Privacy Policy

1001255318 Ontario Inc. (doing business as ClubHive) (the “Company”, “we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you visit our websites, use our products and services, or otherwise interact with us.

1.1. Controller Identity

1.2. Scope

This Privacy Policy applies to personal information we collect when you:

• Visit our websites, including https://www.clubhive.ca/ and any subdomains that link to this Policy;
• Use our cloud-based software products, APIs, and related services;
• Attend our events, webinars, or respond to our marketing communications;
• Communicate with us via email, chat, phone, or social media; or
• Apply for employment (subject to our separate Candidate Privacy Notice)

(collectively, the “Services”).

This Policy does not apply to personal information we process on behalf of our customers as a data processor or service provider. When we process data on behalf of our customers, the customer’s privacy policy governs, and our obligations are set forth in our Data Processing Agreement.

Processor/service provider role: When you interact with our Services through your employer or another organization, that organization is the controller (or “business” under the CCPA). We process personal data on their behalf pursuant to written agreements. Please refer to that organization’s privacy policy for details on how your data is handled.

2.1. Information you provide directly

You may provide us with the following information directly through your interactions with our Services:

• Account registration data: name, email address, password, job title, company name;
• Payment and billing information: if we offer paid features, billing details and a valid payment method, processed by a third-party payment processor;
• Communications: content of emails, support tickets, chat messages, and feedback forms;
• Survey and research responses: when you voluntarily participate in surveys, beta programs, or user research;
• Event registration: name, email, dietary requirements, and accessibility needs when you register for events; or
• Any other information that you voluntarily provide us, including but not limited to: your institution or campus, the clubs and events you save, follow, or interact with, and your notification preferences.

2.2. Information collected automatically

We may collect certain information automatically, including through the use of cookies or similar technology, through your interactions with our Services, including:

• Device and browser information: IP address, browser type and version, operating system, device identifiers, screen resolution, and preferred language;
• Usage data: pages visited, features used, clickstream data, session duration, referring URL, and search queries within the Services;
• Log data: server logs, error reports, API call metadata, and timestamps;
• Location data: approximate geographic location derived from IP address. We do not collect precise geolocation unless you separately consent;

2.3. Information from third parties

We may collect certain information that is shared to us from third parties, including:

• Single sign-on providers: if you authenticate via Google, Microsoft, or another SSO provider, we receive your name, email, and profile information as authorized by you;
• Business partners and resellers: contact and account information provided by channel partners in connection with joint sales activities;
• Public sources and data enrichment: business contact information from publicly available sources (e.g., LinkedIn, company websites) and third-party data providers, used for B2B marketing in accordance with applicable law;
• Integrations: if you connect third-party services to your account (e.g., CRM, cloud storage), we receive data you authorize those services to share.

2.4. Sensitive personal information

We generally do not collect sensitive personal information as defined under the GDPR (also known as “special category data” under Article 9), such as racial or ethnic origin, political opinions, religious beliefs, health data, biometric data for identification purposes, or sexual orientation. If you submit such information to us (for example, in the body of a support message), we will process it only as necessary to respond to your inquiry and will apply additional safeguards including access restrictions and prompt deletion.

Under the California Privacy Rights Act (CPRA), certain categories of information we collect may be classified as “sensitive personal information,” including account log-in credentials (i.e., your email address in combination with a password) and, where applicable, precise geolocation data. We use these categories only as necessary to provide and secure the Services. You have the right to limit the use of your sensitive personal information to purposes authorized by CPRA Section 1798.121. To exercise this right, please see Section 8.2 below.

We process your personal information only for the purposes described below. For individuals in the European Economic Area (EEA), United Kingdom (UK), and Switzerland, we identify the legal basis for each purpose under the GDPR.

Legitimate Interest Assessments: Where we rely on legitimate interest as a legal basis for processing (as indicated in the table above), we have conducted a balancing test weighing our interests against your rights and freedoms as a data subject. We have determined that our interests do not override your rights in each case.

3.1. Whether providing your data is required

In most cases, providing your personal information is voluntary. However, some information is necessary to enter into or perform a contract with us (for example, your name and email to create an account, or billing information to process a payment). If you do not provide such information, we may be unable to provide the relevant Services to you. Where we are required by law to collect certain information (for example, tax identification for invoicing), we will inform you at the point of collection.

3.2. Data minimization

We adhere to the principle of data minimization. We collect and process only the personal information that is adequate, relevant, and limited to what is necessary for the purposes stated in this Policy. We regularly review the data we hold to ensure it remains necessary for the stated purposes.

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising, as those terms are defined under the CCPA. We share personal information only in the following circumstances:

4.1. Service providers

We engage third-party companies and individuals to perform services on our behalf (e.g., hosting, payment processing, analytics, email delivery, customer support).

Below is a current list of our sub-processors:

4.2. Affiliates

We may share personal information with our corporate affiliates for the purposes described in this Policy. All affiliates are bound by this Policy or equivalent data protection standards.

4.3. Business transfers

In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, personal information may be transferred to the acquiring entity. When necessary, we will notify you via email and/or prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

4.4. Legal requirements and protection of rights

We may disclose personal information if required to do so by law or if we believe in good faith that such action is necessary to: (a) comply with a legal obligation, subpoena, court order, or governmental request; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the Services; (d) protect the personal safety of users or the public; or (e) protect against legal liability.

4.5. With your consent

We may share personal information for other purposes with your express consent.

1001255318 Ontario Inc. (doing business as ClubHive) is headquartered in Canada. Your personal information may be transferred to and processed in countries other than your country of residence, including the United States, which may have data protection laws that differ from those in your jurisdiction.

We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected. Retention periods are determined based on the following criteria:

• the duration of our contractual relationship with you;
• applicable legal and regulatory retention obligations (including tax, financial reporting, and employment record-keeping requirements);
• applicable statutes of limitation for potential legal claims;
• the operational necessity of the data for security, fraud prevention, and service continuity; and
• whether the purpose for which the data was collected has been fulfilled or the data subject has requested deletion.

When personal information is no longer required under any applicable criterion, we will securely delete or irreversibly anonymize it. Anonymized data may be retained indefinitely for analytics purposes.

Rights under Canadian privacy law (PIPEDA)

If you are located in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and any applicable provincial privacy laws govern our handling of your personal information. We collect, use, and disclose your personal information only for purposes that a reasonable person would consider appropriate in the circumstances and, where required, with your consent, which you may withdraw at any time subject to legal or contractual restrictions and reasonable notice. You have the right to access the personal information we hold about you and to request correction of inaccuracies. To exercise these rights or raise a concern, contact us using the details in the “Contact us” section. If we are unable to resolve your concern, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

7.1. Rights under the GDPR (EEA, UK, and Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR with respect to your personal data:

• Right of access (Art. 15): You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about the processing.
• Right to rectification (Art. 16): You have the right to correct inaccurate personal data and to have incomplete data completed.
• Right to erasure (Art. 17): You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing (Art. 18): You have the right to request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
• Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
• Right to object (Art. 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right not to be subject to automated decision-making (Art. 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision is necessary for a contract, authorized by law, or based on your explicit consent.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. For EU/EEA residents, our lead supervisory authority is not applicable, as the Company has no establishment in the EU/EEA. A list of EEA supervisory authorities is available at edpb.europa.eu. For UK residents, complaints may be directed to the UK Information Commissioner’s Office (ico.org.uk). For California residents, complaints regarding our privacy practices may be directed to the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General. For Canadian residents, complaints may be directed to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

7.2. How to exercise your rights

To exercise any of the rights described in this Section 7, please submit a request to:

Email: info@clubhive.ca

We will respond to your request within forty-five (45) days (or one (1) month under the GDPR). If we need to extend this period, we will notify you of the extension and the reasons for the delay. We will verify your identity before processing your request. Requests are free of charge unless manifestly unfounded or excessive.

This section provides additional disclosures required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), for residents of California. This section should be read in conjunction with our California Notice at Collection, which is incorporated into this Policy by reference.

8.1. Your CCPA rights

As a California resident, you have the following rights:

• Right to know and access (§ 1798.100, 1798.110): You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of collection, the business or commercial purposes, and the categories of third parties with whom we share it.
• Right to delete (§ 1798.105): You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to correct (§ 1798.106): You have the right to request that we correct inaccurate personal information we maintain about you.
• Right to opt-out of sale or sharing (§ 1798.120): You have the right to direct us not to sell or share (as those terms are defined under the CCPA) your personal information. We do not sell personal information.
• Right to limit use of sensitive personal information (§ 1798.121): If we collect sensitive personal information for purposes beyond those authorized by the CCPA, you have the right to limit such use. We do not use sensitive personal information for purposes that would trigger this right.
• Right to data portability (§ 1798.100(d)): You have the right to request that we transmit your personal information to another business in a structured, commonly used, machine-readable format, to the extent technically feasible. This right applies to personal information you provided to us and that we maintain in a digital format.
• Right to non-discrimination (§ 1798.125): We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge you different prices, or provide a different level or quality of service because you exercised a privacy right.

8.2. How to exercise your rights

To exercise any of the rights described in this Section 8, please submit a request to:

Email: info@clubhive.ca

We will verify your identity by matching information you provide with information we have on file. You may designate an authorized agent to make a request on your behalf by providing written authorization or a power of attorney. We may require verification of both the agent’s authority and your identity.

8.3. Global Privacy Control

We honor Global Privacy Control (“GPC”) signals. If your browser or device transmits a GPC signal, we will treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device, as required by § 1798.135(b)(1). GPC signals apply to the specific browser and device from which they are sent. For more information about GPC, visit globalprivacycontrol.org.

We do not respond to Do Not Track (“DNT”) browser signals, as there is no industry-standard technology for recognizing or honoring DNT signals at this time.

8.4. Financial incentive programs

We do not offer financial incentives or price or service differences in exchange for the retention or sale of personal information.

8.5. CCPA metrics

In accordance with CCPA regulations, we will publish annual metrics on the number of requests to know, delete, correct, and opt-out received, complied with (in whole or in part), and denied, along with median response times. These metrics are available in our California Notice at Collection.

We may use cookies, pixels, local storage, and similar technologies to operate and personalize the Services, analyze usage, and deliver targeted advertising. In jurisdictions requiring prior consent for non-essential cookies (e.g., the EEA under the ePrivacy Directive), we will obtain your consent before placing such cookies.

We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. If you would like to learn more, please contact us at Email: info@clubhive.ca

No method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by GDPR Article 33.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals without undue delay, as required by GDPR Article 34, unless one of the exceptions in Article 34(3) applies.

For California residents, we will notify you of a breach of security involving your personal information as required by California Civil Code § 1798.29 and § 1798.82.

The Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to delete that information promptly.

In compliance with the Children’s Online Privacy Protection Act (“COPPA”), 15 U.S.C. §§ 6501-6506, and 16 C.F.R. Part 312, we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us at info@clubhive.ca so we can promptly delete it.

We do not knowingly sell or share (as those terms are defined under the CCPA) the personal information of consumers under the age of 16. If we become aware that a user is under 16, we will not sell or share their personal information unless we have received affirmative authorization from the consumer (if aged 13–15) or verifiable parental consent (if under 13), as required by CCPA Section 1798.120(c).

To exercise your rights under any applicable state privacy law, please use the contact methods described in this Policy. If we deny your request, you may appeal our decision by contacting us at info@clubhive.ca with the subject line “Privacy Rights Appeal.”

Appeal Rights: If we deny your privacy rights request, you have the right to appeal our decision. To appeal, contact us at info@clubhive.ca with the subject line “Privacy Rights Appeal.” We will respond to your appeal within the timeframe required by applicable law (typically 60 to 90 days). If your appeal is denied, you may contact your state’s attorney general to submit a complaint. Contact information for state attorneys general is available at naag.org/find-my-ag.

Universal Opt-Out Mechanisms: We honor Global Privacy Control (GPC) signals as valid opt-out requests under all applicable state privacy laws that recognize universal opt-out mechanisms, including Colorado, Connecticut, Montana, Delaware, Oregon, New Hampshire, New Jersey, and Texas. If your browser or device transmits a GPC signal, we will treat it as a request to opt out of the sale, sharing, or targeted advertising uses of your personal data for that browser or device.

Profiling and Automated Decision-Making: Under applicable state laws (including Virginia, Colorado, Connecticut, and others), you may have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. To exercise this right, please use the contact methods described herein or enable a GPC signal on your browser.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this Policy;
• Provide notice via email to account holders and/or a prominent notice on our website at least 30 days before the changes take effect;
• Where required by applicable law, obtain your consent before applying material changes to previously collected data.

We encourage you to review this Privacy Policy periodically.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: