Privacy policy

SIMHUB RACE LOUNGE INC. | 1 SimHub Race Lounge Privacy Policy Version 1.7 | Effective date: October 22, 2026 Privacy at a glance SimHub Race Lounge Inc. uses personal information to provide our lounge and simulator experiences, website, App, memberships, sales, coaching and events. This summary highlights your choices; the sections that follow explain our practices and their limits. What we collect Information relevant to your interaction, such as contact details, transactions, account activity, waiver records and race results. Full dates of birth are collected only through participation waivers for people using our physical simulators, not as a routine league or App registration field. Your choices Optional marketing and promotional media permissions are separate from service participation. You can unsubscribe, withdraw consent where applicable, request access or corrections, and ask us to close an account or delete information. Some information must be retained for lawful purposes, as explained in section 11. Cameras and media Our lounge cameras managed through Provision CAM2 record video only, without audio. Our separate Ring doorbell records video and audio, including voices and sounds, and supports live visitor conversations. Event photography and promotional recordings are handled separately with appropriate notice and consent. Our providers We use providers for payments, waivers, hosting and communications. Shopify Network Intelligence is enabled; section 9 explains its use of customer information for enhanced services, personalization and advertising. Information may be processed outside Canada. SimHub does not control independent third-party websites or networks and, except as required by applicable law, is not responsible or liable for their privacy policies or practices. Review their applicable terms of use and privacy notices. Section 8 links provider privacy notices and explains our responsibilities for information processed on our behalf. How long we keep information We keep information for the purposes for which it is needed and applicable legal requirements. Some records must remain after account closure, including relevant financial, waiver, consent or dispute records. Contact our office SimHub Race Lounge Inc. Email: info@simhubracelounge.com (subject: Privacy Request) Telephone: (647) 528-7258 Mail: 5266 Solar Drive, Unit B107, Mississauga, Ontario L4W 0G7, Canada You do not need an App account to make a privacy request. SIMHUB RACE LOUNGE INC. | 2 Our services and the information we collect 1 Scope and responsibility SimHub Race Lounge Inc. ("SimHub", "we", "us" or "our") is responsible for personal information under its control. This policy covers our lounge, physical simulators, coaching, private and corporate events, mobile activations, equipment sales and delivery, memberships, competitions, website at simhubracelounge.com and App at app.simhubracelounge.com. Purchase, refund, membership and participation terms address separate matters. A waiver does not replace privacy consent or waive statutory privacy rights. This policy does not cover employee or applicant records. 2 Information and purposes We collect information reasonably necessary for identified purposes. The categories below apply only where relevant to the service you use. Personal information means information about an identifiable individual. Information Purpose and examples Accounts and contact Name, display name, email, phone number and authentication records to create accounts, communicate and provide support. Transactions and memberships Order, booking, billing, delivery, payment/refund references, membership status and benefit-redemption records to fulfil services, administer renewals and reconcile transactions. Payment providers process card details; Square handles App registration payments. Simulator waivers Participant name, date of birth, signature and relevant guardian details through SmartWaiver to identify the participant, establish age and guardian requirements, and document the simulator participation waiver. League participation Racing name, platform identifiers, entry type, age band or eligibility confirmation where needed, guardian approval records, accepted rules, results, replays, telemetry and incident reports to administer racing, coaching, disputes and prizes. Communications Inquiries, support requests, consent preferences, subscription status and privacy requests to respond and administer your choices. Technical information IP address, browser/device information, session identifiers, request/error logs and verification results to operate, troubleshoot and protect our services. Safety and media Relevant incident information you provide; video-only Provision camera footage; Ring doorbell video and audio; and separately authorized promotional media. Sections 6 and 7 explain recording and sharing. SIMHUB RACE LOUNGE INC. | 3 Sources, consent and young participants 3 Where information comes from We receive information from you, your use of our services, and providers handling transactions, waivers, accounts and communications. Parents, guardians, event organizers or corporate hosts may supply limited information needed to arrange participation. They should provide only information they are authorized to share and direct participants to this policy. Race information may come from iRacing, stewards, other participants and incident reports. Our Facebook and Instagram interactions, including messages, comments and promotional posts, are also handled by Meta under its Privacy Policy. This social-platform use is separate from website tracking integrations. 4 Meaningful consent We explain the information involved, purposes, relevant sharing and reasonably foreseeable significant privacy risks in a way suited to the interaction. We obtain consent unless the law permits or requires otherwise. We seek express consent where required by law; implied consent is used only where appropriate to the circumstances and reasonable expectations. Using our services or accepting this policy is not blanket permission for every use. We do not make optional processing a condition of service beyond what is necessary for legitimate, identified purposes. Marketing and promotional media permissions are separate. Our information sharing includes Shopify Network Intelligence as explained in sections 8 and 9; it is not limited to providers acting only on our instructions. Collection, use or disclosure without consent is limited to an applicable legal exception. You can withdraw consent, subject to legal or contractual restrictions and reasonable notice. We explain any resulting service limitations. For example, without necessary payment or eligibility information, we may be unable to complete a registration. Declining optional marketing does not prevent ordinary purchases or participation. 5 Children, age information and waivers Full dates of birth are collected only through participation waivers for people using our physical simulators, to establish participant identity, age and guardian requirements. They are not routine App or league registration fields. Outside the waiver, we use an age band or eligibility confirmation where needed, and avoid copying full birth dates into App profiles. We do not publish waiver birth dates or use them for marketing. We require parent or legal guardian approval for minors using physical simulators and for participants under 18 in our App league registration process. Participation approval, privacy consent and optional promotional permission serve separate purposes. Guardian and verification information is limited to what is needed to confirm authority and record the relevant approval. For children under 13, we obtain privacy consent from a parent or legal guardian except where an applicable legal exception permits otherwise. For older youth, we consider their capacity to understand the information and proposed use and provide age-appropriate explanations. Guardian approval does not automatically permit access to a capable young person’s private communications or records. We do not profile children for marketing or use their information for targeted or behavioural advertising. Identifiable promotional content involving minors requires separate express authorization appropriate to the child’s capacity and guardian authority. Contact our office if information was supplied without required consent so we can restrict its use and take appropriate corrective action. SIMHUB RACE LOUNGE INC. | 4 Race results, cameras and promotional media 6 Competition results and online communities Competitions may involve sharing racing names or usernames, classes, results, points and relevant sporting penalties with drivers, stewards and spectators. Public standings and planned broadcasts are identified before entry. We avoid publishing personal contact details, dates of birth, guardian details and private incident reports. Race replays and telemetry may identify drivers and show their performance. We use them for requested coaching, administration and incident review. Planned public broadcasts or promotional reuse are explained separately with appropriate consent, including the identifiers shown and intended audience. Contact us before entering if you need an alias or another privacy accommodation. Platforms such as iRacing may display real names under their own rules. We explain essential public disclosure before registration, but cannot guarantee anonymity on an independent platform. Public or shared Discord posts, social-media comments and results may be copied or retained by others. Avoid posting sensitive information. Private protest evidence is shared only as reasonably necessary for a fair review or another lawful purpose. 7 Security cameras, Ring doorbell and promotional recordings Our lounge security cameras, managed through the Provision CAM2 app, record video only. They do not record audio. We use security recordings for necessary safety, property-protection and incident-investigation purposes. Cameras must not cover washrooms or other areas where people reasonably expect heightened privacy. Our separate Ring doorbell records video and audio, including voices and surrounding sounds, and allows live two-way conversations with visitors. Saved doorbell events can be replayed. We use it to respond to visitors, manage entry and support security and incident review. Ring processes doorbell content and related information through its service. See Ring’s Privacy Notice: https://ring.com/privacy-notice. That notice supplements this policy and does not replace SimHub’s responsibilities. Recording notices must identify video monitoring and, at the Ring doorbell, audio recording before people enter the monitored area or interact with the device. Access to recordings is restricted to authorized personnel and necessary providers. Relevant recordings may be preserved for incidents, insurance matters, legal obligations or access requests. Security recordings are not used for promotion without separate assessment and appropriate consent. Section 11 addresses retention. We may separately take photos or record video with sound for event coverage and promotion. We explain intended uses and obtain appropriate consent. Featured portraits, testimonials, interviews and identifiable promotional content involving minors require separate express permission. An entrance sign or event booking is not unrestricted permission to use every guest’s image or record private conversations. Tell staff before filming or contact our office if you do not want to appear; we use reasonable measures such as avoiding you in shots, cropping or blurring. Declining optional promotional use does not affect ordinary services. You may withdraw permission for future promotional use. We stop new uses and address removal from channels under our control where reasonably practicable, subject to lawful retention. We cannot guarantee recovery of printed materials already distributed or copies independently shared by others. Contact us about a specific image or recording so we can assess your request. SIMHUB RACE LOUNGE INC. | 5 Service providers and information sharing 8 Providers and other recipients We share information needed to deliver services and support operations. We remain accountable for processing on our behalf and require appropriate safeguards. Some providers also use information for their own purposes, including fraud prevention, legal compliance, independent accounts and Shopify’s Enhanced Services. The linked provider names below open their privacy notices. Those notices supplement this policy; they do not replace our responsibilities, expand your consent to SimHub or mean that we use every feature a provider describes. Provider or category Role and relevant information Shopify Simplee Memberships Shopify hosts our online store and handles orders, customer records and marketing emails through Shopify Messaging. Simplee administers memberships. Shopify stores subscription preferences and also processes information for Network Intelligence and Enhanced Services described in section 9. Square App registration payments and refunds, including payment information submitted to Square and transaction information returned to SimHub. Supabase Vercel Supabase provides the App database and authentication. Vercel hosts and delivers the App. Relevant processing includes account/application records and operational or technical logs. Cloudflare Turnstile privacy addendum Bot and abuse protection using relevant browser, device, network and verification information. Resend Transactional email delivery when used, including recipient addresses, message content and delivery records. Smartwaiver Simulator participation waivers, including participant birth dates, guardian details and signatures. The App uses waiver linkage and verification records rather than the full waiver text. iRacing Discord Racing and community services, identifiers and competition activity. These platforms also operate independent customer accounts under their own terms. Provision CAM2 Ring Provision CAM2 manages video-only lounge cameras. Ring provides the separate doorbell service, including recorded video/audio, live visitor communication and event information. Necessary technical support providers may handle relevant recordings. Other necessary recipients Authorized IT, accounting and legal providers, insurers, delivery providers and prize/event partners for a disclosed service or lawful purpose. We do not supply participant lists to sponsors or hosts for their own marketing without separate appropriate consent. Hosts may receive information necessary to administer their booking, such as attendance or agreed event results, but not unrelated purchase histories, health information or private account records. We assess requests for lawful disclosure, including valid legal demands, qualifying emergencies and authorized investigations, and disclose only what is justified. For a proposed or completed sale, merger or other business transaction, we apply applicable necessity, confidentiality, permitted-use and notification requirements. If it does not proceed, recipients must return or destroy information as required. Contact our office for information about providers handling your records. SIMHUB RACE LOUNGE INC. | 6 International processing and digital technologies 9 Processing locations and digital technologies Providers may store, process or remotely access information in Canada, the United States or other countries. A Canadian primary database location does not mean that all backups, logs, payments, emails or support access remain in Canada. Information may be subject to lawful access by courts or authorities in another country. We remain accountable for processing on our behalf and take reasonable measures to provide comparable protection. Contact our office about locations and related practices. Our App uses session and authentication technologies and Cloudflare Turnstile. Our store and checkout use technologies needed for cart, payment and security functions. Providers may process technical request information. Blocking necessary technologies can prevent relevant functions from working; browser settings let you remove or block stored cookies. Our online store is hosted by Shopify. Shopify processes information when you visit or make purchases, including contact, transaction, device and browsing information relevant to the services used. Shopify Network Intelligence is enabled. Shopify combines information about interactions with our store, other merchants and Shopify to provide Enhanced Services, including improvements, personalization and advertising. Information is shared with Shopify and relevant third parties, which may operate outside Canada. Other merchants do not receive direct access to our customer records through this feature. For Shopify’s independent processing and available rights, see its Consumer Privacy Policy and Privacy Portal. The portal provides options to limit use of information for advertising and to request access or deletion. You may also contact our office about SimHub’s processing or to withdraw consent where applicable; we will explain and help implement the choices available for your records. Our Shopify store has a cookie-consent banner enabled. Where displayed, use the banner to accept, reject optional cookies or manage your preferences. Required consent must be obtained before optional processing begins. You may contact our office to change your choices or request help if a control is unavailable. Shopify’s Privacy Portal, linked above, offers additional choices about Shopify’s own advertising-related processing. Some advertising-related disclosures may be treated as “sharing,” “sale” or “targeted advertising” under laws outside Canada; applicable rights depend on your location and the processing involved. A marketing-email unsubscribe stops our promotional messages as described in section 10; it does not by itself change browser cookies or Shopify’s independent advertising preferences. Our separate Meta and Google website-tracking integrations and abandoned-checkout reminders are currently disabled. This does not disable Shopify Network Intelligence, ordinary technical logs or provider reporting. Before introducing other optional tracking, we explain its purposes and choices and obtain consent where required. Email systems may report delivery and, where enabled, opens or link clicks to measure message performance. SIMHUB RACE LOUNGE INC. | 7 10 Email marketing and subscription preferences We send service messages needed for your interaction, including account verification, password resets, registrations, payment/refund information, guardian requests and necessary membership notices. A purchase, registration or waiver does not by itself enrol you in optional promotional messaging. We prepare and send promotional email campaigns through Shopify Messaging about SimHub events, offers and services. We do not currently send marketing texts. Promotional messages require valid consent or another applicable basis under Canada’s Anti-Spam Legislation. Before introducing SMS marketing, we will explain the program and provider, obtain required consent and provide a working unsubscribe method. Shopify records whether customers are subscribed or unsubscribed. Unsubscribe requests submitted through Shopify’s unsubscribe process automatically update the subscription status maintained there. We use these preferences to manage relevant marketing communications. Consent and suppression records are retained as needed to demonstrate the applicable permission and respect your choices. Use the unsubscribe link in a marketing email or contact info@simhubracelounge.com. Unless you expressly select one channel or category, an unsubscribe request stops all SimHub marketing, including any future SMS program. No account or reason is required. We apply your choice across marketing systems and contact details we can reasonably associate with you; limited identifying information may be needed to locate another record. Where required by CASL, commercial messages identify SimHub, provide contact information and offer a simple, free unsubscribe mechanism through the same electronic means used to send the message, or another legally permitted method. Requests are implemented without delay and within 10 business days, including direct requests. Required unsubscribe facilities remain valid for at least 60 days after sending. Limited suppression records help respect your choice. Unsubscribing does not prevent service messages we may lawfully send, such as necessary registration, payment or membership notices. Adding promotional material can change how a message is treated under CASL. We do not transfer your SimHub email-subscription consent as permission for another business to send you its own marketing. Shopify’s separate processing and privacy choices are described in section 9. SIMHUB RACE LOUNGE INC. | 8 Retention, security and incident response 11 How long we keep information We keep personal information only as long as reasonably necessary for identified purposes and applicable legal requirements. Retention depends on the record, service relationship, outstanding obligations, sensitivity and relevant legal claims. Contact our office for information about a particular category. Account and membership records support the service relationship and a justified period afterwards. Tax and accounting records are generally retained for at least six years from the end of the last tax year to which they relate, subject to applicable exceptions and longer legal requirements. Closing an account does not automatically erase these records, consent evidence or information subject to a lawful hold. Simulator waivers, guardian approvals and relevant incident records may require retention beyond the visit, particularly where minors are involved. Retention must be based on a documented need and reviewed when that need ends; the possibility of a claim does not justify keeping every record indefinitely. Provision security video, Ring video and audio recordings, and technical logs are retained only for limited periods justified by their purposes. Specific records may be preserved for an incident, access request or legal obligation. Public competition results and private protest evidence are assessed separately. Incomplete registrations and verification records are removed when no longer needed. Contact our office for the retention practices applicable to a recording or other record. When lawful retention ends, information is securely deleted or effectively anonymized, including through instructions to providers. Removing a name alone does not necessarily make information anonymous. Backup copies may remain until scheduled replacement or deletion, protected and restricted from ordinary use. Applicable deletion restrictions must be reapplied if a backup is restored. 12 Safeguards and breaches We are responsible for protecting personal information with physical, organizational and technical safeguards appropriate to its sensitivity and risk. Access is limited to people who need it for authorized work. Safeguards must address access control, secure handling, provider accountability and staff responsibilities. No system can guarantee absolute security; this does not limit our legal obligations. Do not email passwords, verification links or full payment-card details. Use the payment provider’s secure payment interface, keep your credentials private, sign out of shared simulator computers and contact us promptly about suspected unauthorized access. Payment and security services may use automated checks to identify bots, abuse, fraud or invalid transactions. A check may restrict a login, payment or registration. Contact us if you believe this happened in error so we can review our records and assist with the relevant provider. We cannot guarantee reversal of an independent provider’s decision. We assess suspected breaches, take steps to contain them and address their causes. Where a breach of information under our control creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, as required by law. We also notify other organizations or government bodies where legally required to reduce or mitigate harm. We keep records of every breach of security safeguards involving personal information under our control, including non-reportable breaches, for at least 24 months after the day we determine the breach occurred, and longer where legally required. Notices explain the known circumstances, information involved, protective steps and how to contact us. SIMHUB RACE LOUNGE INC. | 9 Your privacy rights and contacting us 13 Access, correction and privacy requests Write to our office to ask whether we hold information about you, obtain access and an account of its use and disclosure, correct information, withdraw consent, or request account closure or deletion. We assist with requests and take reasonable, proportionate steps to verify identity and authority. We do not routinely require excessive identification. For access requests governed by PIPEDA, we respond with due diligence within 30 calendar days of receipt, unless a lawful extension applies. If extended, we notify you within the initial period of the reason, the new deadline and your right to complain. Access is provided at minimal or no cost; any permissible charge is explained and your agreement obtained before proceeding. We provide understandable information and accessible formats where required. We coordinate with providers processing information on our behalf. Independent providers may separately handle requests concerning records under their own control. A technical data export does not replace access to other relevant records we control. We make justified corrections and notify relevant recipients where appropriate. If a dispute about accuracy remains unresolved, we record the challenge as required. Information subject to an access request is retained long enough to allow available recourse. Legal exceptions may restrict access, for example to protect another person’s information or legal privilege. We provide severable information where required and explain a refusal and available complaint avenues in writing unless the law prevents disclosure. An account or payment dispute does not itself justify refusing a legitimate privacy request. You may request deletion, anonymization or account closure. Deletion is not an unconditional right to erase all records. We stop uses for which consent is validly withdrawn, explain lawful retention and restrict retained information to its purpose. Closing an App account does not itself cancel a separately billed membership; tell us if you also wish to cancel renewal. Cancellation does not authorize further optional marketing. 14 Complaints and policy updates We investigate privacy complaints and take appropriate corrective action. You may also contact the Office of the Privacy Commissioner of Canada without first exhausting our internal process. Information about complaints is available at www.priv.gc.ca/en/report-a-concern/file-a-formal-privacy-complaint/. We post updates with a revised effective date and provide additional notice of significant changes where appropriate. Continued use of a service does not replace required consent. Contact us for a copy or an accessible explanation of this policy. Contact our office SimHub Race Lounge Inc. info@simhubracelounge.com (subject: Privacy Request) (647) 528-7258 5266 Solar Drive, Unit B107, Mississauga, Ontario L4W 0G7, Canada