Privacy Policy

Drew Weatherhead ("Bouken," "we," "us," or "our"), based in Alberta, Canada, operates the Bouken Jiu-Jitsu Escape Camp website at boukenjj.com. For EU/EEA and UK residents, the Data Controller is: Drew Weatherhead, Alberta, Canada. Contact: contact@boukenjj.com. This Privacy Policy explains how we collect, use, store, disclose, and protect personal information in connection with the Bouken Jiu-Jitsu Escape Camp (the "Camp") and this website. It covers visitors worldwide and specifically addresses your rights under: - Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Anti-Spam Legislation (CASL); - EU/EEA General Data Protection Regulation (GDPR) and UK GDPR (collectively "GDPR"); - California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

We collect personal information in two ways: 2a. Booking and payment information When you click the PayPal payment button to reserve a Camp spot, PayPal collects your name, email address, billing address, and payment details directly on their platform. We receive from PayPal: confirmation of payment, the email address on your PayPal account, and your name as it appears in the transaction. We do not receive or store credit card numbers or full banking details on our own servers. 2b. Direct correspondence If you email us at contact@boukenjj.com with questions, your name, email address, and the contents of your message are collected and retained for the purpose of responding to you and administering your participation in the Camp. Note: There is no newsletter or mailing-list signup form on this site. We do not collect email addresses for marketing purposes.

- To confirm your Camp reservation and communicate essential logistics before, during, and after the Camp (e.g., itinerary updates, packing lists, safety information). - To respond to pre-booking enquiries you send by email. - To comply with applicable legal obligations (e.g., tax records, safety requirements). - To protect the safety of all participants and resolve disputes. We do not use your personal information for targeted advertising, profiling, or automated decision-making.

Under PIPEDA, we collect and use personal information only with your knowledge and consent, or as otherwise permitted by law. For EU/EEA and UK residents, our legal bases under GDPR Article 6 are: - Contract (Art. 6(1)(b)): Processing your booking information is necessary to perform the contract between you and us (i.e., your Camp reservation). - Legitimate interests (Art. 6(1)(f)): Retaining correspondence records and managing Camp safety and logistics, where our interests are not overridden by your rights. - Legal obligation (Art. 6(1)(c)): Retaining records required by Canadian tax or regulatory law. Where we rely on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

We send only transactional and administrative emails directly related to your Camp booking (e.g., booking confirmation, logistics updates, pre-camp information). These communications are not commercial electronic messages requiring express consent under CASL because they relate to the existing business relationship created by your booking. We do not send newsletters, promotional emails, or marketing messages.

We share your personal information only with the following third-party processors, strictly as necessary to operate the site and Camp: PayPal Holdings, Inc. (payments) — When you complete a booking, your payment data is processed and stored by PayPal under their own Privacy Policy and User Agreement. We act as a merchant receiving payment confirmation; PayPal acts as a separate data controller for payment processing. PayPal is based in the United States. For EU/UK residents, please see Section 7 (International Transfers). Vercel, Inc. (website hosting and analytics) — This site is hosted on Vercel's infrastructure. Your IP address, browser type, and page-request metadata may be logged by Vercel's servers as part of normal web hosting. We also use Vercel Web Analytics, a privacy-focused, cookieless analytics service that records anonymized, aggregate usage statistics (see Section 8). Vercel is based in the United States. We do not sell, rent, lease, or trade your personal information to any other third parties for their own purposes.

If you are located in the EU, EEA, or UK, your personal information may be transferred to and processed in countries outside your jurisdiction, including the United States (PayPal, Vercel) and Canada. Canada has been recognized by the European Commission as providing adequate protection for personal data under PIPEDA, which covers data transferred to Canadian organisations subject to PIPEDA. For data transferred to US-based processors (PayPal, Vercel), we rely on appropriate safeguards, including standard contractual clauses or other legally recognized transfer mechanisms under GDPR Chapter V. You may request information about the safeguards we use for international transfers by contacting us at contact@boukenjj.com.

This website does not use tracking cookies, advertising pixels, or fingerprinting technologies. We do not use Google Analytics, Meta Pixel, or any advertising or cross-site tracking service. We use Vercel Web Analytics to understand how the site is used. It is cookieless and does not track visitors across sites or sessions: it records anonymized, aggregate data such as pages viewed, referrer, country, device and browser type, and anonymous page-performance timings (Vercel Speed Insights). Visitor identifiers are anonymized by Vercel and no profile of you is built or stored by us. When you click the PayPal payment button, you interact with PayPal's hosted checkout, which may set cookies in accordance with PayPal's Cookie Policy. Those cookies are governed by PayPal, not by us. Because we set no cookies of our own and our analytics are cookieless, we do not display a cookie consent banner. If we add advertising or other cookie-based tools in the future, we will implement an appropriate consent mechanism and update this policy.

This section applies to California residents. Categories of personal information collected: - Identifiers: name, email address (received via PayPal booking confirmation or direct email). - Commercial information: transaction records (payment amount, booking date) received from PayPal. - Internet/network activity: IP address and browser metadata logged by our hosting provider (Vercel), and anonymized, aggregate usage statistics (pages viewed) collected via cookieless Vercel Web Analytics. Sources: directly from you via PayPal checkout or email; from Vercel as a byproduct of hosting and analytics. Business purpose: Camp administration, legal compliance, and safety. We do NOT sell or share your personal information with third parties for cross-context behavioral advertising or for monetary consideration. PayPal and Vercel are service providers under CCPA. Your CCPA/CPRA rights: - Right to know what personal information we have collected, used, or disclosed. - Right to delete your personal information, subject to exceptions. - Right to correct inaccurate personal information. - Right to opt out of sale/sharing: we do not sell or share your information, so no opt-out is required. - Right to non-discrimination for exercising any of these rights. To exercise your rights, contact us at contact@boukenjj.com. We will respond within 45 days and will verify your identity before processing a request.

If you are located in the EU, EEA, or UK, you have the following rights under GDPR: - Right of access (Art. 15): confirmation of whether we process your data and a copy of it. - Right to rectification (Art. 16): correction of inaccurate or incomplete data. - Right to erasure (Art. 17): deletion of your data in certain circumstances. - Right to restriction of processing (Art. 18). - Right to data portability (Art. 20): receive your data in a structured, machine-readable format where processing is based on contract or consent. - Right to object (Art. 21) to processing based on legitimate interests. - Right to withdraw consent at any time, without affecting prior processing. - Right to lodge a complaint with your local supervisory authority (e.g., the Information Commissioner's Office in the UK, or your EU member-state authority). To exercise any of these rights, email contact@boukenjj.com. We will respond within one month (extendable by two further months for complex requests, with notice).

You have the right to: - Request access to the personal information we hold about you. - Request correction of inaccurate personal information. - Withdraw consent to the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions and reasonable notice). - File a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca. Because we are based in Alberta, Alberta's Personal Information Protection Act (PIPA) may also apply to some of our activities, and Alberta residents may contact the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca). To make an access or correction request, or to withdraw consent, contact us at contact@boukenjj.com.

We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by applicable law: - Booking and payment records: retained for the duration of your Camp participation and for a reasonable period thereafter to satisfy tax, legal, and safety obligations. - Email correspondence: retained until no longer necessary for Camp administration, then deleted. - Server logs (Vercel): retained in accordance with Vercel's data-retention practices. When personal information is no longer needed, we will delete or anonymize it.

We take reasonable and appropriate technical and organizational measures to protect personal information from unauthorized access, disclosure, alteration, or destruction. This website uses HTTPS encryption for all data in transit. Payment data (card numbers, billing details) is handled entirely by PayPal and is subject to their PCI-DSS-compliant security standards. We do not store payment card data on our own systems. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security. In the event of a data breach affecting your rights, we will notify you and the applicable authorities as required by law.

This website and the Bouken Camp are not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. Camp participation requires participants to be at least 18 years old at the time of the Camp. If you believe we have inadvertently collected information from a minor, please contact us at contact@boukenjj.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will post the updated policy on this page. For material changes, we will make reasonable efforts to notify registered participants by email. Continued use of this website or your Camp booking following any change constitutes your acceptance of the updated policy.

For any privacy-related questions, access requests, or to exercise any of your rights, please contact: Bouken Jiu-Jitsu Escape Camp Drew Weatherhead Alberta, Canada Email: contact@boukenjj.com