Ticketing and Clover integration privacy policy

Responsibility and contact

Phoenix Theatre Management Society (the Society, we, us) is responsible for personal information collected through its ticketing website and private Clover integration. David Johnstone provides and maintains the app on the Society’s behalf and may access information only for authorized development, maintenance, support, and security work.

Send privacy questions, access or correction requests, deletion enquiries, and complaints to president@phoenixtheatre.ca, addressed to the President, the Society’s person responsible for privacy.

Information and purposes

We collect the name, email address, and optional phone number you provide; booking, ticket, seat, purchase, refund, exchange, and admission details; optional account interests and communication preferences; consent records; customer-service correspondence; and seat-sponsorship and plaque wording where applicable. Staff identifiers, permissions, administrative actions, and technical security information are also processed.

We use this information to manage accounts and bookings, provide tickets and admission, administer sponsorships, communicate about purchases and service changes, provide support, keep financial records, prevent misuse, and operate and secure the service. Optional marketing requires a separate choice and can be withdrawn. Essential booking and service messages are separate from marketing.

Clover and payment information

The private Clover integration processes merchant and currency information, device identifiers and names, and authorization credentials. Its currently implemented terminal functions are authorization, merchant validation, device listing, and connection testing. Terminal sale and ticket-refund code is prepared behind disabled activation controls and requires physical-device validation and applicable approval before use. When enabled, the app sends the payment amount, tax amount, and transaction reference to the selected Clover device. Optional Clover email receipts also send the supplied receipt email address when separately enabled.

Where online payment services are enabled, card entry is handled by the payment provider. The ticketing application does not store full card numbers, security codes, or PINs. It retains amounts, transaction results, and provider references needed to manage bookings and reconcile payments. Clover has its own agreements and privacy notices. This policy will be updated before materially different payment processing is enabled.

Cookies, browser storage, and tracking

Cookies support guest recognition, staff and customer sessions, sign-in security, and admission access. Customer session cookies last up to 30 days, guest cookies up to seven days, and the default staff session cookie up to eight hours. Sign-in challenge cookies are shorter-lived. Browser session storage keeps booking categories and revision references without customer contact or payment details. A demo-workspace identifier may remain in local storage until cleared.

No analytics, advertising pixels, or session-replay scripts were found in the reviewed application source. The app does not alter its functional storage in response to browser Do Not Track signals. Some event posters load from Wix’s image service, which receives the visitor’s IP address and ordinary request information. The app sends a no-referrer policy. No claim is made that an external provider performs no tracking.

Transactional email requests made by this application disable open and click tracking. UNVERIFIED: marketing campaign tracking settings have not been inspected; they must be confirmed and disclosed before campaigns are sent.

Access and service providers

Authorized Society personnel, the developer, and service providers may access information needed for their assigned tasks. Providers include Web Hosting Canada for hosting and, when enabled, Clover for payment/device services, Mailchimp Transactional for message delivery, Mailchimp Marketing for opted-in subscriptions, Google for optional customer sign-in, and Microsoft for staff sign-in. Optional sign-in uses identity information needed to authenticate you, rather than access to your contacts or unrelated account content.

We may disclose information as required or permitted by applicable law and as necessary for professional advice or a documented investigation. The Society does not authorize the developer to use customer records for independent marketing or unrelated purposes.

Storage locations and international processing

Deployment documentation identifies a MariaDB ticketing database and private uploaded-file storage on Web Hosting Canada infrastructure. WHC describes its hosting servers as located in Canada. UNVERIFIED: this account’s exact database, hosting, backup locations, and provider-managed log retention have not been independently confirmed.

Mailchimp states that its servers are in the United States and that service providers may process information elsewhere. Clover discloses possible processing in the United States and other countries. Google and Microsoft processing locations for the configured accounts are UNVERIFIED. Information processed abroad is subject to the laws of those locations.

Private release backups and staging snapshots can contain customer information. Local databases, exports, or recovery copies may also exist on authorized maintenance computers. The project is held in OneDrive, so files placed in synced folders may be copied to Microsoft’s cloud. UNVERIFIED: the presence of customer data in local/OneDrive copies and the Microsoft tenant’s storage locations require inventory. We do not promise that all information remains in Canada.

Retention, deletion, and recovery

The schedule below describes the Society’s proposed retention rules and the prepared application controls. Deployment, activation, and provider-side enforcement have not yet been verified. Exact deletion promises take effect only after the relevant controls are configured and checked.

Legal holds suspend automated deletion. Unresolved cases, payments, and refunds conservatively suspend long-term cleanup. Information used for a decision directly affecting an individual must be preserved for at least one year after use where required by British Columbia’s Personal Information Protection Act. The Society must place relevant evidence under hold before routine expiry; audits, disputes, and other legal requirements may extend periods.

Deleting an account removes access and optional profile details. Required financial records, consent evidence, and minimal unsubscribe suppression are handled separately. Remaining account identity is removed after required marketing withdrawal work is confirmed. A deletion ledger is used to reapply erasures when restoring older backups. Provider-held records and backup copies are subject to their respective controls and may not disappear immediately.

Security and your requests

The application uses access restrictions, secure website connections, and encrypted storage of Clover access tokens. Safeguards reduce risk but cannot guarantee complete security.

Contact president@phoenixtheatre.ca to request access, correction, or deletion, withdraw consent where applicable, or complain about information handling. We may verify identity and explain any limitation on a request. Withdrawing information necessary for a service may affect our ability to provide it. Contact the Society if you need assistance without using an account.

Changes

We will update the policy and revision date when practices change and provide additional notice or obtain consent where required. The publication effective date is pending Society review.

Retention schedule

Financial and supporting booking records

Six years after the end of the last relevant tax year. The Society’s confirmed fiscal year-end is December 31. Linked exchanges and later refunds extend the period.

Optional account profiles

Review after 24 months without account or booking activity. Remove after a successfully sent notice and a further 30 days without activity.

Marketing consent evidence

While relied upon, then three years after the last relevant marketing use or withdrawal, whichever is later. Expiry waits for verified marketing-use information.

Unsubscribe suppression

Keep a minimal keyed identifier while the marketing system operates to prevent accidental re-subscription. Explicit new consent can replace it.

Customer-service notes and resolved cases

Two years after resolution; unlinked service notes are reviewed against their last recorded activity. Financial evidence follows the financial period.

Individual admission and collection details

One year after the performance. Anonymous performance attendance totals remain available.

Routine application security events

Seven days, with scheduled cleanup. Incident or decision evidence may require longer retention.

Hosting access and error logs

Target: 30 days. UNVERIFIED: WHC settings and enforcement require confirmation.

Verification challenges and sessions

Verification challenges: 24 hours. Customer sessions: up to 30 days; expired sessions are removed by maintenance.

Completed routine jobs and email metadata

90 days. Unresolved delivery outcomes and financial or consent evidence are retained longer as needed. Message bodies are cleared after confirmed sending or expiry.

Clover authorization credentials

Remove on disconnection or after expiry. Credentials are invalidated during restoration with the current retention ledger.

Recovery and staging copies

Target: 35 days for registered, retired copies. Active recovery copies and copies under hold are protected. UNVERIFIED: provider-managed and existing unregistered copies require inventory.

Local exports and troubleshooting copies

Target: delete within seven days after the task ends. Automatic expiry applies to copies registered with that completion date. Other copies require manual inventory.

Seat-sponsorship plaque wording

While the plaque remains in use or is needed for replacement. Inactive records expire under the financial schedule after allocations are released.