Privacy Policy

1. Who we are

The Forum Entertainment Inc. ("The Forum", "we", "us", "our") is a British Columbia company that produces and promotes live events, primarily for post-secondary students in the Metro Vancouver area.

This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.

We are responsible for the personal information under our control. Questions, requests and complaints go to our Privacy Officer:

Email: privacy@theforumsfu.com

2. What this policy covers

This policy applies to:

• our website at theforumuniversity.com and any subdomain of it, including theforumsfu.com
• any standalone event landing page, signup form, guestlist form, giveaway entry or waitlist we operate
• our email and SMS marketing
• our invitation and RSVP pages, including pages we run on Partiful
• our post-event surveys and feedback forms
• correspondence you send to any @theforumuniversity.com or @theforumsfu.com address

This policy does not cover:

• Ticketing platforms. Tickets are sold through third parties such as TicketWeb and Showpass. When you buy a ticket you are on their site, giving them your information under their privacy policy, and they process your payment. We never see your card details.
• Venues. Nightclubs and other venues we work with are independent businesses with their own privacy practices, security cameras, and door procedures. Section 7 explains the limited information we hand them and why.
• Social platforms. Instagram, TikTok, Discord and similar services handle your information under their own terms when you interact with us there.
• Other websites we link to.

If you follow a link away from one of our pages, read that company's policy. We do not control it.

3. Information we collect

3.1 Information you give us directly

Our signup, guestlist and giveaway forms ask for some or all of the following. Which fields appear depends on the form.

We also collect:

• Survey and feedback responses, including free-text comments, when you fill in a post-event form. These are usually collected through a third-party form tool.
• Anything you write to us, including emails, replies to our marketing, direct messages and support requests.
• Contest and giveaway entries, including whatever a specific contest's rules require.

3.2 Information collected automatically when you visit our pages

• IP address, and the approximate city or region derived from it
• Device type, operating system, browser and language
• The page you arrived from, the pages you viewed, how long you stayed, and what you clicked
• Advertising click identifiers appended to the URL when you arrive from an ad, including Meta's fbclid and TikTok's ttclid
• Campaign parameters we add to our own links, commonly called UTM parameters
• Cookie and pixel identifiers set by us and by the advertising and analytics providers listed in section 8

We also record, through our marketing platform, whether you opened an email we sent and which links you clicked. Our marketing platform rewraps every link in our emails through its own tracking domain. On our current plan this cannot be switched off.

3.3 Information we receive from others

• Advertising and analytics platforms give us aggregated and attributed reporting about how our ads performed. This is normally group-level, not individual.
• Ticketing platforms may give us order reports containing buyer names, email addresses and what they bought, depending on what that platform exports. We use these to run the event and count attendance. We do not add ticket buyers to our marketing lists unless they opted in with us.
• Venue partners may return a checked-in list after an event so we know who actually attended.
• Referrals and ambassadors may pass on the name and contact details of someone who asked to be added to a list. If that is you and you did not agree to it, tell us and we will remove you.

3.4 Photos and video at events

We hire photographers and videographers at our events, and we use the results to promote The Forum on our website, social channels and ads. You may appear in that material. We post signs at our events so you know filming is happening, and our terms say the same.

If you do not want to be filmed, tell the photographer at the event. If a photo or video of you is already posted and you want it taken down, email privacy@theforumsfu.com with enough detail to find it and we will remove it from our own channels. We cannot remove copies other people have already shared.

3.5 What we do not collect

• Payment card or bank details. All payment happens on the ticketing platform or in cash at the door. We do not receive, store or process card numbers.
• Government identification. Venue door staff check two pieces of government ID as a condition of entry. That check happens at the door, by the venue, and we do not record, scan or retain ID data.
• Sensitive categories. We do not ask for health information, ethnicity, religion, sexual orientation, political views, or any similar category, and we ask you not to volunteer them in free-text fields.

4. Why we use your information

We use personal information for these purposes and no others without asking you first.

To run the event you signed up for. Confirming your spot, sending door instructions, arrival times, address, dress code, age requirements and any change to the plan. Building the door list. Answering your questions. These messages are operational rather than promotional, so they go to everyone holding a spot whether or not you opted in to marketing. They are only about the event you signed up for.

To send marketing, only if you opted in. Announcements of upcoming events, pre-sale access, discount codes, giveaways and newsletters, by email and, separately, by SMS. Section 5 explains exactly when you get these and when you do not.

To confirm eligibility. Our events are 19 and over. Date of birth lets us check that before we put you on a list, rather than turning you away at the door.

To measure and improve. Understanding which pages, ads and channels bring people in, how many people who sign up actually attend, and what worked or did not at the event itself.

To advertise. Measuring which ads worked, and showing our ads to past attendees, to people who signed up with us, and to people similar to them. This includes uploading contact lists to advertising platforms to build audiences. This happens whether or not you opted in to marketing, because it is advertising on those platforms rather than us messaging you directly. Section 8 explains how it works and how to stop it.

To keep records and meet legal obligations. Retaining proof of consent as Canadian anti-spam law requires, keeping business and accounting records, and responding to a lawful request from a regulator, court or law enforcement.

To protect the event. Preventing fraudulent, duplicate or abusive signups, and protecting attendees, staff and the venue.

5. Consent

5.1 How we get it

We identify why we are collecting information before or at the point we collect it. The form tells you what each field is for.

Marketing consent is separate from the signup itself. On our forms:

• the marketing opt-in is a distinct checkbox, unchecked by default
• email and SMS consent are asked separately, because they are different things
• you can complete the form and get your spot without ticking either box
• we record the date and time of your consent and store it against your contact record

We do not bundle marketing consent into a condition of entry. Agreeing to hear from us is never the price of a guestlist spot.

5.2 When you get marketing, and when you do not

We only send marketing to people who opted in. Ticking the email box means you agree to marketing email. Ticking the SMS box means you agree to marketing texts. This is express consent. It does not expire and lasts until you withdraw it. If you did not tick a box, you do not get that kind of marketing from us.

Canadian anti-spam law would also let a business market to people who made an inquiry or bought a ticket, for a limited time, without asking. We do not use those exceptions. Signing up for a list or buying a ticket does not, on its own, put you on our marketing lists.

If you sign up for a guestlist and do not opt in, you only receive messages about that guestlist and that event. That means your confirmation, door instructions, reminders, and any change to the event, such as a new time or venue. You do not receive announcements about other events, presales, discount codes, giveaways or newsletters.

The same applies to a drop alert or waitlist: without an opt-in, you only hear about the event or release you signed up for.

These event messages are operational, not marketing, and stop once the event is over.

5.3 Withdrawing consent

You can withdraw marketing consent at any time, at no cost:

• click unsubscribe at the bottom of any marketing email we send
• reply STOP to any marketing SMS
• email privacy@theforumsfu.com and ask

We action unsubscribe requests promptly and in any case within 10 business days, which is the maximum Canadian anti-spam law allows.

Withdrawing marketing consent does not remove you from a guestlist you are already on, and does not stop the operational email that tells you how to get in the door. If you want off a guestlist as well, say so and we will remove you.

6. Our marketing platform

We use Brevo (operated by Sendinblue SAS, a French company) as our email and SMS marketing platform. When you give us your details through one of our forms, or when we add you to a list, that information is sent to and stored in Brevo.

What Brevo holds about you includes your first name, last name, email address, phone number if you gave one, date of birth if the form asked for it, which event and list you joined, your marketing consent status, the timestamp of that consent, and the record of which of our emails you opened and clicked.

Brevo processes this information on our instructions, under contract, to deliver our messages. Brevo hosts data in the European Union, on infrastructure in France, Germany and Belgium. Section 9 explains what storing data outside Canada means for you.

Brevo has its own privacy policy at brevo.com covering how it operates as a company.

7. Sharing with venue partners and guestlists

This section matters if you signed up for a guestlist, a discounted entry list, a free entry list or any similar option.

If you sign up for a guestlist option, we share your name and email address with the venue partner hosting that event, for the sole purpose of checking you in at the door.

Specifically:

• We share first name, last name and email address. We do not send your phone number, date of birth, marketing consent status or anything else, unless a specific venue's check-in system requires a field and we tell you so on that form.
• We share it with the venue for that one event, not with venues generally, and not with any venue whose event you did not sign up for.
• The purpose is door check-in only. It lets staff confirm you are on the list, apply the correct rate, and let you in. Your last name is on the list because the name you give the door has to match your ID.
• We ask venue partners to use the list only for check-in for that event, not to add you to their own mailing lists, and to dispose of it after the event.

Venue partners are independent businesses, not our staff. We put contractual and practical limits on what they do with a check-in list, but once information is in a third party's hands we cannot guarantee its handling. If a venue markets to you off the back of one of our guestlists, tell us. We will take it up with them, and it will affect whether we work with them again.

Venues also operate their own systems on their own premises, including cameras, ID scanners, security and their own guest data. Those are the venue's, governed by the venue's policy, and outside our control.

If you do not want your details shared with a venue, do not sign up for a guestlist option. Buy a ticket instead. A ticket does not require us to put you on a door list.

8. Everyone else we share with

We do not sell your personal information. We do not rent it, and we do not trade lists with other promoters.

Mobile numbers and SMS consent are never shared with third parties or affiliates for their own marketing or promotional purposes. The only companies that receive your number are the service providers that deliver our texts, such as Brevo, acting on our instructions.

We share it in these situations only.

Service providers who work for us. Companies that run part of our operation under contract and on our instructions, including:

Ticketing platforms. TicketWeb and Showpass sell tickets to our events. When you buy, you deal with them directly and they collect your information under their own policies, as independent controllers of it, not as our processors. They may share order data back with us as the event organiser.

Advertising platforms. Meta (Facebook and Instagram) and TikTok. See below.

Venue partners. As described in section 7.

Professional advisers. Our accountant, bookkeeper, insurer and lawyers, where they need it and under a duty of confidence.

Legal and safety. Where we are required by law, by a court order, or by a regulator, or where disclosure is necessary to investigate a serious incident, prevent fraud, or protect someone's safety.

A business transfer. If the company is sold, merged or reorganised, contact records may transfer as part of the business. We would tell you.

Advertising and pixel tracking

Our pages carry the Meta Pixel and the TikTok Pixel, loaded through Google Tag Manager. These report a small number of named events back to the advertising platform: that a page was viewed, that a form was submitted, and that a ticket link was clicked.

Where we send a signup event to Meta, we may include your email address and phone number in hashed form. Hashing turns the value into a fixed-length string that cannot practically be reversed. Meta compares that hash to hashes it already holds to work out whether the person who signed up is someone it recognises. This is called advanced matching. It is what lets us measure whether an ad worked and build audiences of similar people. Some of these events are sent from your browser and some are sent server to server from our systems.

The practical effect is that Meta and TikTok can associate your visit to our page with their own profile of you, and we can ask them to show our ads to people like you.

We also upload contact lists to Meta, in hashed form, to build audiences of past attendees and signups and to find people similar to them. Meta matches the hashes against its own users and deletes what it cannot match, under its terms for this feature. This is for ad targeting only. It is not us sending you messages, so it is not covered by your email or SMS choices. If you want out of it, email privacy@theforumsfu.com and we will remove you from our uploaded audiences.

One limit on the cookie banner. Some of the events described above are sent to Meta directly from our own systems rather than from your browser. Declining cookies stops the tags that run in your browser. It does not stop the events sent from our systems, and neither does a tracker blocker. To stop those, email privacy@theforumsfu.com.

To limit this:

• decline non-essential cookies in our consent banner, which prevents the browser tags from loading
• adjust your ad settings inside Facebook, Instagram and TikTok
• use a browser that blocks trackers, or a tracker-blocking extension
• send a Global Privacy Control signal from your browser, which we honour where our consent tool supports it

9. Where your information is stored

Some of our service providers store and process personal information outside Canada.

• Supabase, which holds our signup and guestlist records, stores data in [SUPABASE REGION - Daniel to confirm].
• Brevo stores data in the European Union, on infrastructure in France, Germany and Belgium. To deliver a text, Brevo passes your number to the mobile carrier networks and their messaging partners, which may be outside Canada and the European Union.
• Meta, TikTok, Google, Partiful and Vercel store and process data in the United States and in other countries where they operate.

While your information is in another country it is subject to that country's laws, and may be accessible to that country's courts, law enforcement and national security authorities under their legal processes. This is a normal consequence of using international service providers and Canadian privacy law requires that we tell you about it.

We use providers that offer contractual protections for transferred data, and we remain accountable for the information we hand them.

10. How long we keep it

When a retention period ends we delete the information or anonymise it so it can no longer identify you.

11. How we protect it

We take steps proportionate to the sensitivity of what we hold:

• accounts on our platforms are limited to the people who need them, with multi-factor authentication where the platform supports it
• our website is served over HTTPS and form submissions are encrypted in transit
• contact data lives in the marketing platform rather than in loose spreadsheets, and shared exports are limited and time-boxed
• guestlists sent to venues go to a named contact, not a general address, and are limited to the fields needed for check-in
• staff and contractors handling contact data are bound by confidentiality terms

No system is perfectly secure, and we cannot guarantee that a determined attacker will never succeed. If a breach occurs that creates a real risk of significant harm to you, we will notify you and report it to the appropriate privacy commissioner, which for a business operating in British Columbia may be the provincial or the federal office depending on the information involved.

12. Your rights

Under Canadian privacy law you can:

Access. Ask what personal information we hold about you, how we have used it, and who we have disclosed it to. We will respond within 30 days, or tell you why we need longer.

Correct. Ask us to fix anything inaccurate or incomplete. If your name on a guestlist is wrong, correct it before the event, because the door will not let you in on a name that does not match your ID.

Withdraw consent. Stop marketing at any time, as described in section 5.3. You can also withdraw consent to other uses, subject to legal and contractual limits, and we will tell you what the consequences are before we action it.

Delete. Ask us to remove your information. We will do so unless we are required to keep something, such as a consent record or an accounting record. We will tell you what we kept and why.

Complain. Raise a concern about how we handled your information. Write to privacy@theforumsfu.com first and we will investigate and respond in writing.

To make a request, email privacy@theforumsfu.com with enough detail to identify your records. We may need to verify who you are before we release anything, to make sure we are not handing your information to someone else. We do not charge for reasonable requests.

If you are not satisfied with our response, you can escalate:

• Office of the Privacy Commissioner of Canada, priv.gc.ca, 1-800-282-1376
• Office of the Information and Privacy Commissioner for British Columbia, oipc.bc.ca, 250-387-5629

For anti-spam complaints specifically, the Canadian Radio-television and Telecommunications Commission runs the Spam Reporting Centre at fightspam.gc.ca.

13. Age

Our events are 19 and over. Venue door staff verify age with two pieces of government identification, and a guestlist spot is not entry on its own.

Our websites and forms are not directed at children and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, email privacy@theforumsfu.com and we will delete it.

If a form tells us you are under 19, we do not add you to any list and we delete what you submitted, other than the minimum record we need to show why the signup was refused.

We ask for date of birth on some forms specifically to confirm the 19 and over requirement before we add someone to a list, and, where you have opted in to marketing, to send a birthday offer. We do not use it for any other purpose.

14. Cookies

We use cookies and similar technologies in three categories:

Strictly necessary. Making the site work, holding your session, remembering your cookie choice, and preventing abuse. These load without consent because the site cannot function without them.

Analytics. Understanding how people move through our pages so we can improve them.

Advertising. The Meta and TikTok pixels described in section 8, plus the click identifiers carried in from an ad.

Analytics and advertising cookies load only after you consent through our banner. You can change your choice at any time through the cookie settings link in our footer. You can also clear or block cookies in your browser settings, though blocking strictly necessary cookies may break parts of the site.

15. Changes to this policy

We will update this policy when our practices change. The effective date at the top always reflects the current version. If a change is significant, for example a new category of information or a materially new disclosure, we will say so on our site and, where we have your consent to contact you, by email.

Continuing to use our sites or attend our events after an update means the updated version of this policy applies to that use. We will not use information we already hold for a materially new purpose on that basis. Where a new purpose needs your consent, we will ask you for it first.

16. Contact

We aim to respond to every privacy request within 30 days.