Privacy Policy

Lithos Climbing Community ("Lithos," "we," "us") is committed to protecting your personal information. This policy explains what we collect, why, and how we handle it — in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. What we collect

We only collect information that is necessary to operate our facility and serve you. This includes:

• Basic personal information: name, email address, phone number, and date of birth — collected when you sign a waiver, purchase a membership, or contact us.
• Payment information: processed by our PCI-compliant payment provider. We do not store credit card numbers or banking details on our systems.
• Youth and program information: for participants under 18 or in specific programs, we may collect emergency contact details, medical/allergen information, and guardian consent — only as needed for safety.
• Incident records: in the event of an injury or safety incident, we document what happened as required by Ontario's Occupational Health and Safety Act (OHSA).
• Website analytics: we may collect anonymized usage data (pages visited, browser type) to improve the website. No personally identifiable information is collected through analytics.

2. How we use your information

Your information is used to:

• Process memberships, day passes, and program registrations
• Communicate with you about your account, bookings, or inquiries
• Ensure the safety of participants (emergency contacts, medical info for youth programs)
• Comply with legal and regulatory requirements (incident reporting, tax records)
• Send you updates about events and programming — only if you've opted in

We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. How we protect your information

• Access control: personal data is accessible only to authorized staff on a need-to-know basis, using role-based permissions.
• Encryption: data is stored on encrypted cloud systems. We do not store personal data exports on personal devices.
• Transmission: sensitive information is never sent via plain email. We use approved secure forms and links, and redact information where possible.
• Payment security: all payment processing is handled by PCI-compliant third-party providers.
• Backups: data backups are managed by our service providers and verified regularly.

4. Data retention

We retain your information only as long as necessary for the purpose it was collected:

• Waivers: retained for the duration of your membership plus a defined post-membership period, as required for liability purposes.
• Incident reports: retained as required by OHSA and our insurance obligations.
• Membership records: retained for the duration of your membership and for a reasonable period afterward for tax and legal compliance.
• Program and event records: retained for the duration of the program/event, then securely deleted or archived.

When information is no longer needed, it is securely deleted or anonymized.

5. Breach response

In the unlikely event of a data breach, we will:

• Immediately contain the breach and assess its scope
• Notify affected individuals as required by PIPEDA
• Report the breach to the Office of the Privacy Commissioner of Canada if it poses a real risk of significant harm
• Take steps to prevent future incidents

6. Photography and media

We may photograph or film in public areas of the facility for promotional or operational purposes. Our media policy:

• No photography or filming in washrooms or change areas
• Close-up or identifiable images require consent
• Program registration forms include a photo consent option
• Event registration discloses when media will be present
• You may request removal of your image at any time — contact us and we will honour the request

Staff will intervene if any filming or photography on-site compromises safety or the privacy of others.

7. Your rights

Under PIPEDA, you have the right to:

• Know what personal information we hold about you
• Request correction of inaccurate information
• Withdraw consent for the collection or use of your information (subject to legal requirements)
• Request deletion of your data, where not required for legal or safety compliance

To exercise any of these rights, contact us using the details below.

8. Cookies and website tracking

This website uses minimal cookies for essential functionality (e.g., embedded maps, calendar). We do not use advertising cookies or cross-site tracking. If we introduce analytics in the future, it will be anonymized and you will be notified.

9. Contact us

If you have questions about this policy or want to exercise your privacy rights:

10. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated "last updated" date. Continued use of our services after changes constitutes acceptance of the revised policy.