DRAFT. This is a template written for review by a qualified lawyer in each country we sell in. It is not legal advice and it is not in force.
Privacy Policy
Version 0.2 · Effective 13 September 2026
Who we are
Santa Maria runs club nights and events, currently in Toronto, and sells tickets to them through this website.
The controller responsible for your personal data:
| Where | Controller | Contact |
|---|---|---|
| Canada (Toronto) | [CANADIAN LEGAL ENTITY] | privacy@partysantamaria.com |
Santa Maria sells tickets to events in Canada only. If that changes, this page names the new controller before a single ticket is sold there.
Registered address: [REGISTERED ADDRESS]. Data protection contact: [DATA PROTECTION CONTACT].
What we collect
- Identity and contact data — the name, email address and (optionally) phone number you give us when you buy a ticket, join the list or message us.
- Order data — what you bought, quantities, prices, currency, order reference, and the versions of the terms you agreed to.
- Payment metadata — card brand and last four digits, and the payment reference from our payment provider. We never see or store your full card number: card details go straight from your browser to Square.
- Age confirmation — that you confirmed you meet the minimum age for the event.
- Entry records — when your ticket was scanned at the door, and by which staff member.
- Marketing preferences — whether you opted in, the exact wording you agreed to, and when.
- Device and usage data — only with your consent to analytics cookies. See the Cookie Policy.
- Messages — anything you send us by email or through the contact form.
- Photos and video taken at events — see "Photography at events" below.
Why we use it, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Sell you a ticket, send it to you, let you in at the door | To perform our contract with you | Contract |
| Keep financial and tax records | We are legally required to | Legal obligation |
| Prevent fraud, ticket-bot abuse and keep the site secure | To protect buyers and the events | Legitimate interests |
| Keep people safe at events, including sharing a guest list with venue security where the venue requires it for entry | Event safety | Legitimate interests / legal obligation |
| Send you marketing email | Only if you asked us to | Consent |
| Measure how the site is used | Only if you accept analytics cookies | Consent |
Where we rely on legitimate interests, we have weighed our interest against your rights and use the least intrusive option that works. You can object at any time — see "Your rights".
Who we share it with
We use service providers who process data on our instructions:
- Square — payment processing.
- Vercel — website hosting.
- Supabase — database and file storage.
- Resend — sending ticket, receipt and list emails.
- Cloudflare (Turnstile) and Upstash — bot and abuse protection.
- Sentry — error monitoring, with personal data scrubbed before it is sent.
- A privacy-friendly analytics provider — only if you accept analytics cookies.
- Venues and their security teams — only the guest list needed to let you in safely.
We also disclose data where the law requires it, or to establish or defend legal claims.
We do not sell your personal data, and we never will.
International transfers
Our infrastructure is hosted in [HOSTING REGIONS]. That means data may be transferred outside the country you live in. Where data leaves Canada, we rely on the safeguards Canadian law provide for international transfers, including standard contractual clauses with our providers. A copy of the safeguards is available on request.
How long we keep it
| Data | Kept for |
|---|---|
| Orders, receipts and financial records | The period tax law requires — expected to be at least 6 years, to be confirmed per country |
| Tickets and door check-in records | 24 months, then anonymised |
| Marketing subscribers | Until you unsubscribe, plus a suppression record so we do not email you again by mistake |
| Contact form messages | 24 months |
| Server and security logs | 90 days or less |
| Privacy requests and our response | 3 years |
Your rights
You can ask us to:
- give you a copy of your data (access);
- correct data that is wrong;
- delete data we no longer need;
- give you your data in a portable format;
- restrict or object to how we use it;
- withdraw consent at any time — this does not affect what we did before you withdrew it.
We do not make any decision about you by automated means alone.
To exercise a right, email privacy@partysantamaria.com or use the contact form and choose "Privacy request". We will respond within 30 days. We may need to confirm your identity first, usually by asking you to reply from the email address on the order.
You can also complain to a regulator:
- Canada — Office of the Privacy Commissioner of Canada (OPC)
Security
We use HTTPS everywhere, store no card numbers, enforce multi-factor authentication for staff accounts, restrict database access with row-level security, and keep audit logs of staff actions. No system is perfectly secure, but if a breach puts your rights at risk we will tell you and the relevant regulator without undue delay.
Children
Our events are for adults and our site is not aimed at children. We do not knowingly collect data from anyone under the minimum age for the event.
Photography at events
Photos and video are usually taken at our events and may be used to promote Santa Maria. If you appear in an image and want it removed, email privacy@partysantamaria.com with enough detail to find it and we will remove it from our own channels.
Changes
If we change this policy we will update the version and effective date at the top, and — where the change matters — tell you by email or on the site.