Privacy Policy

11. Canadian users (PIPEDA)

This section applies to individuals in Canada and to Customers operating venues in Canada.

PIPEDA compliance

Particle Storm processes personal information in accordance with the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including British Columbia's Personal Information Protection Act, Alberta's Personal Information Protection Act, and Quebec's Act respecting the protection of personal information in the private sector (Law 25).

Our privacy officer

Our designated privacy officer for purposes of PIPEDA and provincial privacy legislation is Paul Baillie. You may contact the privacy officer at privacy@shiftarcade.com regarding any privacy matter, including complaints, access requests, and questions about cross-border processing.

Cross-border processing: important disclosure

Personal information of Canadian individuals is transferred to and processed in the United States. While we apply contractual and technical safeguards comparable to those required by PIPEDA, you should understand that personal information processed in the United States may be subject to US laws and lawful access requests by US government authorities (including, where applicable, requests under the CLOUD Act and similar regimes). This may differ from the legal regime that would apply if the information were processed exclusively in Canada. By using ShiftOS, you consent to this cross-border processing.

Your rights under PIPEDA

• You have the right to access your personal information and to challenge its accuracy.
• You have the right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca if you believe your rights have not been respected.
• Quebec residents additionally have rights under Law 25, including data portability and (in some cases) the right to deindexing. Quebec residents should contact our privacy officer for assistance.

Quebec residents: special note

If you are located in Quebec, please contact our privacy officer before using ShiftOS in a Quebec-based venue. Quebec's Law 25 imposes additional obligations on cross-border transfers (including a privacy impact assessment) that we will work with the venue to satisfy. We may require additional contractual provisions for Quebec deployments.

Breach notification

Where a breach of security safeguards involving personal information of Canadian individuals occurs and presents a real risk of significant harm, we will notify the affected Customer without undue delay (and in any event within 48 hours of confirmation), enabling the Customer to meet its notification obligations to the Office of the Privacy Commissioner of Canada and affected individuals.

12. European Economic Area & UK users (GDPR)

This section applies to individuals located in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland, and to Customers operating venues in those jurisdictions.

Our role

With respect to information about Customer staff and authorized users (the people who log into ShiftOps to administer a venue), Particle Storm acts as an independent controller. With respect to end-user (racer, member, attendee) personal information that a Customer collects and processes through ShiftOS, Particle Storm acts as a processor on behalf of the Customer, which is the controller. The Customer is responsible for the lawfulness of the processing instructions it gives us, including the lawful basis on which it relies to collect end-user data.

Lawful bases on which we rely

• Performance of a contract (Article 6(1)(b)): to provide ShiftOS to our Customers and to maintain the accounts of authorized users.
• Legitimate interests (Article 6(1)(f)): for security, fraud prevention, service-improvement using aggregated and de-identified information, and limited direct communications with Customer contacts about the service.
• Legal obligation (Article 6(1)(c)): to comply with tax, accounting, and law-enforcement obligations.
• Consent (Article 6(1)(a)): where required (for example, certain cookies or optional marketing communications). Consent can be withdrawn at any time.

International data transfers

Personal data of EEA, UK, and Swiss individuals is transferred to the United States and other jurisdictions outside the EEA/UK where we or our Sub-processors operate. We rely on the following transfer mechanisms:

• The European Commission's Standard Contractual Clauses (Module appropriate to the relationship, controller-to-processor or processor-to-sub-processor) for EEA-origin transfers, supplemented where appropriate by technical and organizational safeguards.
• The UK International Data Transfer Addendum (UK IDTA) to the EU SCCs for UK-origin transfers.
• The EU–US Data Privacy Framework, UK Extension, and Swiss–US Data Privacy Framework where a particular Sub-processor is self-certified to those frameworks (see the Sub-processors page for the per-Sub-processor transfer mechanism).

Your rights under the GDPR

If you are in the EEA, UK, or Switzerland you have the following rights, subject to the conditions set out in the GDPR / UK GDPR:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure / "right to be forgotten" (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object to processing based on legitimate interests (Article 21)
• Right not to be subject to a decision based solely on automated processing, including profiling (Article 22). We do not currently make such decisions
• Right to withdraw consent at any time where processing is based on consent
• Right to lodge a complaint with a supervisory authority. For the UK, the Information Commissioner's Office (ico.org.uk); for EEA residents, your national data protection authority

End-users (racers, members) should typically exercise these rights through the Customer (the venue) that collected the data, because the Customer is the controller. We will support the Customer in fulfilling your request. To exercise any right directly with Particle Storm in respect of Customer-staff data, contact privacy@shiftarcade.com.

Breach notification

Where a personal data breach (as defined in Article 4(12) of the GDPR) involving Customer Personal Data occurs, we will notify the affected Customer without undue delay (and in any event within 48 hours of confirmation), providing the information the Customer reasonably requires to meet its own notification obligations to its supervisory authority and to affected data subjects.

13. California residents (CCPA / CPRA)

This section applies to California residents and supplements the rest of this policy. It is provided to comply with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of personal information we collect

In the preceding 12 months we have collected the following categories of personal information (as defined in California Civil Code §1798.140):

• Identifiers: name, email, phone, account username, IP address
• Customer records (Cal. Civ. Code §1798.80(e)): billing name, billing address, GST/HST registration number where applicable
• Commercial information: records of services purchased and used, membership status, race credits
• Internet and network activity information: login events, device and browser information, security and audit logs
• Geolocation data: approximate location derived from IP address (we do not collect precise device geolocation)
• Professional information: role and employment status at the Customer venue (for staff accounts)
• Inferences: limited inferences drawn from racing performance (for leaderboards and league standings)

We do not knowingly collect "sensitive personal information" as defined under the CPRA, and we do not use any personal information for the purposes of inferring characteristics about a consumer.

Purposes of collection

We use these categories for the business purposes described in Section 4 of this policy: providing the service, billing, support, security, service improvement (aggregated and de-identified for end-user data), and legal compliance.

Sale and sharing of personal information

Particle Storm does not "sell" personal information and does not "share" personal information for cross-context behavioral advertising, as those terms are defined under the CCPA / CPRA. We have not sold or shared personal information in the preceding 12 months and have no plans to do so. Disclosures we make to the Sub-processors listed at shiftos.app/sub-processors are made under contractual restrictions consistent with the "service provider" definition in Cal. Civ. Code §1798.140(ag).

Retention

We retain each category of personal information for no longer than reasonably necessary for the purposes described in Section 8 of this policy, taking into account our contractual obligations to Customers and our legal-retention obligations.

Your rights under the CCPA / CPRA

If you are a California resident you have the right to:

• Know what personal information we collect, use, disclose, sell, and share
• Access the specific pieces of personal information we hold about you
• Request deletion of your personal information, subject to legal exceptions
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information, although as noted we do not sell or share
• Limit the use and disclosure of sensitive personal information, although as noted, we do not collect sensitive personal information for these purposes
• Be free from retaliation or discrimination for exercising any of these rights

How to exercise your rights

To submit a request, email privacy@shiftarcade.com with "California Privacy Rights Request" in the subject line. We will verify your identity by matching information you provide against information we already hold. You may designate an authorized agent to make a request on your behalf; we will require written proof of the agent's authority and may still need to verify your identity directly.

End-users (racers, members) of a California venue should typically submit requests to that venue first, as the venue is the business that collected the data and Particle Storm acts as its service provider.

"Shine the Light"

California Civil Code §1798.83 permits California residents who have an established business relationship with us to request information about our disclosure of personal information to third parties for those third parties' direct-marketing purposes. We do not disclose personal information to third parties for their direct-marketing purposes, so we have no information to provide in response to such a request.