Privacy Policy

Introduction

Future Forest Music & Arts Festival Inc. (“Future Forest,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit or buy through our websites, store.futureforest.ca and futureforest.ca (together, “the Sites”), when you hold a Future Pass membership, and when you attend the Future Forest festival.

We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s Anti-Spam Legislation (CASL), and applicable provincial privacy laws, including Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25 (“Law 25”). Personal health information we collect on site is also handled in keeping with New Brunswick’s Personal Health Information Privacy and Access Act (PHIPAA).

How we rely on your consent, and the choices you have, are described in Section 4.

1. Scope of this policy

This policy covers two connected settings:

• Our Sites: the store and main website, including purchases, accounts, the mailing list, online forms, and live chat.
• The festival: what we collect when you attend, including entry, safety and security, first aid and harm reduction, and accessibility support.

Where a practice applies to only one setting, we say so. The Sites, our membership, and the festival are intended for people aged 18 and over (see Section 12).

2. Information we collect

2.1 Information you provide

• Your name, email address, phone number, and billing and shipping address.
• Account and login details, and membership details.
• Information you enter in our online forms (for example, vendor or artist applications, and contest entries), which are hosted on Fillout.
• The content of messages you send us, including live chat. Outside staffed hours, live chat is answered by an automated assistant, described in Section 3.
• When you buy, your payment details, which are collected and processed by our payment providers (Stripe, PayPal, or Partial.ly for payment plans); we do not store full card numbers ourselves.

2.2 Information collected automatically

As you browse the Sites, we collect your device and browser type, IP address, time zone, the pages you view, and the source that referred you to us. We collect this through cookies and similar technologies (see Section 5). Your IP address is recorded by our site firewall and may also appear in the access and security logs of our hosting and content-delivery providers (see Section 6).

2.3 Address autocomplete

When you enter an address at checkout, what you type may be processed by Canada Post’s AddressComplete service to suggest valid addresses.

2.4 Membership and program information

If you hold a Future Pass membership, we maintain your membership status and a unique digital membership identifier, including a QR code, and we record your use of the program, such as discounts applied or applications submitted.

2.5 At the festival

When you attend, we collect the following.

• Entry and ticket scanning. Your ticket is scanned at the entrance to confirm a valid ticket and to manage entry. Scanning is handled by our check-in provider, Qflow.
• Age and identification check. Staff visually inspect government photo identification at entry to confirm that guests are 18 or over and eligible for age-restricted activities. We do not scan, copy, or keep your identification; it is looked at and handed back.
• Security cameras. Cameras operate at the gate, at stages, and in other areas of the site for safety and security. Footage is kept for 21 days and is then deleted, unless it is needed for an incident, a legal requirement, or an insurance matter. Access is limited to our safety and security leads, and to others only as required by law.
• Photography, recording, image, and likeness. Photos and video taken at the festival, by us or by people working with us, may capture attendees and may be used to document, archive, and promote the event. The licence you grant for this use is described in our Terms and Conditions. If you would like us to remove an image that identifies you from our own promotional materials, contact our Privacy Officer and we will make reasonable efforts to do so.
• First aid, medical, and harm-reduction information. If you receive first aid or medical care, or use our harm-reduction services such as Tea Hive or Consent Kitties, we collect information about that care so that we can help you safely and meet our legal obligations. We treat this as health information. It is kept and protected in accordance with applicable law and our records-retention practices, it is not used for marketing, and clinical records are kept intact.
• Accessibility and accommodation information. If you ask us for an accommodation, the information you share, which may include health-related details, is used only to arrange that accommodation and is handled with care. You can make a request by emailing accessibility@futureforest.ca.

3. How we use your information

• Orders and memberships: to process and fulfill orders, take payment, arrange shipping, manage your account and membership, and keep you informed about your order or membership.
• Entry, safety, and care: to manage entry and age checks, keep the site and our community safe, operate security, and provide first aid, medical, and harm-reduction support.
• Customer support: to answer your questions, including through live chat. Outside staffed hours, an automated assistant answers chats on our behalf. It is built on Anthropic’s Claude model and runs on Cloudflare; the messages you type in that conversation are sent to Anthropic to generate the reply. A member of our team can take over the conversation.
• Email communications: to send order confirmations and service messages, and, where you have opted in, newsletters and offers. When you join the mailing list on futureforest.ca, your email address, your language, and the form you used are passed to our mailing-list system, FunnelKit, on store.futureforest.ca, and you are added straight away; there is no confirmation step. If you start a checkout and leave without completing the order, we may send you a reminder about the items in your cart (see Section 4). Every marketing email includes an unsubscribe link.
• Documentation and promotion: to document, archive, and promote the festival, as described in Section 2.5.
• Analytics and advertising: to understand how the Sites are used, improve them, measure our marketing, and, where you have opted in, show you relevant ads on third-party platforms such as Google and Meta. Section 6 explains what we share with Google and Meta and how to opt out.
• Security and compliance: to detect and prevent fraud, spam, and bots, protect the Sites (including through a firewall that logs IP addresses), and meet our legal, tax, and accounting obligations.

4. Consent and your choices

We rely on your consent to handle your personal information, and we ask for it in a way that fits how the information is used.

• Information we need to serve you. When you place an order, hold a membership, attend the festival, or contact us, we rely on your consent, given by going ahead with that activity, to handle the information needed to provide it, to keep the site and people safe, and to meet our legal obligations.
• Marketing email. We send newsletters and offers only if you have opted in. We keep a record of your subscription. You can withdraw at any time using the unsubscribe link or by contacting us.

Cart reminders. If you start a checkout and leave without completing the order, we may email you a reminder about your cart. We send this on the basis of the implied consent that Canada’s anti-spam law recognises when you make an inquiry with us, and only for a limited time after you leave the checkout. You can stop these reminders at any time by contacting us (Section 16).

• Analytics and advertising cookies. We use these only with your opt-in consent through our cookie banner (see Section 5).
• Sensitive information. We ask for clear, specific consent before collecting sensitive information, such as health or accommodation details, and we use it only for the purpose you gave it.

You can withdraw your consent, subject to legal or contractual limits, by contacting our Privacy Officer. Withdrawing consent may mean we can no longer provide a particular service.

5. Cookies and tracking technologies

We use cookies and similar technologies in these categories:

• Strictly necessary: required to run the Sites, such as your cart, checkout, login, language, currency, and the record of your cookie choice.
• Analytics: to measure traffic and usage, for example Google Analytics.
• Advertising: to measure ad performance and show relevant ads, including remarketing, for example Google Ads and the Meta Pixel (see Section 6 for what is shared and how to opt out).
• Functional: to enable features such as live chat.
• Security: to help detect spam, bots, and abuse, for example a short-lived Cloudflare cookie called __cf_bm and the CleanTalk cookie. Our banner does not control these cookies.

When you first visit the Sites, our cookie banner offers two choices: Accept all, or Necessary only. Analytics and advertising cookies stay off until you choose Accept all. Your choice is stored in a cookie called ff_consent for one year and applies to both futureforest.ca and store.futureforest.ca. Google’s tags start in a consent-denied state (Google Consent Mode) and are switched on only by that choice. Strictly necessary cookies do not require consent. To change your choice, delete the ff_consent cookie in your browser settings and make your choice again when the banner reappears. If you are withdrawing consent, also delete any analytics or advertising cookies already set. You can block or delete cookies in your browser at any time.

The Crisp live chat widget loads on every page regardless of your banner choice. When it loads, Crisp receives the technical details that any web request carries, such as your IP address and browser type, and it may store an identifier in your browser so that your conversation stays open as you move between pages. What happens to the messages you send in chat is described in Section 3.

Our banner does not currently read browser signals such as Global Privacy Control. Use the banner to set your choice.

6. How we share your information

We do not sell your personal information, and we do not rent or trade it. We share personal information with the service providers and partners listed below. Most of them process it only on our behalf and only as needed to provide their service to us. Google, Meta, Stripe, and PayPal also handle some of it under their own privacy policies for their own purposes, such as fraud prevention or ad measurement. Partial.ly handles payment-plan information under its own terms and privacy policy. Our providers include:

• Payment processing: Stripe (cards and Apple Pay) and PayPal.
• Payment plans: Future Pay, powered by Partial.ly. Your use of a payment plan is also subject to that provider’s terms and privacy policy.
• Email, CRM, and marketing: FunnelKit, our mailing-list and automation software, which runs on our own store server and records email deliveries, opens, and clicks, and the email delivery services that carry mail from the Sites, including SendGrid, which may record deliveries, opens, and clicks.
• Online forms: Fillout, which processes information you submit through our forms.
• Analytics and advertising: Google (Analytics, Ads, and Tag Manager) and Meta (Facebook and Instagram). What each receives, and how to opt out, is explained after this list.
• Live chat and support: Crisp. Outside staffed hours: Anthropic, which generates the automated assistant’s replies from the messages you send, and Cloudflare, which runs the assistant.
• Address tools and shipping: Canada Post.
• Spam and abuse prevention: CleanTalk, which receives the details you submit at checkout, account registration, and in contact forms, together with your IP address, to run its check.
• Automation and record-keeping: Zapier, which passes order and customer details from the store to Airtable, and Airtable, where we keep order records and the responses to our Fillout forms so our team can manage orders and applications.
• Festival check-in: Qflow, for ticket scanning at the festival entrance.
• Hosting, content delivery, and security: Kinsta (on Google Cloud) and Cloudflare, which runs bot protection. Our site firewall, Wordfence, logs IP addresses.

What Google and Meta receive. If you choose Accept all in our banner, Google Analytics receives the pages you view, how you interact with them (such as scrolling, clicks, and form use), items added to your cart, purchases (order number, amount, items, and currency), and mailing-list sign-ups. The sign-up event we send to Google Analytics does not include your email address. Google Ads receives conversion and remarketing signals through the same Google tag, and Google may link your visits across futureforest.ca and store.futureforest.ca to attribute a purchase to an ad. Meta receives page views, shopping events such as purchases, and mailing-list sign-ups through the Meta Pixel and related Meta business tools, and may use them for its own purposes under its own privacy policy. To learn how Google uses this data, see policies.google.com/technologies/partner-sites. Meta’s privacy policy is at facebook.com/privacy/policy.

How to opt out. Choose Necessary only in our banner. If you already chose Accept all, delete the ff_consent cookie and any Google or Meta cookies in your browser, then choose Necessary only when the banner appears again (see Section 5). You can also adjust your Google Ads Settings at adssettings.google.com, install the Google Analytics opt-out browser add-on, adjust your Meta Ads Preferences, or visit youradchoices.ca.

We may also disclose information when required by law, to respond to valid legal requests, to protect our rights or the safety of others, or in connection with a business transfer. Information from on-site first aid or medical care is treated as health information and is not shared for marketing.

7. Automated decision-making

Some decisions are made by automated processing, without a person reviewing them. We use automated screening to detect and prevent payment fraud, which can decline a transaction. CleanTalk runs automated spam screening on checkout, account registration, and contact-form submissions; it receives the submitted details and your IP address and can block a submission or a purchase. Cloudflare runs automated bot protection, which can block access to the Sites. If a decision about you was made in this way, you can ask us to tell you the personal information we used and the main factors behind the decision, ask us to correct that information, and submit your comments to a member of our team who can review the decision. Contact our Privacy Officer to do so.

8. International data transfers

Some of our service providers are located in the United States or other countries outside Canada. They include Anthropic, a company based in the United States, which processes the messages you send to our automated chat assistant. This means your personal information may be stored or processed outside Canada, and outside Quebec, where it may be subject to the laws of those places, including lawful access by foreign authorities. Quebec law requires us to assess whether personal information sent outside Quebec will receive adequate protection; we are carrying out these assessments for the providers listed in Section 6. We take reasonable steps to ensure your information receives a comparable level of protection wherever it is processed.

9. Data retention

We keep personal information only for as long as we need it for the purposes in this policy. In general:

• Order and transaction records: for the period required by tax and accounting law, generally six years.
• Account and membership information: for as long as your account or membership is active, and for a limited period afterward.
• Applications, intake forms, and accommodation requests: for as long as needed to run the program or festival season they relate to, and for a limited period afterward.
• Mailing list: until you unsubscribe.
• Cookie consent choice: one year, in the ff_consent cookie.
• Access and security logs: for a limited period.
• Live chat transcripts and support messages: for a limited period after your question is resolved. Messages handled by our automated assistant are also subject to Anthropic’s own retention terms (see Sections 3 and 8).
• Security-camera footage: 21 days, unless needed for an incident, a legal requirement, or an insurance matter.
• On-site first aid and medical records: in accordance with applicable law and our records-retention practices.
• Analytics and advertising data: in line with the providers’ standard retention.

When information is no longer needed, we securely delete or anonymise it, except where a record must be kept intact by law.

10. Data security

We use industry-standard measures to protect your information in transit and in storage, including encryption in transit and access controls. Payment details are handled by our PCI-compliant payment providers, Stripe and PayPal, and are not stored on our servers. Payment plans are handled by Partial.ly under its own terms and privacy policy. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights and choices

Subject to applicable law, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Delete your personal information, subject to certain legal exceptions.
• Withdraw consent and opt out of marketing at any time.
• Data portability, where applicable law such as Quebec’s Law 25 provides it.
• Ask us to stop disseminating your personal information, or to de-index a link, where Law 25 provides for it.

To exercise any of these rights, contact our Privacy Officer (Section 16). We may need to verify your identity before responding.

If you live outside Canada, we handle your personal information under this policy and applicable Canadian law. Residents of some regions may have additional rights under local law; contact our Privacy Officer and we will respond as the law requires.

12. Children’s privacy

The Sites, our membership, and the festival are intended for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have done so, we will delete it promptly.

13. Third-party links

The Sites may contain links to websites we do not operate. This policy applies only to information collected through our Sites and at our festival. We are not responsible for the privacy practices of third-party websites, and we encourage you to review their policies.

14. Data breaches

If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the appropriate authorities, including the Office of the Privacy Commissioner of Canada and, where applicable, the Commission d’accès à l’information du Québec, as required by law.

15. Changes to this Privacy Policy

We may update this policy from time to time to reflect changes in our practices or for legal or operational reasons. When we do, we will revise the “Last Updated” date above. We encourage you to review this page periodically.

16. Contact us and Privacy Officer

For any question, concern, or request about this policy or your personal information, please contact our Privacy Officer:

Tim Kukula, Executive Director and Privacy Officer
Future Forest Music & Arts Festival Inc.
Privacy: tim@futureforest.ca
General inquiries: info@futureforest.ca
Phone: (506) 999-0356
Address: A-158 Leinster Street, Saint John, NB E2L 1J5, Canada

If you are not satisfied with our response, you have the right to make a complaint to the Office of the Privacy Commissioner of Canada or to your provincial privacy regulator.