Privacy Policy

We collect only what we need to quote, issue and administer a policy:

• Identity and contact: first and last name or registered business name, email address, phone number (vendor quotes).
• Location: home province, business province, event or vendor venue address, and billing address.
• Risk information: event type, dates and duration, expected attendance, whether alcohol is served, booth size and food handling (vendor), coverage limits selected, acknowledgement of excluded activities, and any prior-claims disclosure.
• Policy records: quote and policy numbers, premium, discounts and tax, additional insureds named on the certificate, certificates of insurance issued, and cancellation records.
• Claims: incident date, location and description, and your claim contact details, if you submit a claim.
• Account: your customer portal login, name, and whether multi-factor authentication is enabled.
• Marketing list: if you join our waitlist, your email address, whether you identify as a partner or customer, and your consent choices.
• Technical and usage: a randomly generated browser session identifier, pages viewed and quote steps completed, and the page address. We do not use advertising trackers or third-party marketing cookies.

We do not collect your date of birth, Social Insurance Number, driver's licence, health information, or credit history, and we do not run credit or identity checks. We never receive or store your full card number: payment card details are entered into and processed by our payment processor. Only the card brand and the last four digits are retained with your receipt.

To provide you with a quote, to underwrite and issue a policy, to produce and deliver your certificate of insurance to you and to any venue or organizer you name as an additional insured, to collect payment and applicable provincial tax, to administer claims and cancellations, to answer your questions, to meet legal and regulatory obligations, and to detect and prevent fraud or misuse. We use aggregate usage data to improve the quote experience. We use your email for marketing only if you asked us to.

You give consent by providing your information and continuing through the quote. Certificates, policy documents, payment receipts and claims correspondence are transactional messages required to service your policy and are not marketing. Marketing and newsletter emails require separate opt-in consent, which you can withdraw at any time using the unsubscribe link in the email or by writing to us. Withdrawing marketing consent does not affect your coverage.

• Insurers and their agents that underwrite the coverage you purchase, and their reinsurers, for underwriting, policy administration and claims handling.
• Venues, organizers and market operators you name as additional insureds — they receive the certificate of insurance, which shows the named insured, coverage limits and dates.
• Our payment processor, which handles card data directly.
• Our email delivery provider, to send quotes, certificates and account emails.
• Canada Post APIs, which provide accurate addresses.
• Authorities or advisors where required by law, or to establish or defend legal claims.

We do not sell your personal information and we do not rent or trade our mailing list.

Our service providers may process or store data outside Canada, including in the United States. While it is in another country, it may be accessible to the courts and authorities of that country under their laws. We contract with providers that offer comparable protection to what is required here. You may contact us for information about our practices in this area.

• Purchased policies, certificates, payment records and claims: kept for the insurance record-keeping period required by law and by our insurer partners — a minimum of seven years after the policy expires or the claim closes.
• Quotes that were never purchased: deleted after 180 days.
• Usage and quote-step analytics: deleted after 12 months.
• Consent records: kept 3 years as evidence of consent.
• Waitlist records: deleted within 30 days of unsubscribing.

Data is encrypted in transit and at rest. Access to customer records is restricted by role — most staff accounts cannot read policyholder data at all — and every database table enforces row-level access rules so a customer can only ever see their own records. Certificates are stored in a private bucket and released only through an authorized link. Customer portal accounts support multi-factor authentication. Changes of policy ownership and document acknowledgements are logged.

You may ask us for a copy of the personal information we hold about you, ask us to correct it, withdraw your consent to marketing, or ask us to delete information we are not required to keep. Write to privacy@eventsure.ca. We respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or to your provincial commissioner in Alberta or British Columbia.

We maintain a breach response procedure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as soon as feasible, notify our insurer partners, and keep a record of the incident.

Our Privacy Officer is accountable for compliance with this policy and can be reached at privacy@eventsure.ca. We will post any change to this policy on this page with a new effective date.