Effective 25 September 2026.
1. The Club, and agreement to this policy
The Griffons Den is a private tabletop-gaming club at 920 Hillside Ave, Unit 202, Victoria, British Columbia. In this policy, "the Club" means The Griffons Den and its owner, and "you" means anyone whose personal information the Club handles: members, Seat Holders, parents and guardians, people who book a one-shot or rent a room, newsletter subscribers, Game Masters, visitors to the premises, and visitors to griffonsden.com and the members app.
Agreement. By using griffonsden.com or the members app, creating an account, booking, subscribing, or attending the Club's premises, you consent to the collection, use and disclosure of your personal information as described in this policy. If you do not agree, do not use the Club's services or attend the premises. This policy forms part of, and should be read with, the Club's Membership Terms. If they conflict about personal information, this policy governs.
Privacy Officer. The Club's Privacy Officer is responsible for its compliance with privacy law. Contact: TheGriffonsDen@gmail.com, or by mail at the address above, marked "Privacy Officer".
The law the Club follows. The Club is a private organization in British Columbia, and its handling of personal information is governed by British Columbia's Personal Information Protection Act (PIPA). Nothing in this policy limits a right you have under PIPA that cannot lawfully be limited.
What this policy covers. Personal information the Club collects through griffonsden.com, the members app, email, and at the Club's premises. It does not cover information you make public yourself, or any website, app or service run by someone else, including those the Club links to or uses; their own policies apply to them.
2. What the Club collects and why
| What | Why |
|---|---|
| Your name, email address and phone number | To create and run your account, sign you in, and send the notices your membership requires |
| Seat Holder names, and the ages or age groups of players where a game has participant rules | To seat people at the right table and apply each game's rules |
| Your seats, bookings, attendance and waitlist places | To hold your seat, run the schedule, and pay Game Masters |
| Payment records: charges, dates, refunds and credits | To bill you, keep accounting and tax records, and collect amounts owed |
| Card or bank details | These go directly to the Club's payment processor (Section 4). The Club does not store full card or bank account numbers |
| Your signatures and acceptance of the Club's Terms, rules and agreements | To record and enforce the contract between you and the Club |
| What you post or upload: forum posts, log entries, character profiles, images | To run the features you choose to use |
| Game Master details: contact details, profile, sessions and pay | To contract with and pay Game Masters |
| Technical information: browser and device type, pages requested, sign-in times, connection address | To keep the site working and secure, and to prevent fraud and abuse |
| Video, photographs and recordings made at the premises | Security, safety, incident investigation, and promotion of the Club (Section 3.4) |
Other purposes. The Club may also use personal information to operate, improve and promote the Club; to enforce its Terms, Code of Conduct and Forum Rules; to collect amounts owed; to establish, exercise or defend legal claims; to deal with its insurers and professional advisers; and to comply with the law. The Club will not use it for a purpose a reasonable person would not consider appropriate in the circumstances.
Children and Seat Holders. Where you give the Club information about another person, including a Seat Holder or a child, you confirm that you are authorized to do so and to consent on their behalf, and that you have told them how the Club will use it. The Club collects a child's personal information only through their parent or guardian, who holds the account, is responsible for it, and may exercise the rights in Section 6 on the child's behalf. A person under 19 may not open an account.
Accuracy. You are responsible for keeping the information you give the Club accurate and up to date. Most of it you can update yourself on your dashboard.
3. Consent and how the Club uses your information
3.1 Consent. You consent as set out in Section 1. You may withdraw consent by written notice to the Privacy Officer, on reasonable notice. Withdrawal takes effect only going forward: it does not affect anything collected, used, disclosed or published before it, or any use the law permits or requires without consent, or any use needed to perform or enforce a contract with you. If you withdraw consent to information the Club needs to provide a service, the Club may end that service.
3.2 Email. Service notices are the messages your membership or booking needs: sign-in codes and links, confirmations, schedule changes, billing and renewal notices, and changes to the Club's Terms or this policy. You receive these while you have an account or booking. Marketing email, including the Club's newsletter, is sent only if you have opted in, and every marketing email carries an unsubscribe link.
3.3 What you post. You are responsible for what you post or upload. Do not post anyone else's personal information without their permission. What you post in a forum, log or profile is visible to the audience that feature has, and the Club is not responsible for what other members do with it. The Club may keep, moderate, or remove any post, and posts may remain in a conversation after your account closes.
3.4 Security cameras, photographs and recordings. The premises are under video surveillance. Entering the premises is a condition of consent to being recorded. The Club keeps footage for as long as it considers necessary, and may use and disclose it for security, safety, incident investigation, enforcement of its rules, claims, and to insurers, law enforcement and courts. The Club also photographs, films and records at its premises, and may use and publish that material to operate and promote the Club, as set out in Section 17.8 of the Membership Terms. You may ask the Privacy Officer that your image not be used in new promotional material; the Club will consider the request as far as the law requires, but it does not apply to material already published, printed or distributed, or to security recordings.
3.5 Cookies and your device. The site uses an essential cookie to keep you signed in, lasting up to a year and renewing while you use the site, and stores small preferences on your device. If you block them, parts of the site may not work. The Club does not use advertising cookies or analytics services.
3.6 The installed app and notifications. Installing the members app is optional. If you turn on notifications on a device, they are delivered through that device's push service (for example Apple, Google or Mozilla), which receives a device identifier and the notification text under its own terms. You can turn notifications off at any time.
3.7 The map. The Club's pages show a Google map of its location. Loading it sends your connection's address and browser details to Google, whose privacy policy applies.
4. Who handles your information, and where
The Club does not sell your personal information. It shares it with service providers who help run the Club, currently including:
| Provider | What it does for the Club | Where the information is held |
|---|---|---|
| Canadian Web Hosting | Hosts griffonsden.com, the members app and its database | Canada |
| Stripe | Processes payments and holds payment details | United States and other countries |
| Maileroo | Delivers the emails the site sends | Australia |
| HubSpot | Keeps contact records | United States |
| Runs the Club's email inbox and the map on the Club's pages | United States and other countries | |
| eazyBackup | Stores encrypted backups | Canada |
The Club may change or add providers without notice. Each provider handles information under its own terms and policies. The Club chooses providers with care, and is not responsible for their acts or omissions except as the law requires.
Outside Canada. Information held outside Canada is subject to the laws of that country, and may be accessed by its courts, law enforcement and national security authorities. It is the Club's goal to move all data to sovereign service providers in Canada, but it cannot do so until comparable Canadian providers offer equivalent services.
Other disclosures. The Club may also disclose personal information: to its professional advisers, insurers, lenders and auditors; to the Canada Revenue Agency and other government bodies as required; to law enforcement, courts, tribunals and parties to legal proceedings, where the law requires or permits it or to establish, exercise or defend a legal claim; to protect the safety, rights or property of any person or of the Club; and to a buyer, successor or assignee of all or part of the Club, who may use it for the purposes in this policy.
5. Retention, security and limits of responsibility
Retention. The Club keeps personal information for as long as it is reasonably needed for the purposes in this policy, including legal, accounting, tax and reporting requirements and the resolution of disputes and claims, and then destroys it or makes it anonymous. Where the Club uses personal information to make a decision that directly affects you, it keeps that information for at least one year after the decision, as PIPA requires.
Security. The Club makes reasonable security arrangements to protect personal information in its custody or control against unauthorized access, collection, use, disclosure, copying, modification or disposal, as PIPA requires. No system is completely secure, and the Club does not guarantee that information will never be accessed, lost or disclosed without authorization. You are responsible for keeping your own devices and email account secure, since access to them gives access to your account.
Limits of responsibility. To the fullest extent permitted by law, the Club is not liable for any loss or damage arising from unauthorized access to or use of personal information, from the acts or omissions of service providers or other members, or from information you choose to post or share, except where caused by the Club's own breach of PIPA.
Breaches. If a breach of security involving your personal information creates a real risk of significant harm to you, the Club will notify you and any regulator as and when the law requires.
6. Your rights
Access and correction. You may ask for access to your personal information in the Club's custody or control, information about how it has been used, and the names of those to whom it has been disclosed, and you may ask the Club to correct an error or omission in it. Requests must be in writing to the Privacy Officer, with enough detail to identify the information, and the Club will verify your identity before responding. The Club responds within the time PIPA allows. The Club may charge a minimal fee for access, which it will tell you in advance, and may refuse access or correction where PIPA permits or requires, telling you why. If the Club does not make a correction you ask for, it will note on the information that the correction was requested.
Complaints. Please raise any concern with the Privacy Officer first, in writing, and the Club will respond. If you are not satisfied, you may complain to the Office of the Information and Privacy Commissioner for British Columbia.
7. Changes and general
Changes. The Club may change this policy at any time by posting the new version at griffonsden.com/privacy. Changes take effect when posted. The Club will give notice of a material change by email or on the site. Your continued use of the Club's services or attendance at the premises after a change means you accept it.
General. This policy is governed by the laws of British Columbia and applicable federal law. If any part of it is found invalid or unenforceable, the rest continues in effect. Headings are for convenience only.