Privacy Policy

Effective date: July 22, 2026
Last revised: September 8, 2026

The effective date records the owner-confirmed start of the website project. Newly introduced or materially changed provisions in this revision apply only after publication, required notice and any required acceptance; they do not retroactively alter existing purchases or accrued rights.

Accountable organization: Jonathan James Bailey, carrying on business as ClubPass365
Privacy contact: Privacy Officer, support@clubpass365.com
Mailing address: Toronto, Ontario, Canada

4.1 Scope and accountability

This Policy explains how ClubPass365 handles personal information in providing its website and enabled services. It applies to visitors, customers, subscribers, organizers, authorized staff and people contacting us. We are accountable for information under our control, including information transferred to service providers for processing. Organizers and some providers may independently control information for their own lawful purposes.

4.2 Information and purposes

Accounts and authentication: Names, email addresses, usernames, profile details, credentials or authentication identifiers, access roles and security records support account creation, sign-in, approval and recovery. Passwords must be protected using appropriate password hashing rather than readable storage.

Social sign-in: If enabled and chosen, Google or Facebook may provide a provider identifier and approved profile information such as name, email and profile image. Requested permissions are shown during authorization. We do not receive the provider account password through that flow. Changing or revoking the provider connection may affect sign-in. Linking must not expose another account merely because an unverified email matches.

Orders and tickets: Buyer and attendee details, billing information, event selections, quantities, ticket tier, optional extras, discounts, order status, tax and fee records, ticket identifiers and support history facilitate purchases, ticket delivery, access, refunds and dispute resolution.

Payment and payout information: Payment providers process payment instructions and may collect identity, bank and business verification information for organizer payouts. ClubPass365 may receive transaction identifiers, payment status, limited payment descriptors and verification results. The provider and data route must be identified at payment or onboarding. Do not send complete card details or identity documents by ordinary support email.

Attendance and scanner records: Ticket identifiers, validation results, check-in timestamps and authorized staff identifiers may be processed to validate entry, prevent reuse and reconcile attendance. Camera permission is used for scanning where the scanner is enabled. Camera frames are not intended as event surveillance; any recording or upload beyond ticket validation requires specific disclosure and a lawful basis.

Discovery preferences: Wishlists, organizer follows, recently viewed events, searches, selected locations and permitted interaction history may support saved preferences and recommendations. These are not public attendee lists. Precise device location is requested only when the user chooses a relevant location feature; permission can be refused or revoked, and a manually selected location may be used where available.

Organizer content and public profiles: Event descriptions, flyers, photographs, video links, FAQs, venue details, public organizer contact information and published reviews may be visible to visitors and search engines. Do not include another person’s private information without authority. Public display of photographs still requires appropriate rights and privacy consideration.

Communications: Contact messages, support correspondence, subscription information, consent records and unsubscribe preferences help answer requests, deliver necessary notices and send authorized promotions. Security and diagnostic logs may contain IP addresses, device/browser details, timestamps and error information to maintain and protect the service.

4.3 Consent and limits

We identify purposes at or before collection and seek meaningful consent where required. Optional marketing, sensitive uses and unexpected disclosures require appropriate separate choices. We do not treat browsing, a ticket purchase, an organizer follow or acceptance of general terms as unlimited permission. You may withdraw consent, subject to lawful restrictions and reasonable notice; we will explain effects on requested services. We may handle information without consent only where law permits or requires it.

4.4 Sharing

We disclose relevant information to the Organizer of an event for fulfilment, admission, essential updates, refunds and disputes. Assigned check-in staff should receive only the information necessary for their work. Organizers must not use this access as blanket permission for unrelated marketing.

We use providers for hosting, payment processing, authentication, email delivery, security, support, and optional maps, media or measurement features. Access must be limited to the relevant purpose and protected by appropriate contractual and technical measures. Some providers also have independent legal obligations and purposes explained in their notices.

We may disclose information where lawfully required, to address fraud or threats as legally permitted, or in a business transaction subject to applicable confidentiality, use and notification requirements. We do not authorize the sale of attendee lists through organizer tools. Any material new disclosure practice requires updated notice and consent where applicable.

4.5 Communications and subscriptions

Purchase confirmations, QR tickets, event changes, refunds, security alerts and requested support responses are service communications. Promotional messages are governed separately. An automatic subscriber welcome message that advertises an offer is promotional and must meet applicable consent, identification and unsubscribe requirements.

You may unsubscribe from promotional messages using the mechanism supplied or by contacting support@clubpass365.com. Requests are processed without delay and within the applicable legal deadline. Unsubscribing does not cancel an order or prevent necessary non-promotional service communications. We retain limited suppression information as needed to respect your choice. Browser popup suppression is separate from email-list membership.

4.6 International processing

Service providers may process or store information outside Canada, including in the United States where applicable. Information may be subject to lawful access by authorities in those jurisdictions. We remain responsible for appropriate safeguards for processing under our control. Contact the Privacy Officer for information about relevant providers and processing locations. We do not promise Canadian-only residency unless separately confirmed.

4.7 Safeguards and incidents

We apply safeguards appropriate to sensitivity, including access limitations, protected connections, secure credential handling and administrative controls. Organizers must protect exported records and staff devices. No system is risk-free. Where a breach triggers applicable notification or reporting requirements, we will notify affected individuals and authorities as required and maintain required incident records. This policy does not substitute for an incident-response procedure.

4.8 Retention and deletion

We retain information only while reasonably necessary for disclosed purposes, legal requirements, accounting, fraud prevention and disputes. Account closure does not immediately remove transaction records, lawful holds, consent evidence, suppression records or backups. Access to retained information remains restricted, and backups expire through the applicable rotation. Information no longer needed is securely deleted or appropriately de-identified.

Applicable retention categories and periods must be documented by ClubPass365. You may request details from the Privacy Officer. We do not claim that every record must be retained for the same period or that deletion from every backup is immediate.

4.9 Access, correction and complaints

You may request access to information under our control, information about its uses and disclosures, correction of inaccuracies, withdrawal of consent, or account closure by contacting the Privacy Officer. We may take proportionate steps to verify authority. Applicable exceptions, lawful extensions and restrictions may apply; we will explain a refusal or limitation where required. Where PIPEDA applies, access requests are generally answered within 30 days, subject to permitted extensions.

You may challenge our handling practices and complain to the Office of the Privacy Commissioner of Canada or another competent authority. You do not need to complete an internal process before exercising a statutory right. Requests concerning an Organizer’s independent records may also need to be directed to that Organizer.

4.10 Minors, accessibility and changes

The Platform is not intended to solicit independent accounts or marketing subscriptions from children under 13. A guardian purchasing admission for a child should provide only necessary attendee information. An all-ages event does not authorize unnecessary collection from minors. If we learn that information was collected without necessary authority, we will take appropriate corrective action.

Contact us to request an accessible policy format or help exercising a privacy choice. Material changes will be explained and any required new consent obtained before the new use begins.