Privacy Policy

Last updated: June 2026

The North Hatley Jazz Festival ("we", "us") is committed to protecting the privacy of visitors to our website and participants in our activities. This policy describes the personal information we collect, how we use it, who we share it with, and the rights you have under applicable Canadian and Quebec privacy law, including Quebec's Act respecting the protection of personal information in the private sector (Law 25).

Information We Collect

We collect the following categories of personal information when you use our website or participate in our activities:

• Identity and contact data — name, email address, phone number, and (when relevant) mailing address. We collect this when you sign up for the newsletter, purchase tickets, register as a bidder, apply to volunteer, or contact us.
• Order and ticket data — items purchased, emails, attendee names, phone numbers you choose to add to tickets, and notes you optionally include with a donation. Please do not enter sensitive personal information (such as health or financial details) in free-text notes.
• Billing address (collected by Stripe, not by us) — when applicable sales tax is collected at checkout, our payment processor (Stripe) requires a billing address in order to determine the correct tax jurisdiction. The billing address is entered on Stripe's hosted checkout page and held by Stripe. We do not receive or store the billing address; we only receive the resulting tax amount that Stripe computes.
• Payment information — credit card numbers and CVV codes are entered on Stripe's hosted checkout page and never reach our servers or our database. We receive only a transaction reference, the last four digits of the card, the card brand, and the amount.
• Auction card-on-file — if you place a bid in an auction, you authorize a card to be stored by Stripe (not by us) so that we can charge the final hammer price if you win. We store only Stripe's customer identifier, never the card itself.
• Bidding activity — when you place a bid, we record the bid amount, the time, and the IP address from which the bid was placed, as a fraud-prevention and audit measure.
• Browsing and device data — pages visited, approximate visit duration, browser type, and similar technical information, collected via cookies (see below) and standard server logs.
• Email engagement data — when you receive our newsletter and have separately consented, we may record whether your mail client retrieved the message and which links were clicked (see "Newsletter Tracking" below).

We do not collect personal information directly from children under the age of 14. Where a parent or guardian provides attendee information about a minor at checkout (for example, the child's name on a family ticket), the parent's confirmation of the order at checkout serves as the parental consent required under Quebec's Law 25 for the collection of personal information concerning a minor under 14 (sections 4.1 and 14).

How We Use Your Information

We use the information we collect to:

• process ticket purchases, donations, auction registrations, and refunds;
• deliver your tickets, receipts, and order confirmations by email;
• send transactional messages (event reminders, refund decisions, auction outbid alerts, winning-bid notifications);
• send newsletters and program announcements, when you have consented to receive them;
• review volunteer applications and contact applicants;
• improve our website, our programming, and the participant experience;
• detect and prevent fraud, abuse, and security incidents;
• comply with our legal and tax obligations.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects about you.

Cookies and Similar Technologies

Our website uses a small number of strictly necessary, first-party cookies to operate the shopping cart, the checkout, the "My orders" self-service page, the auction bidder session, and the administrator login used by our staff. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies. Our cookies are marked HttpOnly, Secure (in production), and SameSite=Lax or stricter. You can configure your browser to refuse cookies, but the cart, checkout, and auction features will not function without them.

Our payment processor (Stripe) and our anti-bot provider (Cloudflare Turnstile) may set their own cookies on their own domains when their components are loaded; those cookies are governed by their respective privacy policies.

Newsletter Tracking

When we send you newsletter emails, our email service provider (Resend) can add a small invisible image (a tracking pixel) and rewrite the links inside the email through a redirector. This lets us see, on a per-recipient basis, whether your mail client retrieved the message and which links were followed. We use this information to understand which content interests our subscribers and to improve future newsletters.

This tracking is off by default. We record engagement data only if you have given separate, specific consent for it — for example, by checking a dedicated box, distinct from the newsletter subscription itself, in your preferences. We do not bundle this consent with your newsletter sign-up: you can receive the newsletter without being tracked. You may withdraw your consent at any time by disabling tracking in your preferences or by unsubscribing.

What we record (only with your consent): for each newsletter we send you, we may store the date and time your mail client first retrieved the message, the number of retrievals, the date and time of the first and most recent link click, and the total number of clicks. This data is deleted within 30 days of your unsubscription or of your withdrawal of consent.

About accuracy: mail clients such as Apple Mail (with Privacy Protection enabled) and corporate anti-spam filters automatically retrieve images and pre-check links on your behalf, often before you have read or clicked anything. As a result, a recorded open indicates that your mail client retrieved the message, not necessarily that you read it. Click data is more reliable but can also include automated security pre-checks.

Information We Share

We do not sell, trade, or rent your personal information to third parties. We share information with the following categories of service providers, only to the extent strictly necessary to deliver our services:

• Stripe Payments Canada, Ltd. (Canadian contracting entity; payment data processed in the United States) — payment processing, including credit-card capture, fraud screening, sales-tax calculation when enabled, and (for auctions) storage of a card on file. Stripe receives your name, email address, the order amount, and the card data and (when sales tax is enabled) the billing address you enter on Stripe's hosted checkout page. Stripe performs the sales-tax calculation; we receive only the resulting tax amount.
• Resend, Inc. (United States) — email delivery for transactional messages and newsletters. Resend receives your email address, the contents of the messages we send you, and (for newsletters, when consented) engagement data (opens and clicks).
• Cloudflare, Inc. (United States) — anti-bot verification (Turnstile) and content delivery. Cloudflare may receive your IP address and standard request metadata.
• Vultr Holdings, LLC (Canada — Toronto data centre) — application hosting and primary PostgreSQL database. Your order, ticket, donation, and bidder records are stored on servers physically located in Canada and are not transferred outside the country for hosting purposes.
• Cloudflare R2 (United States) — object storage for media files uploaded by our staff. Media files generally do not contain personal information.
• Functional Software, Inc. (Sentry) (United States) — error reporting. Error reports may incidentally include user identifiers and request metadata.

Data residency. Our primary database — containing your order, ticket, bidder, donation, volunteer, and newsletter records — is hosted in Canada (Toronto). Personal information is transferred outside Quebec only to the limited US-based service providers listed above (Stripe, Resend, Cloudflare, Sentry), each of which is necessary for a specific function (payments, email, security, error reporting) and operates under contractual security and confidentiality commitments. Before permitting any transfer of personal information outside Quebec, we have assessed each recipient as required by section 17 of Law 25 and concluded that your personal information receives a level of protection comparable to that required under Quebec and Canadian law.

We may also disclose personal information if we are required to do so by law, by a court order, or to protect our rights, property, or safety, or that of our participants or the public.

Confidentiality Incidents

In the event of a confidentiality incident presenting a risk of serious injury, we will notify the Commission d'accès à l'information du Québec and the affected individuals as required by Law 25, and we maintain an internal incident register documenting the incidents we have handled and the measures taken to mitigate their effects.

How We Protect Your Information

We take reasonable physical, technical, and organizational measures to protect your personal information against loss, theft, unauthorized access, disclosure, or alteration. Notably:

• All traffic to and from our website is encrypted with HTTPS / TLS.
• Sensitive fields in our database (names, email addresses, phone numbers, attendee names, notes) are encrypted at rest using a key managed separately from the database.
• Credit-card numbers never reach our servers; Stripe is a PCI-DSS Level 1 service provider.
• Administrative access to the CMS is limited to authorized staff and protected by individual accounts, with optional multi-factor authentication.

Retention

We keep personal information only as long as necessary for the purposes for which it was collected, after which it is either deleted or anonymized. Indicative retention periods:

• Newsletter subscriber data — until you unsubscribe; engagement data is deleted within 30 days of unsubscription or withdrawal of consent.
• Order and ticket data — for the duration of our tax, accounting, and legal obligations (typically 6 years after the end of the relevant fiscal year).
• Auction bidder data — until the close of the auction and the resolution of any disputes, then for the duration of our legal obligations.
• Volunteer applications — for the duration of the recruitment cycle, plus up to one year, unless you ask us to delete them sooner.
• Audit logs — for as long as necessary to detect and investigate security incidents.

Your Rights

In accordance with Quebec's Law 25 and other applicable Canadian privacy law, you have the right to:

• access the personal information we hold about you;
• request correction or deletion of inaccurate or out-of-date information;
• withdraw your consent to any use that is based on consent, at any time;
• unsubscribe from our communications;
• request portability of personal information collected from you in a structured, commonly used technical format;
• file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

Person Responsible for the Protection of Personal Information

As required by section 3.1 of Law 25, the person responsible for the protection of personal information at the North Hatley Jazz Festival is Eric St-Pierre, IT Director, who can be reached at privacy@northhatleyjazz.ca.

Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top of this page indicates when the most recent changes were made. We encourage you to review this policy periodically.

Contact Us

For any question about this policy or to exercise your rights, please contact us at privacy@northhatleyjazz.ca.