1. What we collect

Kind	What it is
Account	Name, business name, email, password (stored hashed, never in the clear), phone.
Vendor profile	Business address, what you sell, booth size, power requirements, off-site preparation, years trading, website and social handles, how you heard about us.
Applications	Which events you applied to, the space you asked for, the fee, status, and what you have paid.
Documents	Files you upload to meet a festival’s requirements — certificates of insurance, food handler certificates, health-unit forms, licences. These can contain personal information such as names, addresses and policy numbers.
Your own figures	If you use profit tracking: the sales and costs you enter per show. These are yours. Festivals never see them.
Payments	Handled by Stripe. We keep a customer and subscription reference, the plan you are on, amounts and payment status. We never see or store full card numbers.
Technical	IP address, approximate location from it, pages visited, and a session cookie that keeps you signed in.

2. Why we collect it

• To run your account and show you your own applications, paperwork and figures.
• To pass your application to the festivals you choose to apply to.
• To take deposits and booth fees, and to pay festivals what they are owed.
• To let a festival confirm you meet their insurance and permit requirements.
• To keep the service working, prevent misuse, and meet our tax and accounting obligations.
• To contact you about your account, an application, or a payment. We do not send marketing you did not ask for.

Our basis for handling this is your consent, given when you create an account and again each time you choose to apply to a particular festival, together with what is necessary to perform our agreement with you and to meet legal obligations.

3. Who sees your information

• The festivals you apply to. When you apply, that festival sees your profile, your application and the documents you have sent for their event. They do not see applications you made to anyone else, and they never see your sales or profit figures.
• Stripe, our payment processor, for card payments, subscriptions and payouts.
• Our hosting provider, which stores the data on servers in Canada.
• Authorities, if we are legally required to, or to protect someone’s safety.
• If the business is ever sold or reorganised, information may transfer with it; the buyer is bound by this policy or something equivalent.

We do not sell your personal information, and we do not share it with advertisers.

4. Your documents, specifically

Documents are treated more carefully than the rest of your profile, because they carry the most sensitive information.

• They are stored outside the public part of the site and are never served at a guessable address.
• A document can only be opened by you, by the festival running the event you sent it for, and by our administrators.
• Sending a document to a second festival is something you do deliberately — nothing is shared between festivals on its own.
• You can ask us to delete a document. If a festival has already relied on it to accept you, they may keep their own copy or record under their own policy.

5. How long we keep it

• Account and profile information: while your account is open, and up to 24 months afterwards in case you come back for the next season.
• Applications, payments and commission records: 7 years, which is what Canadian tax and accounting rules expect of business records.
• Documents: until you delete them, the season they were for has passed by 24 months, or you close your account — whichever comes first.
• Technical logs: about 12 months.

6. Your rights

Under Canadian privacy law (PIPEDA) and equivalent provincial law, you can:

• Ask for a copy of what we hold about you.
• Ask us to correct anything wrong — most of it you can edit yourself in Settings.
• Withdraw your consent and ask us to delete your account, subject to records we must keep.
• Ask how a decision was made, or complain about how we have handled your information.

Email info@brandactivation.ca and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

7. Security and cookies

Traffic is encrypted in transit. Passwords are stored hashed. Documents sit outside the public file path and every request for one is checked against who is asking. Access is limited to what each role needs. No system is perfectly secure, and we will tell affected users promptly if a breach puts their information at real risk.

We use a single session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

8. Contact

Questions, requests or complaints about privacy go to info@brandactivation.ca, addressed to the Privacy Officer at Fletcher Hillier, London, Ontario, Canada.

The organisation responsible for your information under PIPEDA is Fletcher Hillier, a sole proprietor operating as brandactivation.ca.

These pages describe how brandactivation.ca actually runs, and they are written to be read rather than to be impressive. They are not legal advice. If you are relying on them for anything that matters, have a lawyer in your province read them first.