Privacy Policy

Faunaesthetic Events Ltd.

Effective date: June 23, 2026

---

1. Introduction

Faunaesthetic Events Ltd. ("Faunaesthetic," "we," "us," or "our") operates the
event website and ticketing service at https://faunaesthetic.ca (the "Site").
This Privacy Policy explains what personal information we collect when you use
the Site, why we collect it, who we share it with, and the choices and rights
you have.

In this policy, "personal information" means information about an
identifiable individual, such as your name, email address, phone number, and
the records we keep about your orders and tickets.

We are committed to protecting your privacy and handling your personal
information responsibly. We comply with the Personal Information Protection and
Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy
law, and with Canada's Anti-Spam Legislation (CASL) for the emails we send.

Our service is intended only for adults. You must be 18 years of age or older
to create an account, buy tickets, or otherwise use the Site.

If you have any questions about this policy or about how we handle your
information, please contact our Privacy Officer using the details in
Section 16.

---

2. Information we collect

We collect only the information we need to sell you tickets, get you into our
events, run our business, and meet our legal obligations. What we collect
depends on how you use the Site.

When you browse the Site

We collect basic, aggregated usage statistics (such as which pages are viewed
and where visitors came from) through our own self-hosted, cookieless
analytics. See Section 9.

We do preserve technical and security logs. These are generated automatically
when you make requests to our website and include IP address, browser user
agent, browser type, endpoint, and timestamp. We only preserve these logs to
operate the Site securely, detect abuse, and diagnose problems, and they are
not used to build a profile of you. These logs are retained only as long as
needed for these purposes.

When you create an account

• Your email address (this is your primary identifier with us)
• Your name
• An optional display name or handle (for example, a chosen alias or
  "fursona" name) that may appear on your tickets in place of, or alongside,
  your name
• Your password, which we store only as a secure cryptographic hash (we
  never store or have access to your actual password)
• A confirmation that you are 18 or older (we record only the date and time
  you confirmed this. See Section 3)
• Your marketing preference (whether you have opted in to receive
  announcements), including a record of when and how you gave or withdrew
  consent

If you choose to sign in using a Google or Microsoft account instead of a
password, we receive your email address and a unique account identifier from
that provider. See Section 8.

When you buy tickets

• The name for each ticket holder, and optionally a display name/handle
  for each ticket
• An optional email address for a ticket holder, if you choose to send a
  ticket directly to a friend. If you provide a friend's name or email, you
  confirm that you have their permission to share those details with us for this
  purpose.
• An optional phone number, if you provide one for your receipt
• Payment and order details: the amount paid, taxes, the items purchased,
  and identifiers that link your order to our payment processor. We never see
  or store your full card number, security code, or card expiry (see
  Section 6)
• An invoice or receipt generated for your order

When you receive a ticket from a friend

If someone buys a ticket and assigns it to your email address, we hold the name
and email associated with that ticket so we can deliver it to you. If you later
create an account with that email, the ticket is linked to your account.

When you apply to be a vendor

If you apply for a vendor or table-rental spot at an event, we collect your
business name, contact name, email, phone number, a description of what you
sell, and your website or social media link. Optionally, you may provide a
HST number or CRA Business Number, and insurance details (including an
insurance certificate, provider, policy number, and expiry) if you choose to
supply them.

When you perform at an event (DJs and performers)

If you are booked as a performer, we collect the legal name you want on your
contract, your payment method and (for e-transfer) the email to send
payment to, and optionally a HST number and/or CRA Business Number for
tax purposes. You will also sign a contract through our self-hosted signing
service (see Section 8).

When you attend an event

When your ticket is scanned at the door, we record that the ticket was admitted,
the date and time of admission, and which staff member scanned it. This is how
we prevent the same ticket from being used twice.

Communications and support

If you email us, request a password reset, request a refund, or otherwise
contact us, we keep a record of that correspondence so we can respond and keep
our records accurate.

---

3. What we deliberately do NOT collect

We have designed our service to collect as little sensitive information as
possible. In particular:

• We do not collect or store your date of birth. To confirm you are an
  adult, we record only the moment you confirmed you are 18 or older (not your
  actual birth date).
• We do not collect or store Social Insurance Numbers (SINs). Where a SIN is
  legally required for tax filing, it is handled separately and on paper at
  filing time, never entered into or stored by the Site.
• We never receive or store your full payment-card details. Your card
  number, security code (CVC), and expiry date are entered directly with our
  payment processor, Stripe, and are never transmitted to or held by us.

---

4. Why we collect your information

We collect and use your personal information for the following purposes:

• To create and manage your account and let you sign in securely
• To process your ticket orders, deliver your tickets, and send you receipts
  and order confirmations
• To verify your ticket at the door and admit you to events
• To manage vendor and performer arrangements, including contracts and
  payments
• To provide customer support and respond to your requests, including
  refunds
• To meet our legal, tax, and accounting obligations (for example, keeping
  invoices and receipts as required by the Canada Revenue Agency)
• To protect the Site and our customers against fraud, abuse, and
  unauthorized access
• With your consent, to send you announcements about upcoming events

We do not use your personal information for purposes that are incompatible with
those listed above without asking you first.

---

5. Consent

By creating an account and using the Site, you consent to our collection and use
of your personal information as described in this policy.

In some cases your consent is express. For example, you must specifically
opt in to receive marketing emails (this is never on by default), and you
explicitly confirm you are 18 or older. In other cases, your consent is
implied by your use of the service. For example, when you buy a ticket, you
are clearly agreeing that we may use your details to fulfil that order.

You may withdraw your consent at any time, subject to legal and contractual
limits (for example, we must keep certain financial records even after you ask
us to stop using your data for other purposes). To withdraw consent, contact our
Privacy Officer or, for marketing emails, use the unsubscribe link in any such
email.

---

6. Payment processing

All card payments on the Site are processed by Stripe, a third-party payment
processor. When you pay for an order, your card details are collected directly by
Stripe through their secure checkout. We never receive, see, or store your card
number, security code, or expiry date.

We receive back from Stripe only what we need to confirm and reconcile your
order. For example, a payment identifier, the amount paid, and the processing
fee. Stripe processes payment data on its own infrastructure, which is located
outside Canada (primarily in the United States), and handles your payment
information in accordance with its own privacy policy, available at
https://stripe.com/privacy.

---

7. Email and marketing (CASL)

We send two kinds of email:

• Transactional emails: for example, order confirmations, your tickets,
  password resets, refund notices, and event reminders. These are necessary to
  provide the service you asked for, and we will send them to you regardless of
  your marketing preferences.
• Commercial (marketing) emails": for example, announcements about upcoming
  events. We send these only if you have expressly opted in. Marketing
  consent is never pre-checked or assumed.

Every marketing email we send includes our identity and mailing address and a
clear, one-click unsubscribe link, in line with CASL. You can unsubscribe at
any time, and we will stop sending marketing emails promptly. We keep a record
of your marketing consent (and any withdrawal of it) as required by law.

---

8. How and with whom we share information

We do not sell, rent, or trade your personal information.

We share personal information only with the service providers we rely on to
operate the Site, and only to the extent each provider needs it. The table below
lists those providers and whether they are operated by us or are external
services.

Provider	Purpose	What it receives	Where it runs
Stripe	Card payment processing	Your card details (entered directly with Stripe), your email, and order amounts	External (primarily United States)
Amazon SES	Sending our emails	The recipient address and the contents of the email	External (United States)
Google / Microsoft	Optional social sign-in (only if you choose it)	A sign-in request; we receive back your email and an account identifier	External (United States)
DocuSeal (contract signing)	Vendor and performer contracts	Contract details you enter when signing	Self-hosted on our own infrastructure
GoatCounter (analytics)	Aggregated page-view statistics	Page and referrer data — no cookies, no personal profiles	Self-hosted on our own infrastructure

We may also disclose personal information without your consent where the law
requires or permits it. For example, to comply with a court order, lawful
request, or to protect our rights, our customers, or public safety. If our
business is ever involved in a merger, acquisition, or sale of assets, personal
information may be transferred as part of that transaction, and we will require
that it continue to be protected in line with this policy.

---

9. Cookies and analytics

We use only first-party cookies that are necessary for the Site to work:

• A session cookie, which keeps you signed in. It is marked HttpOnly and
  SameSite=Lax (and Secure, served only over an encrypted connection, in our
  production environment).
• A security token cookie used to protect forms against cross-site request
  forgery.

We do not use advertising cookies, third-party tracking cookies, Google
Analytics, or tracking pixels.

For understanding how the Site is used, we run our own self-hosted analytics
(GoatCounter), which is cookieless. It counts page views and referrers
without setting tracking cookies or building a profile of you.

---

10. International data transfers

Some of the service providers listed in
Section 8 (in particular Stripe,
Amazon SES, and (if you use social sign-in) Google or Microsoft) store and
process data outside Canada, primarily in the United States. This means your
personal information may be subject to the laws of those countries, including
lawful access requests by foreign courts, law-enforcement agencies, or
regulators.

We use established, reputable providers and rely on their contractual and
technical safeguards to protect your information when it is transferred for
processing on our behalf. We remain accountable for your personal information
when it is handled by a service provider acting on our behalf, and we require
those providers to protect it to a standard comparable to our own. Information
that we hold ourselves (including our self-hosted contract-signing and analytics
services) stays on our own infrastructure.

---

11. How we protect your information

We use industry-standard technical and organizational safeguards to protect your
personal information against loss, theft, and unauthorized access, use, or
disclosure. These include:

• Encrypting all traffic between your browser and the Site using HTTPS (TLS), so
  information you submit is protected in transit
• Storing passwords only as strong cryptographic hashes (we never store
  passwords in a readable form)
• Using long, unguessable identifiers for anything reachable by a web link, such
  as ticket QR codes and document links, so they cannot be guessed or
  enumerated
• Storing sensitive documents (such as invoices, signed contracts, and vendor
  insurance certificates) privately, behind access controls, rather than as
  public files
• Limiting access to personal information to staff who need it, and removing
  sensitive tokens from our internal error logs

No method of transmission or storage is ever completely secure, and we cannot
guarantee absolute security. If a privacy breach occurs that creates a real risk
of significant harm to you, we will notify you and the appropriate authorities as
required by law.

---

12. How long we keep your information

We keep your personal information only as long as necessary for the purposes
described in this policy, or as long as we are required to keep it by law.

In practice, this means:

• Account and event information is retained while your account is active and
  while we may still need it to provide our services or respond to you.
• Financial records: e.g. invoices, receipts, and refund records are
  kept for the period required by the Canada Revenue Agency (generally six
  years).
• Marketing-consent records are kept for at least three years, consistent
  with CASL's enforcement limitation period, so we can demonstrate that we had
  your consent.

When information is no longer needed for any of these purposes, we take steps to
delete or anonymize it.

---

13. Your rights

Subject to legal limits, you have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate or out of date
• Withdraw your consent to our use of your information (including
  unsubscribing from marketing emails)
• Request deletion of your personal information, except where we are required
  to keep it (for example, financial records we must retain for tax purposes)

To exercise any of these rights, contact our Privacy Officer using the details in
Section 16. We may ask you to verify
your identity before acting on your request, and we will respond within 30
days. In the limited circumstances permitted by law, we may need to extend that
time, and we will let you know if we do. There is normally no charge to access
your own information.

---

14. Children

Our service is for adults only. We do not knowingly collect personal
information from anyone under the age of 18. You must confirm that you are 18 or
older to create an account or buy tickets. If we learn that we have collected
information from a person under 18, we will delete it.

---

15. Changes to this policy

This Privacy Policy is a living document and may change as our practices or the
law evolve. We will post any updated version on the Site with a new effective
date. If we make a material change, we will take reasonable steps to let you
know. Your continued use of the Site after an update means you accept the
revised policy.

---

16. How to contact us and how to complain

If you have questions, want to exercise your rights, or wish to make a complaint
about how we handle your personal information, please contact our Privacy
Officer:

Privacy Officer (Chief Executive Officer)
Faunaesthetic Events Ltd.
295-558 #2 Upper Gage Ave
Hamilton, ON L8V 4J6
Canada
Email: info@faunaesthetic.ca

We take privacy complaints seriously and will investigate and respond to you.

If you are not satisfied with our response, you have the right to contact the
Office of the Privacy Commissioner of Canada:

• Website: https://www.priv.gc.ca
• Toll-free: 1-800-282-1376