Privacy Policy

1. Scope and Accountability

1. 1.1
   This Policy applies when you browse the Services, create an account, buy or hold a Ticket, attend or organize an Event, create or respond to a Private Invite, apply to become or act as a Partner, join a Partner team, communicate through Bunny Riot, use map features, subscribe to a plan, purchase or sell a Product through a Storefront, contact support, or otherwise interact with us.
2. 1.2
   Bunny Riot is accountable for personal information under its control. We have designated a Privacy Officer to oversee this Policy, respond to requests and complaints, and support compliance. The Privacy Officer may be contacted using Section 26.
3. 1.3
   An Organizer, Co-Host, venue, Seller, payment provider, mapping provider, or other third party may separately collect or control personal information for its own activities. Its handling of information is governed by its own legal obligations and privacy notice. Section 10 explains how approved Partners may access information through Bunny Riot.
4. 1.4
   This Policy does not apply to information that has been irreversibly de-identified so that it is no longer personal information under applicable law. We may use and disclose de-identified or aggregated information for lawful purposes, provided we do not attempt to re-identify it except to test or maintain privacy safeguards or as permitted by law.

2. Consent and Other Lawful Authority

1. 2.1
   We seek consent appropriate to the sensitivity of the information and the reasonable expectations of the individual. Consent may be express, implied by a request you make, or provided by an authorized person such as a guardian, Buyer, employer, or business representative. We may also collect, use, or disclose information without consent where permitted or required by law.
2. 2.2
   Some processing is necessary to provide a service you request, complete a transaction, maintain security, comply with law, or administer our agreement with you. If you do not provide information needed for those purposes, we may be unable to create an account, process a Ticket or payout, verify a Partner, fulfil an order, admit an Attendee, or provide the requested feature.
3. 2.3
   We request separate or just-in-time consent where appropriate for optional or sensitive activities, including precise device location, non-essential marketing, or a materially new use of personal information. You may withdraw consent subject to legal and contractual limits and reasonable notice. Section 22 explains how.
4. 2.4
   If you provide personal information about another person, including a guest, minor Attendee, team member, Co-Host, customer, or invite recipient, you represent that you have authority to provide it and have given any notice or obtained any consent required by law. Do not provide more information than the Services request.

3. Personal Information We Collect

1. 3.1
   Account and contact information. We may collect your name, email address, telephone number, username, profile image, password credential or authentication token, communication preferences, date of birth or age confirmation, and account settings. If social sign-in is offered, we may receive the profile and account information that you authorize the sign-in provider to share.
2. 3.2
   Ticket, Event, and attendance information. We may collect Ticket type, order number, Event selection, Buyer and Attendee names, age or eligibility confirmation, check-in status and time, transfer or refund activity, attendance history, wait-list status, Event communications, survey responses, feedback, and records needed to resolve admission or customer-support issues.
3. 3.3
   Private Invite information. We may collect an invite creator's identity, Event details, invite-recipient names and contact information, guest lists, RSVP responses, plus-one information, messages, edits, cancellations, and delivery or engagement status. The information visible to invite participants depends on the creator's settings and the feature design.
4. 3.4
   Partner, Co-Host, and team information. We may collect legal and display names, business or organization details, role and authority, contact information, application answers, Event plans, permits, licences, insurance, safety or venue documents, tax and payout information, collaboration invitations, team membership, permission levels, activity logs, support records, and verification status.
5. 3.5
   Payment, payout, and transaction information. We and our payment provider may collect billing contact information, transaction amount, currency, fees, taxes, payment status, refunds, chargebacks, processor tokens, partial payment-method details, bank or payout information, tax identifiers, and records needed for accounting, fraud prevention, disputes, and legal compliance. Bunny Riot does not store complete payment-card numbers.
6. 3.6
   Storefront and Product information. If Storefront features are enabled, we may collect Product selections, order and inventory information, recipient and shipping details, billing details, delivery status, returns, refunds, customer-service communications, and Seller analytics. A Seller receives only information reasonably required to fulfil, support, refund, or otherwise administer its own orders, subject to Sections 11 and 15.
7. 3.7
   Precise and approximate location information. With permission from your browser or device, we may receive latitude and longitude coordinates or another precise or approximate device location. We may also infer a general region from an IP address, receive a location you type or select, or process Event and venue addresses supplied by Organizers. Section 6 provides important details and choices.
8. 3.8
   Device, usage, and diagnostic information. We may collect IP address, browser and device type, operating system, language, time zone, referring and exit pages, pages or screens viewed, links and controls used, session timestamps, approximate region, cookie or local-storage identifiers, feature usage, performance information, and errors or diagnostic events.
9. 3.9
   User Content, communications, and media. We may collect Event listings, Product listings, profiles, text, messages, reviews, photographs, video, audio, files, and other content submitted to the Services. We may also collect correspondence with support, legal, privacy, safety, and Partner teams. Event photography or recordings may contain an Attendee's image, voice, or likeness as described in Section 14 and the Terms of Service.
10. 3.10
    Safety, accessibility, and incident information. Where reasonably necessary, we may collect accommodation requests, accessibility needs, dietary information, emergency contact details, injury or incident reports, security observations, banned-person or conduct records, insurance information, and communications with venues, emergency responders, insurers, or authorities. Health-related or similarly sensitive information should be limited to what is necessary for the request or incident.
11. 3.11
    Identity and eligibility information. For age, fraud, safety, Partner, or payment verification, Bunny Riot or a verification provider may process government identification, a selfie, business-registration information, beneficial-owner or director details, sanctions-screening results, or other verification information. When a provider performs the check, Bunny Riot may receive only the result, status, or limited supporting details rather than a complete copy of the identification.

4. How We Collect Information

1. 4.1
   We collect information directly from you when you use the Services, complete a form, make a purchase, grant device permission, upload content, communicate with us, apply as a Partner, or administer an Event, team, payout, subscription, or Storefront.
2. 4.2
   We may receive information about you from a Buyer, invite creator, guardian, Organizer, Co-Host, Partner team administrator, Seller, venue, check-in worker, support representative, or other person who interacts with the Services. We may also receive information from Stripe, Google Maps, PostHog, authentication providers, fraud and identity-verification providers, email or messaging services, shipping carriers, and other providers used to operate the Services.
3. 4.3
   We collect some technical and usage information automatically through server logs, cookies, browser storage, analytics tools, mapping tools, pixels or similar technologies. Sections 6 through 8 explain the principal current uses.
4. 4.4
   We may collect information from public or lawfully accessible sources when reasonably necessary to verify a Partner or Event, investigate fraud or safety concerns, enforce our rights, or meet a legal obligation. We will not use public availability as permission to collect information indiscriminately.

5. How We Use Personal Information

1. 5.1
   We may use personal information to:

   • •create, authenticate, secure, maintain, and support accounts;
   • •display, search, recommend, map, sell, deliver, transfer, scan, and administer Tickets and Events;
   • •create, send, manage, and respond to Private Invites;
   • •process payments, payouts, fees, subscriptions, taxes, refunds, reversals, chargebacks, and financial reconciliation;
   • •review Partner applications and Event listings, verify identity or business information, and administer Partner teams, Co-Hosts, permissions, dashboards, analytics, Storefronts, and inventory;
   • •fulfil Product orders, coordinate delivery, process returns, and provide customer support;
   • •provide nearby-Event, distance, map, geocoding, routing, and related location features;
   • •send transaction confirmations, Event updates, security alerts, support responses, policy notices, and other service communications;
   • •send marketing communications where we have consent or another lawful basis;
   • •personalize Services, remember preferences, understand usage, test features, troubleshoot errors, and improve accessibility, performance, safety, and user experience;
   • •prevent, detect, investigate, and address fraud, abuse, chargebacks, security incidents, unsafe conduct, policy violations, illegal activity, or threats to persons or property;
   • •establish, exercise, or defend legal claims; respond to lawful requests; maintain records; and comply with tax, accounting, consumer, privacy, anti-spam, payment, sanctions, and other legal requirements; and
   • •complete or evaluate a financing, reorganization, merger, sale, insurance matter, or other corporate transaction, subject to appropriate safeguards.
2. 5.2
   We will not use personal information for a materially different purpose without providing additional notice and obtaining consent where required by law.

6. Precise Location and Google Maps

1. 6.1
   Optional permission. The Events page and related features may ask your browser or device for permission to access precise or approximate location. If you allow access, the device may provide coordinates to centre the map, identify Events near you, estimate distance, order or filter results, and provide other map-related functionality. Location permission is optional. If you decline, block, or later revoke it, you may still use non-location features, but nearby-Event and personalized map functions may be less accurate or unavailable.
2. 6.2
   Current Bunny Riot use. Under the current design, Bunny Riot uses browser-provided coordinates for the active page or browsing session and does not intentionally attach them to your account or build a persistent history of your movements. Coordinates and related request information may exist temporarily in browser memory or technical logs. If you type or select a location filter, open a shared map link, or otherwise choose to save a location-based setting, the selected place, address, coordinates, or map parameters may appear in a URL, browser history, saved preference, or related record.
3. 6.3
   Google processing. Bunny Riot uses Google Maps Platform. When map or location features load, Google may receive and retain information such as search terms, IP address, device information, map interactions, and latitude and longitude coordinates to provide and improve Google products and services. Google's processing is governed by the Google Privacy Policy at policies.google.com/privacy. Use of Google Maps features and content is also subject to the Google Maps/Google Earth Additional Terms of Service at maps.google.com/help/terms_maps.
4. 6.4
   Consent and revocation. Your browser or operating system controls the location permission prompt. You may deny the request or later revoke permission through browser or device settings. Revocation prevents future access through that permission but does not undo processing that already occurred. Clearing site permissions, cookies, browser storage, or history may also remove some saved choices.
5. 6.5
   No unrelated location use. Bunny Riot does not intend to use precise browser location to create an advertising profile, determine Event admission, make a decision with a legal or similarly significant effect, or track movement outside the requested location feature. We do not intentionally provide your identity together with precise browser coordinates to Google. If we propose to retain precise location in an account, use it for a new purpose, or disclose it to a new category of recipient, we will provide a new notice and seek consent where required.
6. 6.6
   Organizer locations. Organizers may provide venue names, addresses, routes, and coordinates for publication. Bunny Riot may geocode and display that information on the map. Organizers must have authority to publish it and must use appropriate visibility settings for private, residential, confidential, invite-only, or sensitive locations.
7. 6.7
   Accuracy and safety. Map markers, routes, directions, travel times, accessibility details, and venue information may be approximate, delayed, or inaccurate. Verify the official Event listing and Organizer instructions. Do not rely on a map as a guarantee of safety, accessibility, road conditions, venue access, or timely arrival.

7. Cookies, Browser Storage, and Similar Technologies

1. 7.1
   We and our providers may use cookies, browser local storage, software-development kits, tags, logs, and similar technologies. These tools may store or access an identifier or preference on your device and help us operate, secure, remember, measure, and improve the Services.
2. 7.2
   Essential technologies support authentication, account security, shopping and ticketing functions, fraud prevention, load balancing, consent records, and other features reasonably necessary to provide the Services.
3. 7.3
   Preference technologies remember choices such as theme, language, location or search filters, and interface settings.
4. 7.4
   Analytics and diagnostic technologies help us understand visits, navigation, feature use, performance, errors, and broad audience trends. Our current analytics provider is described in Section 8.
5. 7.5
   Mapping technologies allow Google Maps to load map content and may enable Google to store or access cookies, identifiers, and technical information under Google's policies.
6. 7.6
   You can control cookies and browser storage using browser settings and any preference control we make available. Blocking or deleting essential technologies may prevent login, checkout, map loading, or other features from working correctly. Browser controls may not block server-side logs or information already collected.
7. 7.7
   We do not promise that browser signals such as "Do Not Track" will produce a uniform response because no single response standard applies to all technologies. We will honour legally required opt-out signals where they apply to our activities.

8. PostHog Product Analytics and Diagnostics

1. 8.1
   Bunny Riot currently uses PostHog to understand and improve the Services and to capture certain software errors. Depending on our configuration, PostHog may process page views, clicks and interface interactions, referring pages, device and browser information, IP address, approximate region, session or device identifiers, performance data, errors, and diagnostic context.
2. 8.2
   PostHog may use cookies, local storage, or privacy-preserving identifiers depending on the configuration in effect. Analytics may include tools such as aggregated funnels, feature usage, heatmaps, or session-replay-like diagnostics if enabled. We will configure analytics with reasonable data minimization and masking controls and will not intentionally use PostHog to record payment-card numbers, passwords, government-identification numbers, or the contents of fields intended for sensitive information.
3. 8.3
   We do not intend to send precise browser coordinates to PostHog as a location-history property. PostHog may infer an approximate region from an IP address and may process technical data through Bunny Riot's first-party ingestion route or PostHog infrastructure.
4. 8.4
   PostHog acts as a service provider for Bunny Riot analytics data and processes it under its agreement with us. Information may be processed outside Canada. PostHog's own privacy information is available at posthog.com/privacy.
5. 8.5
   Where applicable law requires consent for non-essential analytics, we will seek that consent. You may also restrict cookies or local storage through browser settings or use any analytics preference control we provide. A privacy request to Bunny Riot may include a request to delete or de-identify analytics information that we can reasonably associate with you, subject to legal and technical limits.

9. Tickets, Events, Check-In, and Private Invites

1. 9.1
   We use ticket and attendance information to complete orders, deliver Tickets, manage capacity, verify eligibility, prevent duplicate or fraudulent entry, check in Attendees, provide Event communications and support, administer refunds or disputes, and create attendance and revenue analytics.
2. 9.2
   The Organizer of an Event may receive the Attendee name, Ticket type, check-in status, Event communications, order status, and other information reasonably necessary to operate that Event. The Organizer may also receive aggregated attendance, Event count, and revenue analytics. Section 10 limits Partner access and use.
3. 9.3
   A Private Invite creator may provide guest contact information and see RSVP or delivery information needed to administer the invitation. Invite recipients may see information made visible by the creator's settings. Private Invite information must not be used to spam recipients, build an unrelated marketing list, or evade Partner approval and privacy requirements.
4. 9.4
   If you receive an invitation without having an account, we may use your contact information to deliver and administer that invitation and related service messages. We will not treat an invitation supplied by another user as consent to send unrelated Bunny Riot marketing.

10. Partners, Co-Hosts, and Partner Teams

1. 10.1
   Approved Partners receive role-based access to operational information for their own Events and, if applicable, Product orders. This may include Attendee or customer names, Ticket or Product types, check-in or order status, Event messages, revenue, attendance totals, Event counts, inventory, and other dashboard analytics Bunny Riot makes available.
2. 10.2
   Partner access is ordinarily limited to viewing and using information within the Partner Dashboard and Bunny Riot communication tools. A Partner may not download, export, scrape, copy, or build a reusable attendee or customer list unless Bunny Riot expressly authorizes and provides that access to help deliver a related Event, order, support, or other approved service.
3. 10.3
   A Partner may use personal information only to organize, deliver, secure, and support the relevant Event or Product order; communicate through Bunny Riot's tools about that Event or order; comply with law; address safety, refunds, or disputes; and perform another purpose expressly authorized by Bunny Riot and disclosed to the individual where required.
4. 10.4
   Partners must not use Bunny Riot-provided information for unrelated advertising, data enrichment, sale, profiling, political outreach, or direct marketing unless Bunny Riot expressly authorizes the activity and the Partner independently has any consent required by law.
5. 10.5
   A Lead Organizer may invite approved Co-Hosts and team members and assign permission levels. Those users may see information accessible to their role. The Partner is responsible for choosing appropriate permissions, removing access promptly when no longer required, supervising its users, and ensuring that its Co-Hosts and team members follow privacy and security obligations.
6. 10.6
   Bunny Riot may log dashboard access and actions, investigate misuse, restrict permissions, require additional safeguards, or suspend a Partner or team member where reasonably necessary to protect individuals, comply with law, or enforce our Terms.
7. 10.7
   A Partner may separately collect information outside Bunny Riot, such as an accommodation request made directly to the Organizer. The Partner is independently responsible for that collection and should provide its own privacy information where required. Bunny Riot is not responsible for a Partner's independent collection or use, except to the extent Bunny Riot has a non-excludable legal responsibility or contributed to the issue.

11. Storefronts, Sellers, and Shipping

1. 11.1
   If Storefront features are offered, Bunny Riot and approved Partners may act as Sellers. The identity of the Seller should be displayed on the Product listing or checkout. Bunny Riot uses order information to operate checkout, payments, fraud prevention, receipts, analytics, support, and platform administration.
2. 11.2
   A Partner Seller may receive a Buyer's or recipient's name, contact information, shipping address, Product and order details, delivery status, return information, and communications reasonably necessary to fulfil and support that Seller's order. A Seller must not use this information for an unrelated purpose or marketing without separate lawful consent.
3. 11.3
   A Seller may provide necessary shipping information to a carrier, fulfilment provider, return processor, or customer-support provider. The Seller is responsible for choosing appropriate providers and complying with its own privacy obligations. Where Bunny Riot selects the provider for a platform service, Bunny Riot will apply its own provider-review obligations.
4. 11.4
   Storefront access may require a Pro subscription or another written arrangement. Subscription billing, feature usage, and cancellation records are handled as account and transaction information under this Policy.

12. Payments, Stripe, Identity Verification, and Taxes

1. 12.1
   Bunny Riot currently uses Stripe for payment processing, connected Partner accounts, payouts, fraud tools, and related financial services. Stripe may collect payment-card, bank, identity, device, transaction, tax, and verification information directly from Users and Partners. Stripe handles that information under its own agreements and privacy policy, available at stripe.com/en-ca/privacy.
2. 12.2
   Bunny Riot may receive transaction confirmations, processor identifiers, card brand and last digits, payment or payout status, risk signals, dispute information, verification status, connected-account capabilities, and other information needed to administer marketplace payments. We do not receive or store complete payment-card numbers.
3. 12.3
   Bunny Riot or Stripe may use information to prevent fraud, authenticate transactions, comply with financial, tax, sanctions, and anti-money-laundering requirements, process refunds or disputes, and determine whether a Partner account can receive payouts.
4. 12.4
   The party responsible for filing or remitting tax depends on applicable law, seller status, merchant-of-record and payment configuration, and any express arrangement. Processing or calculating tax through Stripe does not by itself determine who files or remits it.

13. Service Communications and Marketing

1. 13.1
   We may send operational messages needed to administer an account, purchase, Ticket, Event, Invite, payout, security issue, policy update, refund, Product order, subscription, support request, or legal obligation. These are service communications rather than general advertising. Closing an account or ending the relevant service may be necessary to stop some operational messages.
2. 13.2
   We send promotional email, SMS, or other commercial electronic messages where we have consent or another basis permitted by Canada's anti-spam law and other applicable law. Marketing messages will identify the sender and include a readily usable unsubscribe mechanism where required.
3. 13.3
   You may unsubscribe using the link or instructions in a message or by contacting us. We may retain a suppression record so that we can honour the request. Unsubscribing from marketing does not stop required service, safety, transaction, or legal messages.
4. 13.4
   Partners ordinarily communicate with Attendees through Bunny Riot tools about the relevant Event or order. Bunny Riot-provided contact information is not permission for a Partner to add an individual to its independent marketing list.

14. User Content, Event Media, and Public Information

1. 14.1
   Information you intentionally publish in an Event listing, Product listing, profile, review, public comment, or other public area may be viewed, copied, indexed, or shared by others. Do not publish personal information that you do not want made public or that you lack authority to disclose.
2. 14.2
   Bunny Riot, an Organizer, a venue, or an authorized media provider may photograph or record an Event. Images, video, audio, captions, and related information may be used for Event operations, security, documentation, news, and promotion as described in the Terms of Service, Event notices, and any additional consent presented to you.
3. 14.3
   We will consider a reasonable advance request relating to safety, privacy, culture, accessibility, or another serious concern, but cannot guarantee that an individual will not appear incidentally in crowd, background, venue-security, or public-area footage. Where law requires consent for a particular use, we will seek it in an appropriate form.
4. 14.4
   The licence to User Content in the Terms of Service addresses intellectual-property permission. This Privacy Policy continues to govern any personal information contained in that content.

15. When We Disclose Personal Information

1. 15.1
   We may disclose personal information to:

   • •the Organizer, approved Co-Hosts, authorized Partner team members, venue, or check-in personnel for the relevant Event;
   • •a Seller, shipping carrier, fulfilment provider, or return processor for the relevant Product order;
   • •Stripe and other payment, payout, fraud, tax, accounting, or identity-verification providers;
   • •Google Maps for mapping, geocoding, nearby-Event, location, and related features;
   • •PostHog for analytics, performance, product improvement, and diagnostics;
   • •cloud hosting, database, authentication, storage, security, customer-support, email, SMS, and communications providers that help operate the Services;
   • •professional advisers, auditors, insurers, lenders, and contractors who need the information to provide services and are subject to appropriate duties;
   • •emergency responders, venues, security personnel, insurers, or authorities where reasonably necessary to address an incident, protect persons or property, or meet a legal obligation;
   • •a court, regulator, law-enforcement body, government authority, payment network, or other person where disclosure is required or permitted by law or reasonably necessary to establish, exercise, or defend legal rights;
   • •a potential or completed purchaser, investor, lender, successor, or transaction adviser in connection with a financing, merger, reorganization, sale, insolvency, or transfer of all or part of Bunny Riot, subject to appropriate confidentiality and lawful use restrictions; and
   • •another person with your instruction, authorization, or consent.
2. 15.2
   Service providers may use personal information only for the services they provide to us, their legal compliance, security, and other purposes permitted by their agreements and applicable law. Some providers, including Google and Stripe, may also act independently for portions of their services under their own terms and privacy policies.
3. 15.3
   We may disclose de-identified or aggregated information that does not reasonably identify an individual. For example, Partners may see attendance or revenue totals and Bunny Riot may publish broad marketplace trends.

16. No Sale of Personal Information and Advertising Choices

1. 16.1
   Bunny Riot does not sell or rent personal information or attendee/customer lists. Sharing information with an Organizer, Seller, or service provider for the purposes described in this Policy is not a sale by Bunny Riot.
2. 16.2
   Bunny Riot will not provide personal information to a third party for that third party's independent behavioural advertising or use non-essential advertising or remarketing technologies without first providing appropriate notice and choice where required. If our advertising practices materially change, we will update this Policy and seek consent or provide an opt-out as required by applicable law.
3. 16.3
   Bunny Riot may use its own account, transaction, Event-interest, and usage information to communicate relevant Bunny Riot Events or features where permitted by law. You may opt out of marketing as described in Section 13.

17. Retention and Deletion Practices

1. 17.1
   We retain personal information only as long as reasonably necessary for the purposes described in this Policy, an additional purpose disclosed at collection, or a legal, accounting, tax, safety, fraud-prevention, dispute, insurance, or recordkeeping requirement.
2. 17.2
   Retention depends on the type of information and context. In general:

   • •account and profile information is retained while the account is active and for a reasonable period afterward for restoration, fraud prevention, disputes, and legal obligations;
   • •Ticket, payment, payout, subscription, refund, chargeback, Product, tax, and accounting records are retained for required financial and legal periods;
   • •Event attendance, check-in, communication, incident, and safety records are retained for operational needs and applicable complaint, insurance, and limitation periods;
   • •Partner applications, verification, team, permit, insurance, and Event records are retained during the relationship and as needed for compliance, disputes, and future eligibility decisions;
   • •Invite and guest information is retained while needed to deliver and administer the Invite and may remain for a reasonable period in account records, logs, or backups;
   • •browser-provided precise location is currently intended for the active page or session rather than a persistent Bunny Riot location history, while Google and technical providers apply their own retention practices;
   • •analytics, diagnostics, cookies, and logs are retained according to configuration, security needs, and provider arrangements and may be de-identified or aggregated; and
   • •privacy and security-breach records are retained for the period required by law. PIPEDA currently requires records of security-safeguard breaches to be kept for at least 24 months.
3. 17.3
   Information may remain temporarily in backups, fraud-prevention systems, suppression lists, processor records, legal holds, or de-identified datasets after deletion from active systems. We may retain information needed to demonstrate compliance, complete a transaction, collect an amount owed, resolve a dispute, protect safety or security, or establish, exercise, or defend legal claims.
4. 17.4
   When retention is no longer justified, we will delete, anonymize, or securely dispose of the information using methods appropriate to its sensitivity.

18. Safeguards and Account Security

1. 18.1
   We use administrative, technical, and physical safeguards appropriate to the sensitivity, volume, format, and use of the information. Measures may include role-based access, authentication, encryption in transit, provider diligence, logging, backups, access reviews, staff or contractor confidentiality duties, incident response, and payment processing by specialized providers.
2. 18.2
   Partner team administrators control permission levels for their team members. Partners must use least-privilege access, protect credentials, review access regularly, and promptly remove people who no longer require it. Bunny Riot may restrict or revoke access where necessary.
3. 18.3
   No internet transmission, system, or storage method is completely secure. We cannot guarantee that unauthorized access, loss, misuse, or alteration will never occur. Users must protect account credentials, use secure devices, and notify support@thebunnyriot.com promptly about suspected compromise.

19. Privacy and Security Incidents

1. 19.1
   We maintain processes to investigate suspected loss of, unauthorized access to, or unauthorized disclosure of personal information. We may take steps to contain the incident, preserve evidence, notify providers or affected organizations, reset credentials, and reduce continuing risk.
2. 19.2
   Where required by PIPEDA or another applicable law, Bunny Riot will report a breach to the appropriate regulator, notify affected individuals, and notify another organization that may be able to reduce the risk of harm. The form and timing of notice will depend on legal requirements and the circumstances.
3. 19.3
   If you believe personal information has been exposed or misused through the Services, contact privacy@thebunnyriot.com or support@thebunnyriot.com as soon as possible. Do not include unnecessary sensitive information in the initial report.

20. Processing Outside Your Province or Canada

1. 20.1
   Bunny Riot is based in Newfoundland and Labrador, Canada. We and our providers may process or store personal information in Canada, the United States, and other jurisdictions where our providers, Partners, or operations are located.
2. 20.2
   Information processed in another jurisdiction may be subject to that jurisdiction's laws and may be accessible to courts, governments, regulators, or law-enforcement authorities there. Canadian privacy law does not prohibit all cross-border processing, but Bunny Riot remains accountable for information under its control and uses contractual or other measures intended to provide an appropriate level of protection.
3. 20.3
   You may contact our Privacy Officer for additional information about material cross-border service-provider practices relevant to your information, subject to security, confidentiality, and legal limitations.

21. Access, Correction, and Privacy Requests

1. 21.1
   Subject to legal exceptions, you may ask Bunny Riot to:

   • •confirm whether we hold personal information about you;
   • •provide access to that information and an account of how it has been used or disclosed;
   • •correct information that is inaccurate or incomplete;
   • •explain the purposes for which information is handled;
   • •withdraw consent for optional future processing;
   • •delete information that is no longer justified, subject to legal and operational limits;
   • •stop marketing communications; or
   • •address another privacy concern or right available under applicable law.
2. 21.2
   Submit a request to privacy@thebunnyriot.com. Describe the information or account involved and the action requested. We may need to verify identity and authority before responding. Do not email a copy of government identification unless we specifically request a secure verification method.
3. 21.3
   We will respond within the time required by applicable law. We may ask for clarification, provide information in a generally understandable form, charge a permitted minimal fee after advance notice, or refuse access where a legal exception applies. If we refuse all or part of a request, we will explain the reason where legally permitted and identify available complaint options.
4. 21.4
   Information controlled independently by a Partner, Seller, Stripe, Google, or another third party may require a request directly to that party. We will provide reasonable assistance where Bunny Riot controls or can retrieve the relevant information.

22. Withdrawing Consent and Managing Choices

1. 22.1
   You may withdraw consent for optional future processing by contacting us or using available account, browser, device, cookie, communication, or provider controls. Withdrawal does not invalidate processing that lawfully occurred before it took effect.
2. 22.2
   You can manage precise location through browser or operating-system permissions. You may need to clear a saved permission and reload the Events page. Denying location may limit nearby-Event and related map functionality.
3. 22.3
   You can unsubscribe from marketing as described in Section 13. We may retain an email address or telephone number on a suppression list to honour the request.
4. 22.4
   You can block or clear cookies and local storage through browser settings, but some Services may stop working. Blocking Bunny Riot storage may not block cookies, logs, or processing performed independently by Google, Stripe, or another provider.
5. 22.5
   You may request account closure. We will delete or de-identify information that no longer needs to be retained, but account closure does not require deletion of transaction, tax, payout, fraud, safety, dispute, legal, backup, or suppression records that we remain entitled or required to keep.

23. Minors and Guardian-Managed Attendance

1. 23.1
   Bunny Riot accounts are intended for persons aged 18 or older. We do not knowingly permit a minor to create and independently control an account.
2. 23.2
   A minor may attend an eligible Event with a parent or legal guardian where the Organizer permits it and applicable age, alcohol, venue, and safety rules are satisfied. A Buyer or guardian may provide the minor's name, Ticket information, age or eligibility information, accommodation information, and emergency or attendance details reasonably needed for that Event.
3. 23.3
   The adult providing a minor's information must be authorized to do so and is responsible for reviewing this Policy and Event-specific notices. We will use the minor's information only for appropriate Event, safety, legal, support, and recordkeeping purposes and will apply safeguards appropriate to its sensitivity.
4. 23.4
   If we learn that a minor created an account or that personal information about a minor was collected without appropriate authority, we may suspend the account and delete or restrict the information, subject to safety, legal, and recordkeeping requirements. Contact privacy@thebunnyriot.com with a concern.

24. Third-Party Services and Links

1. 24.1
   The Services may contain links to or integrations with third-party websites, venues, social networks, payment services, mapping services, shipping services, or other products. A third party's handling of information it controls is governed by its own privacy policy and terms.
2. 24.2
   Review the privacy information and settings of Google, Stripe, PostHog, an Organizer, Seller, venue, shipping carrier, or other third party before providing information directly to it. Bunny Riot is not responsible for an independent third party's privacy practices, except to the extent Bunny Riot has a non-excludable legal responsibility or failed to meet its own obligations in selecting or managing a provider.

25. Changes to This Policy

1. 25.1
   We may update this Policy to reflect changes in the Services, providers, law, or privacy practices. The current version will be posted at thebunnyriot.com/privacypolicy with a revised effective date.
2. 25.2
   If a change is material, we will provide additional notice appropriate to the circumstances, such as an account, email, dashboard, checkout, or website notice. If applicable law requires consent for a new collection, use, or disclosure, we will seek it before that activity begins.
3. 25.3
   This Policy replaces the March 2026 Privacy Policy when the updated version takes effect. Previous processing remains governed by the law and notices applicable when it occurred, subject to any lawful continuing use described in the updated Policy.

26. Contact, Questions, and Complaints