits and pre-paid bookings | Name, email address, payment card details | PCI DSS Level 1 compliant |
| Twilio Inc. | SMS reservation reminders and transactional notifications | Phone number, reservation date and time | Twilio data processing agreements |
| Google LLC (Google Analytics) | Aggregated website traffic analysis | IP address (anonymized), browser data, session data | Google Data Processing Amendment |
In accordance with PIPEDA Schedule 1, Principle 1 (Accountability), The Oak & Barrel Restaurant remains accountable for personal information transferred to third parties for processing. We use contractual and procedural mechanisms to require that these service providers protect your information with standards equivalent to our own.
No Cross-Border Sale of Data. We do not sell your personal information to any third party under any circumstances. When data is processed by a service provider located outside of Canada (as may be the case with Stripe, Twilio, and Google, which operate data centers in multiple jurisdictions including the United States), that data may be subject to the laws of those foreign jurisdictions. We take reasonable steps to ensure cross-border transfers are governed by appropriate contractual protections.
Section 6
Data Retention Limits & Deletion
The Oak & Barrel Restaurant retains personal information only for as long as is necessary to fulfill the identified purpose for which it was collected, or as required by applicable law. This reflects PIPEDA Schedule 1, Principle 5 (Limiting Use, Disclosure, and Retention).
| Data Category | Retention Period | Rationale |
|---|---|---|
| Reservation records | 24 months from date of reservation | Guest history for service continuity and dispute resolution |
| Payment transaction records | 7 years from transaction date | CRA record-keeping requirements under the Income Tax Act and Excise Tax Act |
| Contact form submissions | 12 months from submission date (unless ongoing relationship is established) | Responding to inquiries and tracking unresolved matters |
| AI assistant conversation logs | 90 days from date of interaction | Quality assurance, fraud detection, and chatbot improvement |
| Google Analytics usage data | Up to 14 months (shortest interval appropriate for reporting) | Website performance analysis |
| SMS reminder data (Twilio) | Deleted upon confirmed delivery or 30 days after reservation date | Transactional purposes only |
Upon expiry of the applicable retention period, personal information is either securely deleted using methods that prevent reconstruction or recovery, or permanently anonymized such that it can no longer be associated with any identifiable individual.
Section 7
Individual Rights — Access and Rectification
You have clearly defined rights over your personal information under PIPEDA and Saskatchewan’s PIPA. The Oak & Barrel Restaurant is committed to honouring these rights fully and without undue delay.
- ✦Right of Access: You have the right to request confirmation of whether The Oak & Barrel Restaurant holds personal information about you, and to obtain a copy of that information in an intelligible format.
- ✦Right of Rectification: You have the right to request correction of any personal information that is inaccurate, incomplete, or out of date. Where a correction is made, we will transmit the corrected information to any third party that received the original data, where feasible.
- ✦Right to Withdraw Consent: You may withdraw consent to any or all of our data collection activities at any time, subject to legal or contractual constraints. Withdrawal will not affect the validity of prior collection.
- ✦Right to Challenge Compliance: You have the right to challenge our compliance with this Privacy Policy or applicable privacy legislation by directing a complaint to our Privacy Officer.
Submit a Request
To exercise any of the rights above, contact our designated Privacy Officer:
Privacy Officer — The Oak & Barrel Restaurant
Saskatoon, Saskatchewan
privacy@oakandbarrel.caWe acknowledge receipt within 10 business days and provide a substantive response within 30 calendar days, consistent with PIPEDA’s response timeline requirements.
Escalation to the Office of the Privacy Commissioner: If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (OPC) at 1-800-282-1376 or priv.gc.ca.
Saskatchewan residents may also contact the Office of the Saskatchewan Information and Privacy Commissioner (IPC) at oipc.sk.ca.
Section 8
Breach Notification Compliance
The Oak & Barrel Restaurant operates in full compliance with the breach notification requirements established under PIPEDA’s Breach of Security Safeguards Regulations (SOR/2018-64), which came into force on November 1, 2018.
Real Risk of Significant Harm
In the event that a security breach occurs involving personal information under our control, we will promptly assess whether the breach creates a "real risk of significant harm" (RROSH) to any affected individual. Factors considered include the sensitivity of the personal information involved, the probability that it has been or will be misused, and whether the breach involves financial information or other high-sensitivity data.
Notification to the Office of the Privacy Commissioner
If the RROSH threshold is met, The Oak & Barrel Restaurant will report the breach to the Office of the Privacy Commissioner of Canada as soon as feasible after the breach is confirmed, including a description of the circumstances, the date of the breach, the personal information involved, the number of individuals affected, and steps taken to reduce risk and prevent future breaches.
Direct Notification to Affected Individuals
Concurrently with or immediately following our report to the OPC, we will directly notify each affected individual using the most reliable and expedient means available. Each notification will describe the nature of the breach, the information involved, steps the individual can take to protect themselves from harm, our Privacy Officer's contact information, and the individual's right to file a complaint with the OPC.
Breach Records
The Oak & Barrel Restaurant maintains an internal record of every breach of security safeguards, regardless of whether the breach meets the RROSH threshold. These records are retained for a minimum of 24 months from the date of the breach and are made available to the OPC upon request.
Policy Updates
The Oak & Barrel Restaurant reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or technological environment. When material changes are made, we will revise the Effective Date at the top of this document and, where appropriate, provide notice via the Website or direct communication. Your continued use of oakandbarrel.ca following the posting of any update constitutes your acceptance of the revised Policy.
This Privacy Policy was prepared in accordance with the Personal Information Protection and Electronic Documents Act(PIPEDA), S.C. 2000, c. 5; the Breach of Security Safeguards Regulations, SOR/2018-64; and Saskatchewan’s Personal Information Protection Act(PIPA), S.S. 2003, c. P-19.1.