Back to obsrv.ca
Legal
Last updated: September 4, 2026
OBSRV ("we," "us," "our") is a mystery shopping and guest-experience evaluation company based in Ontario. This policy explains what personal information we collect, why we collect it, how we protect it, and your rights regarding it under Canadian privacy law. It covers obsrv.ca (the "Site"), individuals who contact us or become clients, the business contacts we research as part of our outreach, individuals who take part in our mystery shopper program, and individuals observed during an evaluation.
This policy applies differently depending on your relationship to OBSRV:
Website visitors and inquirers: anyone who submits our contact form.
Clients: restaurants and hospitality businesses that engage us to conduct evaluations.
Business contacts: restaurant owners, managers, and operators whose publicly available business information we research for outreach purposes, whether or not you've contacted us.
Mystery shoppers: individuals who apply to or take part in our shopper program.
Observed individuals: restaurant staff described in a shopper's evaluation notes. See Section 5.
From website visitors: when you submit our contact form, we collect what you provide, typically your email address, business name, and details about what you'd like us to observe. We do not use cookies, analytics, or tracking technologies on this Site at this time.
About business contacts: to identify restaurants that may benefit from our services, we research publicly available business information: business name, address, business phone number, and, where published, an owner or manager's name and business email address. Sources include business websites, local food journalism, and public business directories.
From clients: when you engage us, we collect the information needed to scope, deliver, and invoice an engagement, including contact details for the person coordinating it and details about the location(s) to be evaluated.
From mystery shoppers: when you apply to our shopper program, we collect the information on our intake form, typically your name, contact information, and location, so we can match you with nearby assignments. If you complete an assignment, we also collect the observations, ratings, and notes you submit, along with reimbursement or payment details needed to pay you.
Survey and engagement data: the evaluation forms our shoppers complete may include photos of the location, receipts as proof of visit, and timestamped answers to structured questions about the visit. Where practical, we ask shoppers to avoid capturing other guests or full payment card numbers in photos; any such incidental information is used only to verify the visit and complete the report, and is not disclosed beyond that purpose.
We rely on different forms of consent depending on how we collect your information. Submitting our contact form or applying to our shopper program is voluntary and constitutes your consent to the collection, use, and disclosure described in this policy for that purpose. Where we research business contact information from public sources, we rely on the "publicly available information" basis recognized under PIPEDA, alongside your ability to opt out of further contact at any time (Section 10). You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us using the information in Section 15; withdrawing consent may limit our ability to provide services to you.
We use contact-form information solely to respond to your inquiry and, if you proceed, to scope and deliver a mystery shopping engagement.
We use business contact information to reach out about our services, subject to the outreach practices described in Section 10.
We use client information to deliver, invoice, and improve our engagements.
We use shopper-submitted information to assign and manage evaluations, pay shoppers, and compile reports for our clients.
In all cases, we do not sell, rent, or share your information with third parties for their own marketing purposes.
Our evaluations involve mystery shoppers documenting their experience as a guest, which may include descriptions of interactions with restaurant staff. We collect this information solely to report back to the restaurant that engaged us, and we do not publish, sell, or otherwise disclose it outside that engagement.
As an Ontario business handling personal information in the course of commercial activity, we follow the ten principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA):
Accountability: OBSRV is responsible for compliance with this policy (Section 15).
Identifying Purposes: we identify why we collect your information at or before the time of collection, as described throughout this policy.
Consent: we collect, use, and disclose personal information with appropriate consent, as described in Section 3.
Limiting Collection: we collect only what's needed for the purposes identified in this policy.
Limiting Use, Disclosure, and Retention: we use and disclose personal information only for the purposes for which it was collected, and retain it only as long as necessary (Section 11).
Accuracy: we take reasonable steps to keep personal information accurate and up to date for its intended use.
Safeguards: we protect personal information with safeguards appropriate to its sensitivity (Section 7).
Openness: this policy is publicly available and describes our practices in plain language.
Individual Access: you may request access to, and correction of, your personal information (Section 12).
Challenging Compliance: you may direct questions or complaints to us, or to the Office of the Privacy Commissioner of Canada (Section 12).
We take reasonable steps to protect personal information against loss, theft, and unauthorized access, including restricting access on a need-to-know basis and relying on reputable service providers with their own security safeguards. No system is completely secure, and we cannot guarantee absolute security.
We use service providers based in Canada and abroad, including the United States, to host our Site and manage inquiries, leads, engagement data, and shopper submissions. As a result, your information may be stored or processed outside Canada and could be accessible to foreign authorities under the laws of those jurisdictions.
Our Site is hosted by GoDaddy. We do not integrate any third-party advertising or payment processing on the Site itself.
Behind the scenes, we use Google Workspace (Sheets, Forms, Gmail) to manage inquiries, engagements, and shopper data, and research tools to help identify business contacts. These providers process information on our behalf and do not use it for their own purposes.
If we contact you by email about our services, that message will identify OBSRV as the sender, include our contact information, and provide a way to opt out of future messages. We honor opt-out requests promptly and will not contact you again once you've asked us to stop, consistent with Canada's Anti-Spam Legislation (CASL).
Contact-form inquiries: retained for up to 24 months if no engagement results, or, if you become a client, for the duration of our engagement plus a reasonable period afterward for record-keeping.
Business contacts we've researched: retained for up to 12 months from when we last researched or contacted you, unless you become a client.
Mystery shoppers: retained for the duration of your participation in our program plus a reasonable period afterward, to respond to inquiries and meet financial record-keeping obligations.
Clients: retained for the duration of our engagement plus a reasonable period afterward for record-keeping and legal compliance.
Under PIPEDA, you have the right to access the personal information we hold about you, request corrections, and withdraw consent where applicable. To make such a request, contact us at info@obsrv.ca; we aim to respond within 30 days. If you're not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.
If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and report the breach to the Office of the Privacy Commissioner of Canada as required by law.
Our services are intended for business use and are not directed at individuals under the age of 18. We do not knowingly collect information from minors.
Questions about this policy, or requests regarding your personal information, can be directed to us at info@obsrv.ca.
We may update this policy from time to time. The "last updated" date above reflects the most recent revision.
This policy is governed by the laws of the Province of Ontario, Canada. This policy is drafted to comply with PIPEDA, the federal private-sector privacy law currently in force. It does not address obligations under other jurisdictions' laws (for example, U.S. state privacy laws or the GDPR), which are not applicable to OBSRV's current operations.