Privacy Policy

👋 1. Introduction

TinkerTrail STEM Academy ("TinkerTrail", "we", "us", or "our") operates https://tinkertrail.ca and provides STEM education programs including camps, workshops and learning paths for children in Mississauga, Ontario, Canada.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have. By using our website or registering for our programs, you agree to the practices described here.

We are committed to complying with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy laws.

📋 2. Information We Collect

2.1 Information you provide directly

When you register for a program, contact us, or use our website, we may collect:

• Parent or guardian name, email address, and phone number
• Child's name, date of birth, and age
• Emergency contact information
• Medical information and allergy disclosures relevant to participation
• Payment information (processed securely through third-party providers — we do not store card numbers)
• Photo and media consent preferences
• Messages and enquiries submitted via our contact form

2.2 Information collected automatically

When you visit our website, we automatically collect basic technical data including:

• IP address and approximate location (city/region level)
• Browser type and device information
• Pages visited and time spent on the site
• Referring website or search terms

This data is collected through cookies and standard web analytics tools. See the Cookies section for details.

2.3 Information we do not collect

• We do not collect Social Insurance Numbers, government IDs, or financial account details
• We do not collect information from children directly — all registration is completed by a parent or guardian
• We do not collect data through social media integrations without your explicit action

👧 3. Children's Privacy

• We do not knowingly collect personal information directly from children under 13. All registration and consent is handled by a parent or legal guardian.
• We collect only the minimum information about a child necessary to deliver our programs safely — name, age, and relevant medical/allergy information.
• We do not use children's personal information for marketing purposes.
• We do not share photos or videos of children without explicit written consent from a parent or guardian, obtained at registration.
• If you believe we have inadvertently collected information from a child without proper parental consent, please contact us immediately at hello@tinkertrail.ca and we will delete it promptly.

⚙️ 4. How We Use Your Information

We use the information we collect for the following purposes:

We will never use your information for any purpose not listed here without first obtaining your consent.

🤝 5. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information only in the following limited circumstances:

• Service providers: We use trusted third-party services to operate our business (payment processors, email platforms, event ticketing via The Events Calendar / WooCommerce). These providers are contractually bound to use your data only to provide their services to us.
• Legal requirements: We may disclose information if required by law, court order, or government authority.
• Safety: We may share information with emergency services or medical personnel if a child's safety is at risk.
• Business transfers: In the event TinkerTrail is sold or merged, personal information may be transferred to the new owner, subject to the same privacy protections.

Any third-party service providers we use are located in Canada or the United States and are subject to appropriate data protection agreements.

🍪 6. Cookies & Tracking

Our website uses cookies — small text files stored on your device — to make the site work and to understand how visitors use it.

You can control cookies through your browser settings or by declining non-essential cookies in the cookie consent banner when you first visit our site. Note that disabling cookies may affect some site functionality.

🗂️ 7. Data Retention

We keep your personal information only as long as necessary for the purposes it was collected:

• Registration and program records: Retained for 2 years after the last program attendance, then securely deleted
• Payment records: Retained for 7 years as required by Canadian tax law
• Medical and allergy information: Retained only for the duration of active program enrollment, then deleted
• Marketing email lists: Retained until you unsubscribe or request deletion
• Website analytics data: Aggregated and anonymised after 26 months
• Photos and videos (with consent): Retained until consent is withdrawn

When data is no longer needed, we securely delete or anonymise it.

⚖️ 8. Your Privacy Rights

Under PIPEDA and applicable Canadian privacy law, you have the right to:

• Access — Request a copy of the personal information we hold about you or your child
• Correction — Ask us to correct inaccurate or incomplete information
• Deletion — Request that we delete your personal information (subject to legal retention requirements)
• Withdrawal of consent — Withdraw consent for marketing emails or photo use at any time
• Complaint — Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

To exercise any of these rights, contact us using the details in Section 11. We will respond within 30 days.

🛡️ 9. How We Protect Your Information

We take the security of your information seriously and use reasonable administrative, technical, and physical safeguards including:

• SSL/TLS encryption for all data transmitted to and from our website
• Secure, password-protected access to registration and customer data
• Payment processing via PCI-DSS compliant third-party providers — we never store full card numbers
• Limited staff access to personal data on a need-to-know basis
• Regular review of our data practices and security measures

While we take every reasonable precaution, no method of electronic storage or transmission is 100% secure. In the unlikely event of a data breach affecting your rights, we will notify you and the relevant authorities as required by law.

🔄 10. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do:

• We will update the "Last updated" date at the top of this page
• For significant changes, we will notify registered families by email
• Continued use of our website or services after changes are posted constitutes acceptance of the updated policy

We encourage you to review this policy periodically.

📞 11. Contact Us

If you have any questions about this Privacy Policy, want to exercise your rights, or have a concern about how we handle your data, please contact us: