Last Updated: June 24, 2026

Introduction

Future Forest Music & Arts Festival Inc. (“Future Forest,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit or buy through our websites, store.futureforest.ca and futureforest.ca (together, “the Sites”), when you hold a Future Pass membership, and when you attend the Future Forest festival.

We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s Anti-Spam Legislation (CASL), and applicable provincial privacy laws, including Quebec’s Law 25. Personal health information we collect on site is also handled in keeping with New Brunswick’s Personal Health Information Privacy and Access Act (PHIPAA).

How we rely on your consent, and the choices you have, are described in Section 4.

1. Scope of this policy

This policy covers two connected settings:

Our Sites: the store and main website, including purchases, accounts, the mailing list, online forms, and live chat.
The festival: what we collect when you attend, including entry, safety and security, first aid and harm reduction, and accessibility support.

Where a practice applies to only one setting, we say so. The Sites, our membership, and the festival are intended for people aged 18 and over (see Section 12).

2. Information we collect

2.1 Information you provide

Your name, email address, phone number, and billing and shipping address.
Account and login details, and membership details.
Information you enter in our online forms (for example, accommodation requests, vendor or artist applications, and contest entries), which are hosted on Fillout.
The content of messages you send us, including live chat.
When you buy, your payment card details, which are collected and processed by our payment provider; we do not store full card numbers ourselves.

2.2 Information collected automatically

As you browse the Sites, we collect your device and browser type, IP address, time zone, approximate location (used to show the correct currency and language), the pages you view, and the source that referred you to us. We collect this through cookies and similar technologies (see Section 5).

2.3 Address autocomplete

When you enter an address at checkout, what you type may be processed by Canada Post’s AddressComplete service to suggest valid addresses.

2.4 Membership and program information

If you hold a Future Pass membership, we maintain your membership status and a unique digital membership identifier, including a QR code, and we record your use of the program, such as discounts applied or applications submitted.

2.5 At the festival

When you attend, we collect the following.

Entry and ticket scanning. Your ticket is scanned at the entrance to confirm a valid ticket and to manage entry. Scanning is handled by our check-in provider, Qflow.
Age and identification check. Staff visually inspect government photo identification at entry to confirm that guests are 18 or over and eligible for age-restricted activities. We do not scan, copy, or keep your identification; it is looked at and handed back.
Security cameras. Cameras operate at the gate, at stages, and in other areas of the site for safety and security. Footage is kept for 21 days and is then deleted, unless it is needed for an incident, a legal requirement, or an insurance matter. Access is limited to our safety and security leads, and to others only as required by law.
Photography, recording, image, and likeness. Photos and video taken at the festival, by us or by people working with us, may capture attendees and may be used to document, archive, and promote the event. The licence you grant for this use is described in our Terms and Conditions. If you would like us to remove an image that identifies you from our own promotional materials, contact our Privacy Officer and we will make reasonable efforts to do so.
First aid, medical, and harm-reduction information. If you receive first aid or medical care, or use our harm-reduction services such as Tea Hive or Consent Kitties, we collect information about that care so that we can help you safely and meet our legal obligations. We treat this as health information. It is kept and protected in accordance with applicable law and our records-retention practices, it is not used for marketing, and clinical records are kept intact.
Accessibility and accommodation information. If you ask us for an accommodation, the information you share, which may include health-related details, is used only to arrange that accommodation and is handled with care. You can make a request through becca@futureforest.ca or our accommodation form.

3. How we use your information

Orders and memberships: to process and fulfill orders, take payment, arrange shipping, manage your account and membership, and keep you informed about your order or membership.
Entry, safety, and care: to manage entry and age checks, keep the site and our community safe, operate security, and provide first aid, medical, and harm-reduction support.
Customer support: to answer your questions, including through live chat.
Email communications: to send order confirmations and service messages, and, where you have opted in, newsletters and offers. Every marketing email includes an unsubscribe link.
Documentation and promotion: to document, archive, and promote the festival, as described in Section 2.5.
Analytics and advertising: to understand how the Sites are used, improve them, measure our marketing, and, where you have opted in, show you relevant ads on third-party platforms such as Google and Meta.
Security and compliance: to detect and prevent fraud and spam, protect the Sites, and meet our legal, tax, and accounting obligations.

4. Consent and your choices

We rely on your consent to handle your personal information, and we ask for it in a way that fits how the information is used.

Information we need to serve you. When you place an order, hold a membership, attend the festival, or contact us, we rely on your consent, given by going ahead with that activity, to handle the information needed to provide it, to keep the site and people safe, and to meet our legal obligations.
Marketing email. We send newsletters and offers only if you have opted in. You can withdraw at any time using the unsubscribe link or by contacting us.
Analytics and advertising cookies. We use these only with your opt-in consent through our cookie banner (see Section 5).
Sensitive information. We ask for clear, specific consent before collecting sensitive information, such as health or accommodation details, and we use it only for the purpose you gave it.

You can withdraw your consent, subject to legal or contractual limits, by contacting our Privacy Officer. Withdrawing consent may mean we can no longer provide a particular service.

5. Cookies and tracking technologies

We use cookies and similar technologies in these categories:

Strictly necessary: required to run the Sites, such as your cart, checkout, login, language, and currency.
Analytics: to measure traffic and usage, for example Google Analytics.
Advertising: to measure ad performance and show relevant ads, including remarketing, for example Google Ads and the Meta pixel.
Functional: to enable features such as live chat and currency or language detection.
Security: to help detect spam and abuse.

When you first visit the Sites, our cookie banner lets you choose which non-essential cookies to allow. Analytics and advertising cookies stay off until you turn them on, and we record your choice. You can change your choice at any time through the banner or your browser settings. Strictly necessary cookies do not require consent. We honour recognised browser opt-out signals where the law requires it.

6. How we share your information

We do not sell your personal information, and we do not rent or trade it. We share personal information only with service providers and partners who process it on our behalf, and only as needed to provide their service to us. These include:

Payment processing: Stripe.
Payment plans: Future Pay, powered by Partial.ly. Your use of a payment plan is also subject to that provider’s terms and privacy policy.
Email, CRM, and marketing: FunnelKit and SendGrid, which may record email deliveries, opens, and clicks.
Online forms: Fillout, which processes information you submit through our forms.
Analytics and advertising: Google (Analytics, Ads, and Tag Manager) and Meta (Facebook and Instagram).
Live chat and support: Crisp.
Address tools and shipping: Canada Post.
Spam and abuse prevention: CleanTalk.
Automation and record-keeping: Zapier and Airtable.
Festival check-in: Qflow, for ticket scanning at the festival entrance.

We may also disclose information when required by law, to respond to valid legal requests, to protect our rights or the safety of others, or in connection with a business transfer. Information from on-site first aid or medical care is treated as health information and is not shared for marketing.

7. Automated decision-making

Some decisions are made by automated processing, without a person reviewing them. We use automated screening to detect and prevent payment fraud, which can decline a transaction, and automated spam screening on form and comment submissions, which can block a submission. If a decision about you was made in this way, you can ask us to tell you the personal information we used and the main factors behind the decision, ask us to correct that information, and submit your comments to a member of our team who can review the decision. Contact our Privacy Officer to do so.

8. International data transfers

Some of our service providers are located in the United States or other countries outside Canada. This means your personal information may be stored or processed outside Canada, and outside Quebec, where it may be subject to the laws of those places, including lawful access by foreign authorities. Before we transfer personal information outside Quebec, we assess whether it will receive protection comparable to what it receives here, and we keep those assessments on file. We take reasonable steps to ensure your information receives a comparable level of protection wherever it is processed.

9. Data retention

We keep personal information only for as long as we need it for the purposes in this policy. In general:

Order and transaction records: for the period required by tax and accounting law, generally six years.
Account and membership information: for as long as your account or membership is active, and for a limited period afterward.
Mailing list: until you unsubscribe.
Live chat transcripts and support messages: for a limited period after your question is resolved.
Security-camera footage: 21 days, unless needed for an incident, a legal requirement, or an insurance matter.
On-site first aid and medical records: in accordance with applicable law and our records-retention practices.
Analytics and advertising data: in line with the providers’ standard retention.

When information is no longer needed, we securely delete or anonymise it, except where a record must be kept intact by law.

10. Data security

We use industry-standard measures to protect your information in transit and in storage, including encryption in transit and access controls. Payment card details are handled by Stripe, our PCI-compliant payment provider, and are not stored on our servers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights and choices

Subject to applicable law, you may have the right to:

Access the personal information we hold about you.
Correct information that is inaccurate or out of date.
Delete your personal information, subject to certain legal exceptions.
Withdraw consent and opt out of marketing at any time.
Data portability, where applicable law such as Quebec’s Law 25 provides it.
Ask us to stop disseminating your personal information, or to de-index a link, where Law 25 provides for it.

To exercise any of these rights, contact our Privacy Officer (Section 16). We may need to verify your identity before responding.

If you live outside Canada, we handle your personal information under this policy and applicable Canadian law. Residents of some regions may have additional rights under local law; contact our Privacy Officer and we will respond as the law requires.

12. Children’s privacy

The Sites, our membership, and the festival are intended for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have done so, we will delete it promptly.

13. Third-party links

The Sites may contain links to websites we do not operate. This policy applies only to information collected through our Sites and at our festival. We are not responsible for the privacy practices of third-party websites, and we encourage you to review their policies.

14. Data breaches

If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the appropriate authorities, including the Office of the Privacy Commissioner of Canada and, where applicable, the Commission d’accès à l’information du Québec, as required by law.

15. Changes to this Privacy Policy

We may update this policy from time to time to reflect changes in our practices or for legal or operational reasons. When we do, we will revise the “Last Updated” date above. We encourage you to review this page periodically.

16. Contact us and Privacy Officer

For any question, concern, or request about this policy or your personal information, please contact our Privacy Officer:

Tim Kukula, Executive Director and Privacy Officer
Future Forest Music & Arts Festival Inc.
Privacy: tim@futureforest.ca
General inquiries: info@futureforest.ca
Phone: (506) 999-0356
Address: A-158 Leinster Street, Saint John, NB, Canada

If you are not satisfied with our response, you have the right to make a complaint to the Office of the Privacy Commissioner of Canada or to your provincial privacy regulator.