Privacy notice.

Effective October 27, 2026. This is a draft policy for The Box’s proposed Surrey venue. The owner must have it reviewed, identify the legal operating entity and privacy officer, and provide a direct privacy contact before a public launch.

What we collect and why

We collect your name, email, international phone number, preferred contact method, requested activity and time, guest count, and any notes to review and respond to your inquiry or booking interest. Municipality helps understand broad demand. Recurring and league inquiries may also collect preferred weekdays, times, group sizes, duration, weeks, price range and format. Do not include sensitive information in notes.

Pre-launch requests

Interest requests are non-binding and are not confirmed reservations. We use these records to evaluate demand. We do not collect payments or precise home addresses.

Your choices

Processing consent is required to handle a request. Marketing and WhatsApp consents are separate and optional. Refusing analytics does not prevent a request. Early-access signup is voluntary. Withdraw marketing consent, request access/correction/deletion, or make a privacy inquiry using the contact form. Select “privacy request” in your message and verify ownership of the email address. We will verify identity before disclosing or deleting records.

Analytics

Google Analytics loads only after you allow optional analytics cookies. It measures page views, engagement and booking interest steps. We do not send names, emails, phone numbers, form text or private status links to Google Analytics. Change your choice at any time using Cookie preferences. See the optional analytics details below.

Service providers and transfers

The public website and booking interest records are hosted using Cloudflare Workers and D1. If you allow analytics, Google Analytics processes usage information. Providers may process data outside Canada. This website does not currently send automated email or WhatsApp confirmations.

Retention and security

Saved booking requests can be reopened in the same browser using an essential protected cookie lasting up to 30 days. This cookie expiry does not delete the underlying request. Contact us about access or deletion of submitted information. HTTPS, private request access and database access controls help protect your information.

Canadian review

The owner should obtain professional advice on British Columbia’s Personal Information Protection Act, any applicable PIPEDA requirements, Canada’s Anti-Spam Legislation, cross-border processing, children’s data, record retention, and the final consent and unsubscribe process. This draft is not legal advice.