Data processing agreement

About this agreement

This agreement is part of our terms of service between Meiko Technologies Ltd. (“Luncheezy”, “we”) and the school, school board, parent council or other organization that runs a lunch program on Luncheezy (“you”). An admin accepts it for your organization when they accept the terms.

It covers the personal information that you, your staff, volunteers, sellers and families put into Luncheezy for your program: families’ and children’s details, allergies and diets, orders, payments and credits, staff and volunteers, class lists and lunch-day records (“your school’s information”).

It doesn’t cover what we handle for our own purposes as the organization responsible for it: people’s sign-in details and security records, our billing of your plan, requests sent from our website and messages to our support team. Our privacy policy describes those.

Who is responsible for what

• You are responsible for your school’s information under the privacy law that applies to you: you decide what your program collects and why, you tell families about it, and you answer to them and to your privacy regulator.
• We are your service provider. We keep and process your school’s information for you, under this agreement and the privacy laws that apply to us: the Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia’s Personal Information Protection Act and, for information about people in Quebec, Quebec’s Act respecting the protection of personal information in the private sector (Law 25).
• If you are a public body, such as a school board, you may have duties under a public-sector privacy law. We’ll help you meet them, and we’ll consider signing your own agreement if your law requires one: write to [email protected].

Only on your instructions

We use your school’s information only to provide Luncheezy to you and your families: as the product works, as your staff set it up and use it, and as these terms and your written requests say. We also use it where the law requires, and we’ll tell you first unless the law forbids it.

We never sell your school’s information, use it for advertising or marketing, combine it with information from other sources to build profiles, or use it to train AI models. If an instruction from you seems to break a privacy law, we’ll tell you.

Confidentiality and our staff

Only Luncheezy staff who need to, to support you or keep the service safe, can reach your school’s information, and they are bound to keep it confidential. Support staff can look an account up; only a small number of senior staff, who sign in with two-step verification, can act on it. When one of them views Luncheezy as one of your users to solve a problem, every action is recorded in your school’s audit log, which your admins can read.

Security

We protect your school’s information with the measures described in our privacy policy: encrypted connections, sign-in without passwords and with two-step sign-in for everyone who can change a school’s banking or billing, each school’s information kept apart by the database itself, access limited by role, an audit log that can’t be edited, and logs that never hold sign-in codes, PINs or allergy information. We review these measures as the service changes and as risks evolve.

Sub-processors

We use the providers on our sub-processors list. Each one gets only what its job needs, under a written contract that requires it to protect that information at least as well as this agreement does. We remain responsible to you for what they do with it.

We tell your admins by email at least 30 days before a new provider receives your school’s information, unless we must replace one urgently to keep the service running or secure; then we tell you as soon as we can. If you object for a reasonable privacy reason and we can’t address it, you may stop using Luncheezy and close your school’s account without penalty, and we refund any plan fees you prepaid for the period after it closes.

Where your school’s information goes

Your school’s information is stored in Canada: on servers we operate ourselves, and with Backblaze in Toronto for files and backups. Only three providers process some of it outside Canada: Stripe (payments; in the United States and other countries), MailerSend (email; in the European Union) and Plivo (sign-in codes by text message; in the United States). None of them receives allergy or diet information.

Information processed in another country is subject to that country’s laws, and its courts and authorities may be able to reach it. Before sending personal information outside Quebec, we assess the privacy risks as Quebec law requires. You can ask us for a summary of that assessment.

Confidentiality incidents

If we learn that your school’s information has been accessed, used, disclosed or lost without authorization, we tell your admins and privacy officer without undue delay, and we act at once to stop it and to limit the harm. We tell you what happened, what information and people are involved as far as we know, what we’ve done and what we recommend, and we keep you updated.

We record every incident in our incident register, as Quebec law requires, and keep that record for 5 years. Unless we agree otherwise, you decide whether to notify the people concerned and your regulator, and we give you what you need to do it. When the incident is ours to report under the law that applies to us, we report it too.

Helping you with requests and assessments

Families can see, correct and download much of their own information in the app, and your staff can correct and export your school’s information. If someone asks you for access to, a correction of or the deletion of their information and the app can’t do it, we help you answer within the time the law gives you.

If we receive a request about your school’s information directly, we send it to you, or tell the person to contact you, unless it concerns their own Luncheezy account. We also help you with privacy impact assessments, questions from a regulator and the privacy and security questionnaires public bodies send.

At the end: export and deletion

You can export your school’s information at any time with the app’s reports and exports.

• When your school closes its Luncheezy account (or we end it under the terms), ordering stops, your staff and families are told, and your admins can still sign in to export your school’s information for 90 days.
• After those 90 days, we delete your school’s personal information or make it anonymous: children’s names are replaced by a code, and their allergies, sign-ins, class lists, staff roles and family links are deleted.
• We keep financial records (orders, payments, refunds, credits and fee statements) for 7 years, as tax law requires, and then delete them. Audit-log entries are kept 2 years, or 7 years for money, and then deleted.
• Deleted information leaves our backups within 35 days, as backups roll off.
• Parents keep their own Luncheezy account, which they can delete at any time; their link to your school ends.

While your school uses Luncheezy, information is also deleted on the schedule in our privacy policy: for example, children are made anonymous 12 months after they leave your school.

Information and audits

We answer your reasonable questions about how we handle your school’s information, and give you on request a summary of our security measures and privacy assessments. If you need more to meet your legal duties, such as an audit after an incident, we’ll agree on its scope, timing and cost with you in good faith.

How long it lasts, and conflicts

This agreement applies for as long as we hold your school’s information, even after your account closes. If it and the terms of service say different things about personal information, this agreement wins. We may update it the way the terms describe; a change that matters is announced ahead of time and accepted again by an admin.

Contact

Our privacy officer is responsible for this agreement: [email protected], or by mail at 4648 Lakelse Avenue, Terrace, BC V8G 1R2, Canada.