1. Who we are and the scope of this policy

The String Space is a music education program in Ottawa, Ontario. In this policy, “The String Space,” “we,” “us,” and “our” refer to the operator of The String Space and www.thestringspace.com.

This policy covers personal information collected through the website and the online services linked or embedded in it. It does not govern independent websites or services that we do not control.

2. What is personal information?

Personal information is information about an identifiable individual. It may include a person’s name, contact details, age, account or registration information, payment-related information, communications, and online identifiers such as an IP address or cookie identifier. Information that has been aggregated or de-identified so that it cannot reasonably identify an individual is not treated as personal information under this policy.

3. Information we collect

Information you or a parent/guardian provides

Depending on how you use the website and our registration tools, we may collect:

• contact information, such as a parent’s, guardian’s, or adult student’s name, email address, telephone number, and mailing address;
• student information, such as name, age or date of birth, instrument, musical experience, level, program interests, scheduling preferences, and other details needed to respond to an inquiry or arrange instruction;
• registration and membership information, such as household details, selected programs, attendance or booking information, signed agreements, and account credentials;
• payment and transaction information needed to process fees or maintain a membership. Full payment-card details are generally collected and processed by our payment or registration provider rather than stored directly by us;
• communications and feedback you send to us; and
• any other information you choose to provide through a form, email, telephone call, or other interaction.

Information collected automatically

When you visit the website, we and our service providers may automatically collect technical and usage information, including your IP address, approximate location derived from the IP address, browser and device type, operating system, referring page, pages viewed, links or buttons used, date and time of access, and advertising or analytics identifiers. We use cookies, tags, pixels, scripts, and similar technologies for these purposes.

Information from service providers

We may receive information from providers that support registration, scheduling, payments, website hosting, analytics, communications, and advertising. For example, Zen Planner may provide us with inquiry, registration, membership, scheduling, or payment-status information submitted through its embedded tools.

4. How we use personal information

We may use personal information to:

• respond to inquiries and recommend suitable programs or next steps;
• register students, create and administer accounts or memberships, schedule lessons and classes, process fees, and deliver requested services;
• communicate about classes, schedules, events, payments, program changes, safety, and administration;
• send promotional messages where we have consent or another lawful basis, and manage unsubscribe requests;
• operate, secure, troubleshoot, and improve the website and our services;
• understand website use and measure advertising and campaign performance;
• detect and prevent fraud, misuse, and security incidents;
• keep appropriate business, accounting, consent, and transaction records; and
• meet legal, regulatory, insurance, and contractual obligations and protect our legal rights.

We will not use personal information for a new purpose that is materially different from the purposes described above without providing notice and obtaining consent where required.

5. Consent and choices

We seek meaningful consent for the collection, use, and disclosure of personal information, unless the law permits or requires otherwise. The appropriate form of consent depends on the sensitivity of the information and the reasonable expectations of the individual.

You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal may limit our ability to provide a requested service. To withdraw consent, contact us using the method in section 14.

6. Children and youth

Many of our programs are intended for children and youth. A parent or legal guardian should submit inquiries, registrations, and consents for a child who is not able to provide meaningful consent. We do not ask children under 13 to provide personal information directly without the involvement and consent of a parent or guardian, except in an exceptional circumstance permitted by law.

We limit the personal information we collect about children to what is reasonably needed for inquiries, enrolment, instruction, administration, safety, and legal obligations. We do not knowingly use children’s personal information for behavioural advertising. If you believe a child has submitted personal information without appropriate consent, please contact us so we can review and, where appropriate, delete it.

7. Cookies, analytics, advertising, and embedded services

The website currently uses or embeds the following services. These providers may process technical and usage information according to their own privacy notices and settings:

You can control cookies through your browser settings and any consent tool made available on the website. Blocking some technologies may affect website features. Google also provides advertising settings and a Google Analytics browser opt-out add-on. Choices made through a third-party provider are governed by that provider’s tools and policies.

8. When we disclose personal information

We may disclose personal information:

• to service providers that perform functions on our behalf, including website hosting, security, analytics, advertising measurement, registration, scheduling, communications, payment processing, accounting, and professional advice;
• to instructors, staff, contractors, or event partners where access is reasonably necessary to deliver or administer a program;
• with your consent or at your direction;
• when required or permitted by law, including to respond to lawful requests, prevent fraud or harm, or protect rights and safety; and
• in connection with a proposed or completed business transaction, subject to appropriate confidentiality and legal requirements.

We do not sell or rent personal information. We require service providers to use personal information only for authorized purposes and to protect it appropriately, subject to their role and applicable law.

9. Processing outside Canada

Some service providers, including Google, Cloudflare, and Zen Planner/Daxko, may process or store personal information outside Canada, including in the United States. While information is in another country, it may be subject to that country’s laws and may be accessible to courts, law-enforcement, or national-security authorities in accordance with those laws. We remain accountable for personal information transferred to service providers for processing on our behalf.

10. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, to maintain appropriate business and financial records, to resolve disputes, and to meet legal, regulatory, insurance, and contractual requirements. Retention periods vary by the type and sensitivity of information and the reason it was collected. When information is no longer required, we delete, destroy, or de-identify it using reasonable measures, subject to backup and archival cycles.

11. Safeguards

We use administrative, technical, and physical safeguards that are reasonable in light of the sensitivity, volume, format, and storage of the information. These may include access controls, staff or contractor confidentiality obligations, reputable service providers, secure transmission, backups, and procedures for responding to suspected privacy or security incidents. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Marketing communications

We may send commercial electronic messages only where permitted by Canada’s Anti-Spam Legislation or other applicable law. Promotional emails will identify the sender and include an unsubscribe mechanism. You may unsubscribe at any time by using the link in the message or contacting us. We may still send non-promotional messages that are necessary to administer an inquiry, registration, payment, lesson, class, event, or ongoing service.

13. Access, correction, complaints, and other rights

Subject to applicable law, you may ask to access personal information we hold about you, request a correction, withdraw consent, or ask a question or make a complaint about our privacy practices. We may need to verify your identity before completing a request. In limited circumstances, the law may permit or require us to refuse access; if so, we will explain the reason where legally permitted.

We will investigate privacy complaints and respond within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

14. Contact us

15. Changes to this policy

We may update this policy from time to time to reflect changes to our practices, services, providers, or legal requirements. We will post the updated version on the website and revise the effective or last-reviewed date above. If a change is material, we will provide additional notice where appropriate or required.