Version 1.0 · Effective [EFFECTIVE DATE] · Draft for review by a licensed lawyer
Privacy Policy
Which Ticket is operated by Mundi Equity Group Ltd., a company based in Alberta, at 1100-225 6 Ave SW, Calgary, Alberta T2P 1N2, Canada ("we", "us"). This policy explains what personal information we collect, why, who we share it with, where it is stored, how long we keep it, and how you can see, correct, move or delete it.
We follow British Columbia's Personal Information Protection Act, Canada's Personal Information Protection and Electronic Documents Act, and, for people in Québec, Québec's Act respecting the protection of personal information in the private sector.
The short version
- We collect your email address, your plan, your region, a record of what you agreed to, and limited billing information from Stripe.
- Stripe takes your card details directly. We never see or store your full card number.
- Some of our service providers store information in the United States.
- We do not sell your information, and we do not use advertising or analytics cookies today.
- You can unsubscribe, get a copy of your information, correct it or delete it at any time by writing to our Privacy Officer.
Who is responsible
Our Privacy Officer is responsible for how we protect personal information. For people in Québec, this is the person in charge of the protection of personal information.
Privacy Officer
Mundi Equity Group Ltd., 1100-225 6 Ave SW, Calgary, Alberta T2P 1N2, Canada
Email: support@whichticket.ca
What we collect and why
| Information | Where it comes from | Why we use it |
|---|---|---|
| Email address | You, at signup | To deliver the weekly ranking email and alerts you pay for, send receipts and account notices, and reply to you |
| Plan (monthly or yearly), membership status and dates | You and Stripe | To provide the right membership and bill correctly |
| Region (for example British Columbia or Western Canada) | You, at signup | To send rankings for the games sold where you live |
| Consent record: the exact wording you agreed to, its version, the page you signed up on, and the date and time | Created when you sign up or change your email choices | Canada's anti-spam law requires us to be able to prove what you agreed to |
| A coded version of your IP address, made with a secret key | Your browser, at signup | To detect abuse, such as one computer creating many fake signups. We keep this for 90 days. It is still personal information, so we protect it like the rest |
| Billing details held by Stripe: your name, billing country and postal code, card brand, the last four digits of your card, and your payment history | You, entered directly into Stripe | To take payment, issue receipts, handle refunds and meet tax rules |
| Email delivery events: whether an email was delivered, bounced, or reported as spam | Resend, our email provider | To stop sending to addresses that do not work and to protect our sender reputation |
| Messages you send us | You | To answer you |
We do not collect your lottery purchases, winnings, precise location, contacts, or information from your device.
Your browser. The site saves the region you pick in your browser's local storage so the page remembers it. That saved setting stays on your device. We receive your region only when you sign up or change it in your account. We do not use cookies for advertising or analytics. If that changes, we will ask first (see "Cookies and tracking").
Age. Which Ticket is for adults of legal lottery age in their province. We do not knowingly collect information from anyone younger, and if we learn we have, we delete it.
Consent
By becoming a member you agree that we may use your information to provide the membership, as described above. Emails that deliver what you paid for, receipts and renewal notices are part of the membership.
Separately, you can choose whether we may send you news and offers, including after your membership ends. That choice is optional, is never pre-ticked, and does not affect your membership. You can withdraw it at any time.
You may withdraw consent to any use that is not needed to provide your membership or to meet a legal obligation. If you withdraw consent to the membership emails themselves, we cannot deliver the service, and we will tell you how to cancel billing.
Who we share it with
We share personal information only with these service providers, only what each needs, and only under contracts that require them to protect it and use it only to serve us:
| Provider | What it does | Where it stores information |
|---|---|---|
| Stripe, Inc. and its affiliates | Payments, receipts, refunds | United States and other countries |
| Resend | Sends our emails | United States |
| Google LLC (Google Cloud and Firebase) | Hosts the website and our member database | Member database in Canada [CONFIRM REGION: Montréal or Toronto]; some Google services in the United States |
Stripe also uses payment information for its own purposes, such as preventing fraud and meeting anti-money-laundering rules, under its own privacy policy: https://stripe.com/privacy. Resend's policy: https://resend.com/legal/privacy-policy. Google's policy: https://policies.google.com/privacy.
We may also disclose information when the law requires it, such as a valid court order, or to protect against fraud. If we sell or reorganise the business, information may pass to the new owner, who must use it only as this policy describes.
We do not sell, rent or trade personal information. We do not share it with lottery operators or advertisers.
Information stored outside Canada and outside Québec
Information handled by Stripe and Resend, and some Google services, is stored and processed in the United States. While it is there it is subject to US law and may be accessed by US courts, law enforcement and national security authorities. Before using these providers we assessed the risks, including for information about people in Québec, and we have contracts with each provider that require them to protect it.
How long we keep it
| Information | How long |
|---|---|
| Your account (email, plan, region, status) | While you are a member, then 24 months after your membership ends, then deleted |
| Consent record | While we rely on it, plus 3 years, so we can prove what you agreed to |
| "Do not email" list (a coded version of your email) | Kept after deletion so we never email you again by mistake |
| Billing and tax records | 6 years after the end of the tax year they relate to, as Canadian tax law requires |
| Coded IP address | 90 days |
| Email delivery events | 12 months |
| Messages to us and privacy requests | 2 years after we close them |
If we use your information to make a decision about you, such as refusing a refund, we keep it for at least one year after the decision so you can ask to see it. When we no longer need information, we delete it or make it anonymous.
How we protect it
We use encryption when information travels between your browser and our servers, limit access to the people who run Which Ticket, require two-step sign-in on the accounts that hold your information, keep payment card numbers out of our systems entirely, and choose providers with established security programmes. No system is perfectly secure, so we also keep a plan for handling incidents.
If a breach of our safeguards creates a real risk of significant harm to you (for people in Québec, a risk of serious injury), we will notify you and the Office of the Privacy Commissioner of Canada and, for people in Québec, the Commission d'accès à l'information, and we will record every incident as the law requires.
Your rights
You can ask us to:
- tell you what personal information we hold about you, how we use it and who we have shared it with, and give you a copy;
- correct information that is wrong or incomplete;
- delete your information, except what the law requires us to keep (we will tell you what that is and why);
- give you the information you provided to us in a structured, commonly used computer format, such as a CSV or JSON file (this right is set out in Québec law; we offer it to everyone);
- withdraw your consent as described above.
Unsubscribing. Every email has an unsubscribe link. It takes effect immediately, and in every case within 10 business days. Unsubscribing stops emails; it does not cancel your billing. Use the Cancel link in any email or write to us to cancel.
How to ask. Email support@whichticket.ca or write to the address above. We may ask you to confirm you control the email address on file. We respond within 30 days and do not charge for reasonable requests.
Complaints. Contact our Privacy Officer first. If you are not satisfied, you can contact:
- Office of the Information and Privacy Commissioner for British Columbia: https://www.oipc.bc.ca
- Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca
- In Québec: Commission d'accès à l'information du Québec: https://www.cai.gouv.qc.ca
Cookies and tracking
Today we use no advertising or analytics cookies, pixels or tracking tools. The site uses browser local storage only to remember your region. If we add analytics or advertising measurement, we will update this policy first and they will stay off until you turn them on.
Our privacy practices
We keep written policies on how long we keep information, who in our business can access it and what they can do with it, and how we handle complaints and privacy requests. The Privacy Officer approves them. You can ask for a summary.
Changes to this policy
We will post any change here with a new version number and date. If a change affects how we use your information in a significant way, we will email members at least 30 days before it takes effect and ask for consent where the law requires it.
Contact
Mundi Equity Group Ltd., operating as Which Ticket
1100-225 6 Ave SW, Calgary, Alberta T2P 1N2, Canada
Privacy Officer: Privacy Officer, support@whichticket.ca