Legal
Privacy Policy
Effective date: May 7, 2026
1. Who We Are
La Promesa Tango Festival(“the Festival,” “we,” “us,” or “our”) is presented by Calle del Tango, a dance organization based in Toronto, Ontario, Canada. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit https://lapromesatangofestival.com, create an account, or register for the festival.
Questions or concerns? Contact us at info@lapromesatangofestival.com.
2. Information We Collect
2.1 Information You Provide Directly
- Account registration — name, email address, and password (managed securely by Clerk; see Section 5).
- Festival registration — full name, city/country of residence, workshop and milonga selections, referral code (if applicable), and dietary or accessibility notes you choose to share.
- Payment information — credit/debit card details or Interac e-Transfer confirmation. Card data is processed entirely by Square and never stored on our servers (see Section 6).
- Communications — messages you send us by email or contact forms, including support inquiries.
2.2 Information Collected Automatically
- Usage data — pages visited, links clicked, browser type, device type, operating system, and referring URL.
- Log data — IP address (anonymized for analytics), timestamps, and server logs retained for security and debugging purposes.
- Analytics identifiers — when you accept analytics cookies, a Google Analytics client identifier and (for signed-in users) your stable user identifier are associated with your activity to help us understand site usage. See Section 7.
- Marketing attribution data — campaign parameters (UTM tags), click identifiers (gclid, fbclid), referring URL, and the page where you first landed. This lets us measure which marketing channels drive registrations. Stored on your registration record only when you create one.
- Cookies and similar technologies — strictly necessary cookies required for login state and cart functionality, plus optional analytics and advertising cookies that only set after you grant consent through our cookie banner. See Section 9.
2.3 Information From Third Parties
- Clerk — if you sign in via a social provider (e.g., Google), we receive your name and email address from that provider as relayed through Clerk.
- Square — we receive a transaction confirmation and masked payment summary (last 4 digits, card brand) to confirm your registration payment.
3. How We Use Your Information
We use the information we collect to:
- Create and manage your festival registration and account.
- Process payments and issue registration confirmations and receipts.
- Send you essential communications about the festival (schedule changes, venue details, health and safety notices).
- Send you optional marketing emails about upcoming festivals, workshops, or events by Calle del Tango — you may unsubscribe at any time.
- Detect and prevent fraud, abuse, or unauthorized access.
- Comply with our legal obligations under Canadian law.
- Improve our website and services through aggregated, anonymized analytics.
We do not sell, rent, or trade your personal information to any third party for their own marketing purposes.
4. Legal Basis for Processing
We are subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Where PIPEDA requires, we rely on your consent for processing. For residents of the European Economic Area, we additionally rely on the following bases under the GDPR:
- Contract performance — processing necessary to register you for the festival and complete your purchase.
- Legitimate interests — fraud prevention, website security, and service improvement.
- Consent — optional marketing communications and non-essential cookies.
- Legal obligation — retention of financial records as required by tax law.
5. Clerk — Authentication Service
Account creation and login are powered by Clerk, Inc. Clerk handles password hashing, session management, multi-factor authentication, and optional social sign-in. Your password is never accessible to us. Clerk processes personal data in accordance with its own Privacy Policy and is compliant with GDPR and SOC 2 Type II. By creating an account you also acknowledge Clerk's data practices.
6. Square — Payment Processing
All payment transactions are processed by Square, Inc. Square is a PCI DSS Level 1 certified payment processor. Card numbers, CVVs, and full payment credentials are entered directly into Square's secure hosted fields and are never transmitted to or stored on our servers. We retain only a transaction reference ID and masked payment summary for your records and our accounting.
Square's handling of your payment data is governed by Square's Privacy Policy.
For Interac e-Transfer payments, your banking institution processes the transfer directly. We receive confirmation of payment from your bank but no banking credentials or account details.
7. Analytics and Advertising Tools
We use the following third-party tools to measure how the website is used and to help market the festival. These tools only run after you grant consent through our cookie banner. If you decline, the tools either fall back to anonymized aggregate signals (Google Analytics) or do not run at all (Meta Pixel). You can withdraw consent at any time — see Section 12.
7.1 Google Analytics 4 (GA4)
We use Google Analytics 4 provided by Google LLC (United States) to understand site traffic, page-level engagement, and the channels that drive registrations. GA4 is configured with IP-address anonymization and a 14-month data retention period. When analytics consent is granted, GA4 sets a client identifier in a cookie (`_ga`) so we can distinguish returning visitors from new ones. When consent is denied, GA4 still receives traffic counts but in anonymized, cookieless form (Google Consent Mode v2).
Confirmed registration and refund events are also sent server-to-server to Google Analytics so our revenue and refund totals are accurate even if a browser blocks client-side tracking. These server-side events include the registration confirmation number, transaction value, currency, and the items purchased — but never your payment credentials, name, email, or contact information.
7.2 Meta Pixel (Facebook / Instagram)
When you grant advertising consent, we load the Meta Pixel provided by Meta Platforms, Inc. (United States). The Meta Pixel measures the effectiveness of our Instagram and Facebook advertising and helps us reach people similar to our existing audience. It records browser-level signals such as page views, button clicks, and approximate geographic location. If you decline advertising consent, the Meta Pixel does not load and Meta receives no information from the website.
7.3 Google Tag Manager
Tag delivery is managed via Google Tag Manager, also provided by Google LLC. Tag Manager itself does not collect personal data; it is a container that deploys the analytics and advertising tags listed above subject to your consent choices.
8. Ambassador and Referral Program
If a friend invites you to register using an ambassador code or ambassador link (a URL containing a `?ref=...` parameter), we associate that invitation with your registration so the inviter can be credited. The invitation code is recorded on your registration record and is visible to you in your account. We do not share your identity with the inviter beyond confirming the registration was made.
9. Cookies and Local Storage
We use the following types of cookies and browser storage. Where consent is required, non-essential items only set after you accept the cookie banner.
9.1 Strictly Necessary (always set)
- Clerk session cookies — keep you logged in.
- `lp_cookie_consent` (localStorage) — records your cookie consent choice so we don't ask you again on every visit.
- `lp_attribution` (sessionStorage) — temporary, tab-scoped marketing-attribution data that persists across the sign-in redirect within a single browsing session. Cleared when the tab closes.
- `lp_draft_id` (localStorage) — stores the identifier of your in-progress registration so your cart survives page refreshes.
9.2 Analytics (set only with consent)
- `_ga`, `_ga_*` — Google Analytics client identifier and session tracking.
9.3 Advertising (set only with consent)
- `_fbp` — Meta Pixel browser identifier.
- `_fbc` — Meta Pixel click identifier (set when you arrive from a Meta ad).
You can manage or delete cookies via your browser settings. Disabling strictly necessary cookies will prevent you from logging in or registering. To change your consent choice for analytics or advertising cookies, clear `lp_cookie_consent` from your browser's site data — the consent banner will reappear on your next visit.
10. Data Retention
- Account data — retained for the lifetime of your account. You may request deletion at any time (see Section 12).
- Registration and financial records — retained for 7 years after the festival to satisfy Canadian tax and accounting requirements.
- Marketing preferences — retained until you withdraw consent.
- Server logs — retained for 90 days for security purposes, then deleted.
11. Disclosure of Your Information
We may share your information with:
- Service providers — Clerk (authentication), Square (payments), Brevo (transactional email), Google LLC (analytics and tag delivery), Meta Platforms, Inc. (advertising measurement, only when you grant advertising consent), and other vendors used to deliver services on our behalf, bound by confidentiality obligations.
- Festival operations — internal staff and volunteers who need access to registration details to organize workshops, milongas, and check-in.
- Legal authorities — if required by law, court order, or to protect the safety of participants or the public.
- Business transfers — in the event of a merger, acquisition, or transfer of assets, your data may be transferred with appropriate notice.
We do not share your personal information with any other third parties without your explicit consent.
12. Your Rights
Under PIPEDA and, where applicable, the GDPR, you have the right to:
- Access — request a copy of the personal information we hold about you.
- Correction — request correction of inaccurate or incomplete data.
- Deletion — request erasure of your personal data, subject to legal retention requirements.
- Withdraw email-marketing consent — at any time via the unsubscribe link in any email or by contacting us.
- Withdraw cookie consent — clear `lp_cookie_consent` from your browser's site data; our consent banner will reappear on your next visit so you can change your choice. You can also disable analytics or advertising cookies at the browser level at any time.
- Data portability — request your data in a structured, machine-readable format (GDPR registrants).
- Objection / restriction — object to or request restriction of certain processing activities (GDPR registrants).
To exercise any of these rights, contact us at info@lapromesatangofestival.com. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your national supervisory authority (EEA residents).
13. Data Security
We implement commercially reasonable technical and organizational safeguards to protect your personal information, including TLS encryption in transit, access controls limited to authorized personnel, and delegating sensitive credential management to certified third-party providers (Clerk, Square). No method of transmission over the internet is 100% secure. We cannot guarantee absolute security and encourage you to use a strong, unique password for your account.
14. International Transfers
La Promesa Tango Festival is operated from Toronto, Ontario, Canada. Our service providers, including Clerk (United States), Square (United States and Canada), Google LLC (United States), and Meta Platforms, Inc. (United States), may process your data in jurisdictions outside Canada. These providers maintain appropriate safeguards (such as Standard Contractual Clauses for EEA transfers) to ensure your data is protected to an equivalent standard.
15. Children's Privacy
The festival and this website are not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated by posting the revised policy on this page with an updated effective date. Continued use of the website or your account after changes are posted constitutes acceptance of the revised policy.
17. Contact Us
For any privacy-related questions, requests, or complaints, please contact:
Calle del Tango — PrivacyToronto, Ontario, Canada
info@lapromesatangofestival.com