The data a caterer records in online software (customers, menus, proposals, invoices, event history) belongs to the caterer, not to the software provider. The provider hosts and protects it; it can neither analyze it for its own purposes, sell it, nor hold it back. Here is what that means in practice, and the five questions to ask before you sign.
The cloud, in one sentence
The cloud means storing and accessing your data over the Internet, on servers run by a provider, rather than on a computer in your office. You can reach it from anywhere, the whole team works on the same version, and backups no longer depend on a hard drive.
Owner, host, controller: three roles
- **The data owner** is you. Your customer files, your recipes and your figures are your assets.
- **The host** provides the servers. It stores the data without making any use of it.
- **The party responsible for processing**, in the legal sense, is also you when it comes to your customers’ personal information. Your software provider acts as a processor: it handles the data according to your instructions and your obligations.
What the law requires
In Québec, Law 25 has governed the collection, use and retention of personal information since 2023: consent, an incident register, an assessment before any transfer outside Québec, and your customers’ right of access and correction. In France and the European Union, the GDPR sets out the same broad principles, with a data processing agreement between you and your provider.
In both cases, the caterer remains responsible for what it collects: a mailing list for your promotions requires consent, and a customer can ask what information you hold about them.
How Caterer Manager handles your data
- The data of all customers, Canadian and French, is hosted in Canada, in a Toronto data centre.
- Neither Caterer Manager nor its hosting providers use your data: no analysis for their own purposes, no sharing, no selling. Each customer’s data is kept separate from everyone else’s.
- A daily backup protects against loss.
- The number of employees with access to the data is limited, and each one signs a confidentiality agreement.
- In your account, the [Team and security](gt:module.equipe) module gives you 7 roles and 125 permission points: each person sees what they need, nothing more.
- More than 60 Excel exports let you take your data out at any time.
Full details are in our privacy policy.
Five questions to ask any provider
- **Where is my data hosted?** The country matters for Law 25 and the GDPR, and for how quickly you can get access in the event of a dispute.
- **Who on your side has access to it, and under what conditions?**
- **What happens if I leave?** Ask about the export format and how long after the contract ends the data is deleted.
- **How often do you back up, and have you ever restored a backup?**
- **Can I limit what each employee sees?** A delivery driver doesn’t need to see margins; a salesperson doesn’t need banking access.
A provider that answers these five questions clearly, in writing, respects your data. A provider that hesitates on the third one keeps you through how hard it is to leave, not through the quality of its service.
