Your data, in plain words.

What we collect, and why

For a booking or an enquiry: your name, email, phone and the address the session happens at. We need these to run the session and to invoice you.

For a child taking part: first and last name, date of birth, and anything you tell us about allergies or medical needs. Date of birth decides which group a child belongs in; medical notes go to the coach on the day and nowhere else.

For a waiver: the signer’s name, the time it was signed and the IP address it came from. That combination is what makes the waiver evidence, and it is why we cannot delete it — see “What we cannot delete” below.

Marketing email — CASL

Canada’s Anti-Spam Legislation governs commercial email to Canadian addresses. We only send marketing email where we have consent, and we record which kind we hold and when we got it.

Express consent is when you have ticked a box or told us to add you. Implied consent arises from an existing business relationship and expires — two years after a booking, or six months after an enquiry that did not become one. When it expires, we stop.

Every marketing email carries a one-click unsubscribe and our identity and contact details. Unsubscribing is honoured immediately and permanently; the suppression is enforced in our database rather than by a person remembering.

Transactional messages — an invoice, a booking confirmation, a waiver link, a password reset — are not marketing and are not covered by an unsubscribe. You will keep receiving those while you have a live booking with us.

Your rights — GDPR and Canadian privacy law

You can ask us what we hold about you and we will provide it in a portable form. You can ask us to correct anything wrong. You can ask us to delete what we hold, subject to the exceptions below. You can withdraw consent to marketing at any time.

If you are in the EU or UK, the GDPR gives you those rights explicitly, plus the right to object to processing and to complain to your supervisory authority. We apply the same standard to everyone rather than running two systems.

We do not sell personal data, we do not use it to build advertising profiles, and we do not make automated decisions about you.

To exercise any of this, email us. We will respond within 30 days.

What we cannot delete

Signed waivers, and the invoices and payment records behind a completed booking, are kept even if you ask us to delete everything else. Waivers are the evidence that a guardian consented to a child taking part, and we and our insurer may need them for as long as a claim could be brought. Financial records are kept because tax law requires it.

This is a genuine limit on the deletion right, and we would rather state it plainly than promise erasure we cannot perform. Everything else — contact details, marketing history, enquiry notes — we can and will delete on request.

Cameras on the bus, and marketing photos

Our buses may carry interior cameras that record during sessions. Those recordings exist for safety, supervision and documenting any incident; they are kept for a limited period, seen only when something needs reviewing, and are never published or used for marketing.

Marketing photos and video are separate and work on consent: we only publish images in which your child is identifiable if you ticked the optional consent box when signing the waiver. Saying no changes nothing about the session. You can withdraw consent at any time by emailing us, and we will remove the content from the channels we control.

Measuring how the site is used

We count page views on this website so we can tell which pages are useful and which are not. That measurement is cookieless — it stores nothing on your device, it does not follow you to other websites, and it does not build a profile of you. This is why the site shows no cookie banner: there is no cookie to ask you about.

What is recorded is the page you looked at, the site you arrived from, and coarse technical detail such as country, browser and whether you are on a phone. It is aggregated, and we cannot work back from it to a person.

Our staff CRM is deliberately excluded from this measurement. Its web addresses contain client and invoice identifiers, and those are never sent to an analytics service.

Who else sees it

Our hosting and database provider, our payment processor, and our email provider. Each processes data on our instructions only.

Coaches see the roster and any medical note for the session they are running, and nothing else.

Some of these providers operate outside Canada, which means your data may be processed abroad under contractual safeguards.

How long we keep it

Contact and marketing records: until you unsubscribe or ask us to delete them, or until implied consent expires.

Booking, invoice and payment records: seven years, as tax law requires.

Waivers: retained while a claim remains possible.

Website analytics: we do not run third-party advertising trackers.