Last updated: May 14, 2026
This Privacy Policy explains how Candyll collects, uses, discloses, and safeguards your personal information when you use our website at candyll.com, our mobile application, and related services (collectively, the "Service" or "Platform"). It is designed to comply with Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and British Columbia's Personal Information Protection Act ("BC PIPA") where applicable. By using the Service you consent to the practices described below.
Candyll ("we", "us", "our") is the organization responsible for the personal information in our custody and control. We have designated a Privacy Officer to oversee compliance with this Policy and with applicable privacy law. You may contact the Privacy Officer at privacy@candyll.com.
We collect only information that is reasonably necessary to provide and improve the Service.
We do not collect: government-issued ID, credit-card numbers, social insurance numbers, biometric data, health data, sexual orientation, religious belief, or other sensitive categories of personal information.
We use your personal information for the following purposes only:
We will not use your personal information for any new purpose without your consent or other lawful basis.
We rely primarily on your consent to collect, use, and disclose personal information, given when you create an account and accept our Terms of Service. Where required, we obtain additional express consent (for example, for location access or push notifications). We may also rely on lawful bases other than consent where permitted by PIPEDA and BC PIPA — for example, performance of a contract with you, compliance with a legal obligation, or a legitimate business interest that is not outweighed by your privacy interests (such as fraud prevention and network security).
You may withdraw consent at any time by contacting our Privacy Officer, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may limit our ability to provide some or all of the Service.
When you join a Deal or book a slot, we share with the Merchant only what is necessary to fulfil the reservation: your display name, reservation timestamp, quantity, slot time (if applicable), and pickup status. We do not share your password, email address (unless you choose to contact a Merchant), payment information, push token, or precise location with Merchants.
Reviews you write are public and shown alongside your display name. Do not include sensitive personal information in reviews.
We use the following service providers (data processors) to operate the Service. Each is bound by contractual privacy and security obligations.
These providers process information solely on our instructions and for the limited purpose of operating the Service.
Some of our service providers are located outside Canada (primarily in the United States and Europe). When personal information is transferred to or stored in another jurisdiction it may become subject to the laws of that jurisdiction, including laws permitting government access. We use providers that offer equivalent or stronger contractual protections and industry- standard encryption in transit and at rest. By using the Service you acknowledge and consent to these cross-border transfers.
We may disclose personal information without your further consent where permitted or required by law, including:
We do not sell your personal information to third parties, and we do not engage in cross-context behavioural advertising.
Our website uses essential cookies for authentication, session management, language preference, and CSRF protection. We do not use advertising cookies or third-party tracking pixels. You may block cookies through your browser settings, but doing so may prevent you from signing in or using parts of the Service.
Transactional notifications (account verification, reservation confirmations, pickup reminders, security alerts) are sent because they are necessary to deliver the Service you requested and are exempt from CASL consent requirements. Marketing communications, where applicable, are sent only with your express opt-in consent and include an unsubscribe mechanism in every message. You may withdraw marketing consent at any time without affecting transactional messages or your account.
We retain personal information only as long as reasonably necessary for the purposes set out above and to comply with our legal, accounting, and reporting obligations.
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:
No method of transmission or storage is 100% secure. We cannot guarantee absolute security. If we become aware of a breach of security safeguards involving a real risk of significant harm, we will notify affected individuals and, where required, the Office of the Privacy Commissioner of Canada and/or the Office of the Information and Privacy Commissioner for British Columbia, in accordance with applicable law.
The Service is not directed at children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a minor has provided us with personal information, please contact our Privacy Officer and we will take reasonable steps to delete it.
You have the right to:
We respond to verified requests within thirty (30) days, or provide reasons for a longer period if necessary, in accordance with PIPEDA timelines. We may require you to verify your identity before responding to a request to prevent unauthorized access. We may charge a minimal cost-recovery fee for access requests, with advance written notice.
We use limited automated processing to calculate your trust score from past activity (no-shows, completions, cancellations) and to sort or rank Deals for display. We do not use automated systems to make decisions that produce legal or similarly significant effects on you without human oversight. You may contact us to request human review of any trust-score determination affecting your account.
Send your request to privacy@candyll.com with enough detail for us to identify you and the information at issue. We may follow up to verify your identity.
If you are not satisfied with our response to a privacy concern, you may file a complaint with:
The Service may link to third-party websites or services. Those sites have their own privacy practices, which we do not control and for which we are not responsible. Review their policies separately.
We may update this Policy from time to time to reflect changes in law, technology, or our practices. We will post the updated version with a new "Last updated" date and, for material changes, provide reasonable notice (for example, by email or in-app message). Your continued use of the Service after the effective date constitutes your acceptance of the updated Policy.
Privacy Officer
privacy@candyll.com
For security issues: security@candyll.com
This Privacy Policy is intended as a good-faith implementation of PIPEDA and BC PIPA. It does not constitute legal advice. Before relying on it in a live production setting, have it reviewed by a Canadian privacy lawyer.