Privacy notice

What we collect

What you type into the form

Each event asks for slightly different things, so the form in front of you is the complete list. For our current events that is your first and last name, your email address, your phone number, which cities you would travel to, and how many tickets you are interested in.

We store your answers together with the question exactly as it was worded when you answered it. That way, if a form changes later, we can still tell what you were actually asked, and we can tell the difference between a question you left blank and one you were never shown.

Your consent choices

When you tick a consent box, we record the exact wording you were shown, which version of that wording it was, whether you agreed, and when. Canada's anti-spam law puts the burden of proving consent on the sender, and this record is that proof. If you later withdraw consent, we add a withdrawal record rather than erasing the original, so the history stays intact, which is the point of keeping it.

What happened to the emails we sent you

Our email provider reports back whether a message was accepted, delivered, bounced, or reported as spam, and, where it reports it, whether the message was opened or a link inside it was clicked. We use this to tell whether the booking link actually reached you, and to stop emailing addresses that bounce.

How many people visited the page

We count visits to each event page so we know how many people who looked went on to pre-register. To count you once rather than five times, we turn your IP address and browser into a scrambled code. Your IP address and browser details are never stored. Only the code is. That code is mixed with a secret we hold and with today's date, so it changes every day and cannot be used to follow you from one day to the next, to recognise you on another event's page, or to work backwards to who you are. If you arrived through a share link, we record which link it was, so we can tell which ones people actually used.

Google Analytics

We also use Google Analytics, which tells us which pages people look at, how they reached us, roughly where in the world they are, and what kind of device and browser they used. It is how we learn whether a campaign or a shared link actually brought anyone, which the counting described above cannot tell us on its own. Google works this out partly from your IP address; Google shortens that address before storing it, and we never see it. We have turned off Google's advertising features, so nothing collected here is used to personalise ads to you or to follow you across devices. Google Analytics sets cookies, described under Cookies below, and the information goes to Google in the United States.

Keeping the form from being abused

To stop automated submissions flooding the form, we count recent submissions from each source using the same kind of scrambled, non-reversible code, and we use Cloudflare's anti-bot check. Again, the IP address itself is not stored.

What we don't collect

No advertising trackers. We do not use your information to target ads, do not build an advertising profile of you, and do not buy information about you from anyone. We never ask for payment details, date of birth, or government identification, because pre-registering doesn't require any of them. We do use Google Analytics, which is described above and under Cookies.

Why we collect it

• To email you about the event you pre-registered for: a confirmation, and then the booking link when tickets are released.
• To decide where and when to run events: how many people are interested, and in which cities. This is the main reason pre-registration exists.
• To email you about future events: only if you ticked that box, and only until you tell us to stop.
• To prove we had your consent: as anti-spam law requires.
• To keep the form working: spotting abuse, and checking our email is arriving.

We do not use your information for anything else. If that ever changes, we will ask you first, because a new purpose needs new consent. We do not sell or rent it, and we do not share it with advertisers or data brokers. We use a small number of service providers to run the site and send our email, and they handle your information only to do the job we hired them for. We may also disclose information if the law requires it, for example a court order.

What pre-registering does and doesn't do

Pre-registering is a free expression of interest. It does not hold a ticket, reserve a seat, or place you in a queue, and no money changes hands. What it does is put you on the list that receives the booking link by email before tickets go on general sale. Everyone on that list receives it at the same time.

Where your information is stored

The database holding your registration, your answers and your consent records is located in Canada. We chose a Canadian region deliberately and it cannot be moved without rebuilding it.

You should know, though, that the website itself runs on servers in the United States, and our email provider and Google Analytics operate there too. That means your information passes through and is processed in the United States even though it is stored in Canada, and while it is there it may be accessible to United States authorities under the laws that apply to it. Canadian privacy law allows this provided we tell you, and provided we hold those providers to comparable protection, which our agreements with them do.

How long we keep it

We keep your registration and answers for 24 months after the event you pre-registered for, so that we can tell returning attendees apart from new ones when planning the next run. After that they are deleted.

Consent and withdrawal records are kept for three years after the consent ends, because anti-spam law requires us to be able to prove consent for that long. This is the one thing that outlives a deletion request: if you ask us to delete you, we remove your registration and answers and keep only the record that you once consented and then asked to be removed.

Visit counts and abuse-prevention records hold no information that identifies you and are kept only as long as they are useful for measurement.

Your choices and your rights

Stopping emails about future events

Every email we send carries an unsubscribe link. One click stops emails about future events. You do not need to sign in or explain yourself, and it takes effect immediately. You will still receive email about an event you have already pre-registered for, including the booking link, because that is what you asked us for.

Seeing, correcting or deleting what we hold

Under Canadian privacy law you can ask us what we hold about you, ask us to correct it if it is wrong, and ask us to delete it. Email privacy@kilikood.ca from the address you pre-registered with, or tell us which address you used. We will respond within 30 days.

Deleting your registration means you come off the list for the event, so you will not receive the booking link. We will say so before acting on the request.

Cookies

Google Analytics sets cookies in your browser so it can tell a returning visit from a new one. They hold a randomly generated identifier, not your name or email address, and they are the only cookies we set for you as a visitor.

You can refuse or delete them at any time in your browser settings, or install Google's Analytics opt-out add-on, which stops the measurement on every site that uses it. Nothing about pre-registering depends on them: the form, the confirmation email and your booking link all work exactly the same with the cookies blocked.

The site also sets a sign-in session cookie for Kilikood staff using the administration area, which you will never encounter, and Cloudflare's anti-bot check may set its own in order to work. That one is Cloudflare's, and is covered by their privacy policy.

How we protect it

The site is served only over an encrypted connection, and your information is encrypted in transit and at rest. Access to registration data is limited to Kilikood staff who need it, is enforced by the database itself rather than only by the application, requires a password with lockout after repeated failed attempts, and is logged. No system is perfect, but if a breach ever created a real risk of harm to you, we would notify you and the Privacy Commissioner, as the law requires.

Children

This site is meant for adults booking tickets. We do not knowingly collect information from children under 13. If you believe a child has pre-registered, tell us and we will remove it.

Changes to this notice

If we change this notice we will update the date at the top. If a change affects what we do with information we already hold about you, we will email you rather than rely on you noticing.

Contact us

Questions, requests or complaints about privacy go to the person responsible for it at Kilikood:

If we do not resolve your concern, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.