Privacy Policy

This policy is issued by Tomahawk Group (“Tomahawk Group,” “we,” “us,” or “our”), a Montreal-based hospitality group that owns and operates a collection of restaurants, bars, and cafés. Our registered mailing address is:

Tomahawk Group
222 St Laurent Blvd
Montreal, Quebec · H2Y 1Y7 · Canada

This policy applies to personal information we collect through our website (tomahawkgroup.ca and any venue subdomains), our email communications, our AI phone assistant “Vicky,” our guest-relations and loyalty programs, and your in-person visits to any of our venues.

Reservations booked on third-party platforms (OpenTable, Resy, Google, Instagram, etc.) are also governed by those platforms’ own privacy policies. Once we receive a reservation, your information is handled under this policy.

Quebec’s Law 25 requires every business to name a person responsible for the protection of personal information. Ours is:

Thomas Vernis — Privacy Officer
thomas@tomahawkgroup.ca
514-844-2367

You can contact our Privacy Officer at any time to exercise your rights, ask a question, or file a complaint. We will acknowledge your request within 10 business days and respond substantively within 30 days, as required by law.

We only collect information that is reasonably necessary for the purposes described in Section 4. Specifically, we collect the following categories:

a. Information you give us directly

• Newsletter subscriptions: email address, preferred language, and the page you subscribed from.
• Career applications: name, email, phone, résumé, preferred positions and venues, optional cover letter or message.
• Reservations and bookings: name, email, phone, party size, date, time, and any special requests or dietary notes you share.
• In-venue guest profile: if you share it with our team — first and last name, email, phone, birthday, company, preferred language, dietary or accessibility needs, and notes from past visits (e.g., favourite table, preferred wine, allergies).
• Private-event or press inquiries: the information you include in your message.

b. Information from phone calls with Vicky (our AI assistant)

• Caller phone number, duration, date and time.
• Call transcript and audio recording, so we can confirm reservations and improve service.
• Any information you voluntarily share during the call (name, party size, date, dietary notes, etc.).

Vicky announces at the beginning of each call that the conversation is recorded and handled by an AI assistant. You can decline and ask to speak to a human or hang up at any time.

c. Information collected automatically when you visit our website

• Device and browser information (type, operating system, screen size, language).
• IP address, approximate city-level location derived from it, and referring URL.
• Pages visited, time on page, clicks on reservation buttons, and session-level navigation.
• Marketing campaign parameters (UTM source, medium, campaign) when you arrive from a link we sent.
• Cookies and similar technologies — see Section 8.

d. Information from third parties

• Reservation systems (OpenTable and similar) — name, contact details, and booking history for reservations made through them.
• Social platforms — limited profile information you choose to share when you interact with our accounts.
• Referrals from partners and concierges — name and contact details, only when you have consented.

We do not knowingly collect information from children under the age of 14. If you believe a child has provided us with personal information, please contact our Privacy Officer and we will delete it.

We use personal information only for the purposes listed below. Under Law 25, each purpose is disclosed separately so you can consent (or decline) meaningfully.

• Operate our venues — process reservations, prepare your table, honour dietary or accessibility needs, handle private events, respond to inquiries.
• Recognize you across our venues — if you have opted in to our guest-relations program, we use a single profile across all Tomahawk Group venues so staff can welcome you back and remember your preferences.
• Send marketing and loyalty communications — only with your express consent (Section 7). You can unsubscribe at any time.
• Evaluate career applications — screen, interview, and follow up with candidates.
• Improve our website and service — anonymous and aggregate analytics help us understand which pages work and where guests get stuck.
• Prevent fraud and secure our systems — detect abuse of coupon codes, suspicious logins, bot traffic.
• Comply with legal obligations — tax, accounting, employment, liquor-licensing, health-and-safety, and responses to lawful requests from authorities.

We do not use your personal information for any purpose that we have not told you about, and we do not sell your personal information. Ever.

We share personal information only with the categories of recipients listed below, and only to the extent necessary.

a. Within Tomahawk Group

Our venues are operated under a common guest-relations program. If you are a recognized guest at Felix and visit June Buvette for the first time, our team may see the notes in your profile so they can serve you at the same standard. You can opt out of this cross-venue recognition at any time by writing to our Privacy Officer.

b. Service providers (processors) acting on our instructions

We use carefully selected vendors to run the technology behind our operations. They are bound by written agreements to use your information only for the services we ask them to perform, to protect it with appropriate safeguards, and to return or destroy it when the contract ends.

c. Legal authorities

We disclose personal information when required by Canadian law — for example, in response to a valid court order, a lawful request from the police, or a tax audit — and to defend our legal rights. When permitted, we will notify you first.

d. In a business transaction

If Tomahawk Group is sold, merged, or restructured, personal information may be transferred to the successor entity. We will notify you in advance and you will retain all rights described in this policy.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

Several of our service providers are located in the United States, which means your personal information may be processed outside Quebec and outside Canada. Before using a provider outside Quebec, we conduct a Privacy Impact Assessment to confirm that your information will receive protection equivalent to what Law 25 requires. We also enter into written agreements with each provider that include contractual safeguards (confidentiality, security standards, breach-notification obligations, sub-processor limits, and audit rights).

You can ask our Privacy Officer for a summary of the Privacy Impact Assessment covering any specific transfer.

Wherever possible, we rely on your express consent — the kind you give by ticking a box, typing your email into a signup form, or telling us at the host stand. We separate each purpose so you can consent to one thing (e.g., reservations) without being forced to consent to another (e.g., marketing).

In some cases we rely on other legal bases:

• Performance of a contract — to process a reservation or a job application you have submitted.
• Legal obligation — to keep records required by tax, employment, or liquor-licensing law.
• Legitimate interest — minimal, narrow uses such as preventing fraud or securing our website, where we have balanced our interest against your rights.
• Implied consent under CASL — for a limited period, we may send you service-related messages and a small number of marketing messages arising from an existing business relationship (e.g., you made a reservation in the last 24 months). You can still opt out at any time.

You can withdraw your consent at any time. For marketing, click the unsubscribe link at the bottom of any email, or email thomas@tomahawkgroup.ca. For other purposes, contact our Privacy Officer. Withdrawal will not affect the lawfulness of anything we did before you withdrew.

Our website uses cookies and similar technologies (local storage, pixels, SDKs) for three categories of purposes:

• Strictly necessary — required for the site to function (e.g., language preference, session continuity, CSRF protection). These do not require consent.
• Analytics — Google Analytics 4 and Vercel Analytics help us understand aggregate traffic patterns. Under Law 25, we load these only after you consent.
• Marketing attribution — we read UTM parameters from the URL when you arrive from one of our campaigns, so we can measure which campaigns work.

You can control cookies through your browser settings, and you can ask Google to exclude your visits from Analytics using the Google Analytics Opt-out Browser Add-on.

We do not make any decision that produces legal or similarly significant effects on you using automated processing alone. Our AI phone assistant Vicky helps take reservations, but reservation confirmations, cancellations, waitlist offers, and any exception handling are reviewed and approved by a human team member at the relevant venue.

We keep personal information only as long as we need it for the purposes we collected it for, plus any period required by law.

• Newsletter subscriptions — until you unsubscribe, plus 3 years (CASL consent records).
• Guest-relations profiles — for the duration of your relationship with us, plus 3 years of inactivity, after which we anonymize or delete.
• Reservation records — typically 24 months, unless linked to an ongoing guest profile.
• Career applications — 24 months after the final decision, then destroyed unless you ask us to keep them longer.
• Call recordings and transcripts — 12 months.
• Financial records (invoices, receipts) — 7 years, as required by Canadian tax law.
• Email suppression list — indefinitely, so we can honour your opt-out.
• Website analytics — 14 months in Google Analytics (our configured retention), then aggregated.

We use reasonable technical, physical, and organizational safeguards, including:

• TLS encryption in transit for every web and email interaction.
• Encrypted storage at rest with our cloud providers.
• Role-based access control — only staff who need your information for their job can see it.
• Multi-factor authentication for all administrative accounts.
• Regular security reviews of our providers and of our own code.
• Written agreements with every service provider, including breach-notification obligations.
• A documented incident-response plan. If a confidentiality incident poses a risk of serious injury, we will notify you and the Commission d’accès à l’information promptly, as Law 25 requires.

No system is perfectly secure. If you suspect a problem with your account or data, please contact our Privacy Officer immediately.

Under Quebec’s Law 25 and Canada’s PIPEDA, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate, incomplete, or ambiguous.
• Withdraw your consent at any time, subject to legal and contractual restrictions.
• Request the deletion of information whose collection was not authorized by law or whose purposes have been fulfilled.
• Data portability — receive a computerized copy of the information you gave us, in a common structured format (Law 25, since September 2024).
• Object to automated decisions, though we do not currently make any. If this ever changes, we will tell you and give you a way to ask for human review.
• Know the logic behind any decision affecting you that involves automated processing, and the main factors involved.
• File a complaint with our Privacy Officer — and, if you are not satisfied with our response, with the Commission d’accès à l’information (in Quebec) or the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, email thomas@tomahawkgroup.ca from the address on file, or write to us at the mailing address above. We will respond within 30 days. There is no fee for reasonable requests. We may need to verify your identity before we act.

Every commercial email we send to a Canadian address complies with the Canadian Anti-Spam Legislation (CASL). It identifies us, gives our postal address, includes our contact information, and contains a clearly visible unsubscribe link that works for at least 60 days after the email is sent. Unsubscribes are honoured within 10 business days, as the law requires.

You can unsubscribe at any time by clicking the link at the bottom of any email, visiting our unsubscribe page, or writing to thomas@tomahawkgroup.ca.

If you are located outside Canada — for example, if you are a visiting guest from the United States or the European Union — this policy still applies to your interactions with us. We apply the protections described here to all guests, regardless of where you live.

Residents of the European Economic Area, the United Kingdom, and Switzerland: our lawful bases under the GDPR are (i) consent, (ii) performance of a contract, (iii) legitimate interest, or (iv) legal obligation, as described throughout this policy. You may contact our Privacy Officer to exercise GDPR rights equivalent to those described in Section 12.

We review this policy at least once a year and whenever we change our practices. When we make material changes, we will post a banner on the website and, for existing subscribers, send you an email before the change takes effect. The current version is always at tomahawkgroup.ca/privacy.

For any privacy-related question or request, please contact our Privacy Officer using the details in the card below.