Privacy Policy

1.Who we are and what this Policy covers

We are Fluid Events Inc., carrying on business as eventmate (“eventmate,” “we,” “us,” or “our”), a corporation with its registered office at 2229 Kingston Road, Scarborough, Ontario M1N 1T8, Canada.

This Privacy Policy explains what personal information we collect through our marketing and information website at https://www.eventmate.ca, the eventmate application at https://app.eventmate.ca, the eventmate mobile application, and our related products and services (together, the “Services”), why we collect it, how we use, share, and protect it, how long we keep it, and the choices and rights you have.

This Policy forms part of our Terms of Use. Words that are given a defined meaning in the Terms of Use, including “Organizer,” “End User,” “Attendee,” “Donor,” “Bidder,” “Event,” and “Transaction,” have that same meaning here.

If you do not agree with this Policy, please do not use the Services.

2.Our two roles

We handle personal information in two capacities: for our own purposes, and on behalf of an Organizer. Which capacity applies determines who is accountable for the information and who you should contact about it.

Information we handle for our own purposes. When an Organizer registers for an account, subscribes to the Services, contacts us, signs up to hear from us, or visits our website, we collect and use that information for our own business purposes. For this information, eventmate is the organization accountable under the *Personal Information Protection and Electronic Documents Act* (Canada) and comparable provincial legislation.

Information we handle on behalf of an Organizer. When an Organizer uses the Services to run an Event, we handle personal information about that Organizer’s Attendees, Donors, Bidders, purchasers, guests, and staff on the Organizer’s behalf and at its direction. We call this information “Event Data.” Event Data includes guest lists uploaded by the Organizer, check-in records, donation and receipt information, bid and purchase records, and messages and names submitted for display at an Event.

What that means in practice. The Organizer, and not eventmate, decides what Event Data is collected, what it is used for, and what happens to it. The Organizer is responsible for telling individuals how their information will be used, for obtaining any consent required, and for responding to requests those individuals make about their information. Under Canadian privacy law an organization remains accountable for personal information it transfers to a service provider for processing, and so the Organizer remains accountable for its Event Data. We handle Event Data only to provide, support, secure, and operate the Services for that Organizer, as permitted by our agreement with the Organizer, and as required by law.

Aggregated and de-identified information. We may create aggregated or de-identified information from the way the Services are used, such as counts of check-ins, average donation size, or the times of day when features are used, and we may use that information to operate, secure, and improve the Services and to report on their performance generally. Aggregated and de-identified information does not identify any individual and we do not attempt to re-identify it.

Who to contact. If you are an Attendee, Donor, Bidder, or purchaser and you want to know how a particular Organizer handles your information, please contact that Organizer. Section 13 explains what we will do if you contact us instead.

3.Where this Policy applies

The Services are offered from Canada and are intended for Organizers established in Canada, outside the Province of Quebec, and for their Events held in Canada, outside the Province of Quebec. Certain features, including donation receipt generation, are built for Canadian tax rules.

Quebec. The Services are not offered to Organizers established in Quebec and are not intended for Events held in Quebec. We have not built the Services or this Policy to meet the specific requirements of the *Act respecting the protection of personal information in the private sector* (Quebec), and we do not represent that they do. If you access the Services from Quebec, or use them in connection with an Event in Quebec, you do so on your own initiative and you are responsible for determining whether the Services are appropriate for you and for complying with the laws that apply to you.

Outside Canada. The Services are not directed to individuals or organizations outside Canada. If you access the Services from outside Canada, you do so on your own initiative and your personal information will be handled in accordance with this Policy and Canadian law.

4.Information we collect

4.1Information Organizers provide. When you register an Organizer account, subscribe, or configure an Event, we collect the name, job title, email address, and telephone number of the individuals who administer the account, account credentials, the name and size of your organization, the types of events you intend to run, and your billing address and billing contact details. Where you use the receipting feature, we also collect the charitable registration number, legal name, address, logo, and authorized signatory details you supply for use on receipts.

4.2Information collected in connection with an Event. Depending on how the Organizer configures its Event, we may collect or receive, as Event Data, the name, email address, telephone number, and mailing or billing address of Attendees, Donors, Bidders, and purchasers; donation amounts, dates, and receipt details; bid history, winning bids, and purchase details; check-in status and attendance records; guest list information uploaded by the Organizer, which may include seating or table assignments, guest relationships, and any notes or requirements the Organizer chooses to record; and any messages, names, or images submitted for display at the Event.

4.3Payment information. All Transactions are processed by Stripe, Inc. We do not collect, receive, or store full payment card numbers, expiry dates, or card security codes. Stripe provides us with confirmation of the Transaction and limited details such as the amount, the date, the status, the card brand, and the last four digits of the card. Where you pay using Apple Pay or Google Pay, your payment credentials are handled by the device provider and by Stripe and are not disclosed to us. Stripe’s privacy notice is available at https://stripe.com/en-ca/privacy.

4.4Information collected automatically. When you use the Services we automatically collect technical information including your IP address, browser and device type and settings, operating system, language preference, referring URLs, date and time stamps, the pages and features you use, error and diagnostic reports, and an approximate location derived from your IP address. We do not collect precise device or satellite-based location, and the Services do not request access to your device’s location. We use this information to operate and secure the Services, to diagnose problems, and for internal analytics and reporting.

4.5Sensitive information. We do not ask for and do not seek to collect sensitive personal information such as health information, racial or ethnic origin, religious beliefs, or sexual orientation. An Organizer may, however, choose to include information of that kind in a guest list or in an Event configuration, for example dietary or accessibility requirements. Under our Terms of Use the Organizer is responsible for collecting that information lawfully and for obtaining any consent required. Please do not submit information through the Services that you would not want the Organizer and its Event team to see.

4.6Information about other people. If you provide us with personal information about another individual, for example by uploading a guest list, registering a companion, or making a payment on someone else’s behalf, you confirm that you are entitled to provide that information to us for the purposes described in this Policy.

5.How we use personal information

We use personal information for the following purposes:

(a)to create, authenticate, and administer Organizer accounts, and to keep those accounts in working order;

(b)to provide the Services to Organizers, including guest list management and check-in, display of event materials and messages, auctions, on-site sales, donation collection, and the generation of donation receipts on the Organizer’s behalf and at its direction;

(c)to process and record Transactions through Stripe, to make Transaction records available to the Organizer, and to calculate and apply the Platform Fee;

(d)to send transactional and service messages, including account notices, receipts, bid confirmations, outbid notices, closing reminders, auction results, and notices of changes to our terms or policies;

(e)to respond to enquiries, provide customer support, and troubleshoot problems;

(f)to send marketing and promotional communications to Organizers and to individuals who have asked to hear from us, in accordance with section 15;

(g)to monitor, secure, and protect the Services, including detecting and preventing fraud, abuse, and unauthorized access;

(h)to understand how the Services are used, to identify usage trends, and to evaluate and improve the Services, as described in section 9;

(i)to publish testimonials that you have given us permission to publish;

(j)to establish, exercise, or defend legal claims, and to enforce our Terms of Use; and

(k)to comply with our legal, regulatory, and record-keeping obligations.

We will not use personal information for a new purpose that is materially different from those described above without first obtaining consent, unless we are permitted or required by law to do so.

6.Consent

How we obtain consent. We collect, use, and disclose personal information with your consent, which may be express or implied depending on the sensitivity of the information and the purpose. Registering an account, making a Donation, submitting a Bid, purchasing an item, or submitting content for display at an Event implies consent to the handling of that information for the purposes described in this Policy. We ask for express consent where the law requires it, including for most marketing communications.

Withdrawing consent. Subject to legal and contractual restrictions and reasonable notice, you may withdraw your consent at any time by contacting our Privacy Officer as set out in section 19. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it, and it does not require us to delete records we are required to keep, including donation and receipt records. If you withdraw consent, we may no longer be able to provide some or all of the Services to you.

Exceptions. In limited circumstances Canadian privacy law permits us to collect, use, or disclose personal information without consent, including where it is necessary to investigate a breach of an agreement or a contravention of law, to detect or prevent fraud, to comply with a subpoena, warrant, or court order, or in connection with a prospective business transaction where prescribed conditions are met.

Event Data. Where we handle Event Data on an Organizer’s behalf, obtaining and managing consent is the Organizer’s responsibility, not ours.

7.Who we share personal information with

7.1Service providers. We use the following third parties to operate the Services: Stripe, Inc. for payment processing and payouts; Supabase for authentication, database, and hosting; PostHog for product analytics and session recording; and providers used to deliver email and text message notifications. We may add or change service providers from time to time and will update this Policy accordingly. We require our service providers by contract to protect personal information to a standard comparable to our own and to use it only for the purposes for which we engaged them.

7.2The Organizer. Event Data is made available to the Organizer that is running the Event, and to the individuals the Organizer authorizes to administer its account. Once the Organizer has that information, the Organizer’s own privacy practices apply to it.

7.3Business transactions. We may disclose personal information in connection with, or during negotiations of, a financing, merger, reorganization, or sale of all or part of our business, subject to the conditions imposed by applicable privacy law. If a transaction completes, the acquiring party will be required to use the information for the purposes for which it was collected.

7.4Legal and protective disclosures. We may disclose personal information where we are required or permitted by law to do so, including in response to a subpoena, warrant, court order, or lawful request from a government or regulatory authority, and where we reasonably believe disclosure is necessary to investigate or prevent fraud or unlawful activity, to protect the safety of any person, or to establish, exercise, or defend legal claims.

7.5With your consent. We may disclose personal information for other purposes with your consent.

7.6No sale of personal information. We do not sell, rent, or trade personal information, and we do not disclose personal information to third parties for their own marketing purposes.

8.Information stored or processed outside Canada

Some of our service providers store or process personal information outside Canada, including in the United States. Where personal information is stored or processed in another country, it may be accessible to the courts, law enforcement agencies, and regulatory or national security authorities of that country under the laws of that jurisdiction, and those laws may not provide the same protections as Canadian law.

We require our service providers by contract to protect personal information to a comparable standard, but those contractual protections do not override foreign law. By using the Services, you acknowledge that your personal information may be stored and processed outside Canada on this basis. If you would like more information about our practices in this area, or about the specific service providers we use and where they store information, please contact our Privacy Officer as set out in section 19.

9.Cookies, analytics, and session recording

9.1Strictly necessary cookies. We use cookies and similar technologies that are necessary for the Services to function, including to keep you signed in, to maintain your session, to remember your preferences, and to protect the security of the Services. These cannot be disabled without affecting the operation of the Services.

9.2Analytics. We use PostHog to understand how the Services are used, to identify usage trends, to diagnose errors, and to improve the Services. PostHog collects information such as pages and screens viewed, features used, clicks and navigation, device and browser characteristics, and IP address.

9.3Session recording. PostHog also creates recordings of on-screen activity during a session, showing page views, navigation, scrolling, and clicks as they occurred. This is used to understand how people move through the Services, to identify points of difficulty, and to diagnose faults. Session recording is limited to publicly accessible pages of the Services. Payment pages and payment entry screens are not recorded, and payment card details are not captured. Session recordings are retained for the period set out in section 10.

9.4No advertising technologies. We do not use cookies or similar technologies to deliver targeted or interest-based advertising, and we do not permit third parties to use tracking technologies on the Services for advertising purposes.

9.5Managing cookies. Most browsers accept cookies by default. You can usually set your browser to remove or reject cookies through its settings. If you remove or reject cookies, some features of the Services may not work as intended.

10.How long we keep personal information

We keep personal information only for as long as we need it for the purposes described in this Policy, or for as long as we are required or permitted to keep it by law. The following periods apply:

(a)Donation, receipt, and Transaction records, and the personal information contained in them, are retained for seven years from the end of the calendar year in which the Transaction occurred, consistent with Canada Revenue Agency record-keeping expectations for charitable receipting and general tax records.

(b)Records evidencing consent to receive commercial electronic messages are retained for three years after the consent expires or is withdrawn, so that we can demonstrate compliance with Canada’s anti-spam legislation.

(c)Records of breaches of security safeguards involving personal information under our control are retained for twenty-four months from the date we determine the breach occurred, as required by federal privacy law.

(d)Product analytics data and session recordings are retained for twelve months.

(e)Organizer account records, including account credentials and configuration information, are retained for the duration of the subscription and for one year afterwards, other than records described in paragraphs (a) to (c) and (f).

(f)Records relevant to an actual or reasonably anticipated dispute, complaint, chargeback, or legal claim are retained until the matter is resolved and the applicable limitation period has expired.

(g)All other personal information is retained for one year from the date of collection or from the end of the Event to which it relates, whichever is later.

Where an Organizer’s subscription ends, we will make its data available for export as described in our Terms of Use, after which the periods above apply. When we no longer need personal information, we securely delete or anonymize it. Where deletion is not immediately possible, for example because the information is held in backup archives, we isolate it from further processing until deletion is possible.

11.How we protect personal information

We maintain administrative, technical, and physical safeguards that are appropriate to the sensitivity of the information we hold. These include encryption of information in transit, access controls that limit access to personnel who need it to do their work, authentication and session management through Supabase, segregation of Organizer data, and reliance on Stripe for the handling of payment card information so that card details never reach our systems.

No method of transmission over the internet and no method of electronic storage is completely secure. While we take our obligations seriously and use reasonable measures to protect personal information, we cannot guarantee that unauthorized access will never occur, and transmission of personal information to and from the Services is at your own risk.

12.Privacy breaches

12.1Records. We maintain a record of every breach of security safeguards involving personal information under our control, whether or not the breach creates a real risk of significant harm, and we retain those records for twenty-four months.

12.2Information we hold for our own purposes. Where a breach involves personal information that we hold for our own purposes and it is reasonable to believe the breach creates a real risk of significant harm to an individual, we will report the breach to the Privacy Commissioner of Canada and notify the affected individuals as soon as feasible, and we will notify any other organization or institution that may be able to reduce the risk of harm.

12.3Event Data. Where a breach involves Event Data that we hold on an Organizer’s behalf, the Organizer is the organization in control of that information and is responsible for assessing whether the breach creates a real risk of significant harm, for reporting the breach to the applicable regulator, and for notifying affected individuals. In those circumstances we will:

(a)notify the affected Organizer without undue delay after we become aware of the breach;

(b)provide the Organizer with the information reasonably available to us that it requires to assess the breach and to meet its own reporting and notification obligations, and cooperate with the Organizer’s reasonable requests in connection with the breach;

(c)take reasonable steps to contain the breach, investigate its cause, and mitigate its effects; and

(d)not notify Attendees, Donors, Bidders, purchasers, or other individuals directly without the Organizer’s instruction, unless we are required to do so by law, in which case we will tell the Organizer before we do so where it is lawful and practicable to do that.

Nothing in this section limits any obligation we have under applicable law.

13.Your privacy rights

Subject to certain exceptions under Canadian privacy law, you have the right to ask us for access to the personal information we hold about you, to be told how it has been used and to whom it has been disclosed, to have inaccurate or incomplete information corrected, to withdraw your consent as described in section 6, and to ask that information be deleted where we are not required to keep it.

How to make a request. Please contact our Privacy Officer as set out in section 19. We will respond within thirty days of receiving your request, or tell you within that period if we need an extension and why. We may need to verify your identity before acting on a request, and we will use the information you give us for that purpose only. There is no charge for an access request, although we may charge a reasonable fee for a request that requires significant copying or transcription, in which case we will tell you the estimated cost before proceeding.

Requests about Event Data. If your request relates to information we hold on an Organizer’s behalf, we are not in a position to act on it directly. We will tell you which Organizer holds the information, and, where you ask us to, we will forward your request to that Organizer and act on the Organizer’s instructions.

Account information. Organizers can review and update most account information at any time by signing in to the account settings.

Complaints. If you are not satisfied with how we have handled your personal information or your request, please raise it with our Privacy Officer first so that we have an opportunity to resolve it. You may also complain to the Office of the Privacy Commissioner of Canada, and, if you are located in Alberta or British Columbia, to the Information and Privacy Commissioner of that province.

14.Children and young people

The Services are not directed to children under 13 and we do not knowingly collect personal information from children under 13. As set out in our Terms of Use, you must be at least 18 years old to make a Donation, submit a Bid, or purchase an item through the Services.

An Organizer may include a person under 18 on a guest list or check them in to an Event, and it is the Organizer’s responsibility to obtain any consent required to do so. If you believe we have collected personal information from a child under 13, please contact us at the address in section 19 and we will take reasonable steps to delete it.

15.Marketing communications

We send marketing and promotional communications only where we have consent to do so or where we are otherwise permitted under Canada’s anti-spam legislation, including where we have an existing business relationship with you. Every marketing message we send identifies us and includes a working unsubscribe mechanism, and we action unsubscribe requests within ten business days.

Unsubscribing from marketing messages does not stop transactional and service messages that are necessary to administer an account, complete a Transaction you have entered into, or tell you about changes to our terms and policies.

Where an Organizer sends messages to its Attendees, Donors, or Bidders through the Services, the Organizer is the sender of those messages and is responsible for complying with anti-spam legislation, including consent, identification, and unsubscribe requirements.

16.Information displayed publicly at an Event

Depending on how an Organizer configures its Event, information such as your name, the fact that you made a Donation, a donation amount, a bid, or a message you submit may be displayed publicly at the Event, for example on a donation wall, a recognition screen, a leaderboard, or a live event screen. The Organizer decides what is displayed and is responsible for monitoring and moderating that content.

If you do not want your name, your Donation, or a message you have submitted to be displayed at an Event, please tell the Organizer before or at the time you make it. Once information has been displayed at an Event, it may have been seen, photographed, or recorded by others, and we cannot control what those individuals do with it.

17.Organization name, logo, and testimonials

By creating an account or using the Services, an Organizer grants Fluid Events Inc. a non-exclusive, royalty-free licence to use and display the organization’s name and logo to identify it as a client or user of eventmate for marketing and promotional purposes, including on the eventmate website, in client showcases, and in general marketing materials. We will not use an Organizer’s name or logo in a false, misleading, or disparaging manner, and we will not alter a logo beyond standard formatting or sizing for display.

This licence continues after an account is terminated and continues until the Organizer asks us in writing to stop. Following that written request, we are not required to remove or recall materials already printed or otherwise in circulation, and we will remove references to the Organizer from digital media within our control, such as our website and social media accounts, within sixty days of the request. This provision is intended to align with the corresponding provision of our Terms of Use.

If you give us a testimonial, quotation, or endorsement, you grant us permission to publish it together with your name, title, and organization on our website and in our marketing materials, unless you tell us otherwise in writing at the time. You may ask us to stop using a testimonial at any time by contacting our Privacy Officer, and the same sixty-day removal period applies.

18.Changes to this Policy

We may update this Policy from time to time. The updated version will be identified by a new “last updated” date at the top. Where we make a material change, we will provide notice by posting the updated Policy prominently and, where appropriate, by contacting Organizers directly. We encourage you to review this Policy periodically.

19.Privacy Officer and how to contact us

We have designated a Privacy Officer who is accountable for our compliance with this Policy and with applicable privacy legislation. If you have a question, a request, or a complaint about how we handle personal information, please contact:

20.Sabrina Roy, Privacy Officer

Fluid Events Inc. o/a eventmate

2229 Kingston Road

Scarborough, Ontario M1N 1T8

Canada

Email: hello@eventmate.ca