Privacy Policy

La Promesa Tango Festival(“the Festival,” “we,” “us,” or “our”) is presented by Calle del Tango, a dance organization based in Toronto, Ontario, Canada. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit https://lapromesatangofestival.com, create an account, or register for the festival.

Questions or concerns? Contact us at info@lapromesatangofestival.com.

We use the information we collect to:

• Create and manage your festival registration and account.
• Process payments and issue registration confirmations and receipts.
• Send you essential communications about the festival (schedule changes, venue details, health and safety notices).
• Send you optional marketing emails about upcoming festivals, workshops, or events by Calle del Tango — you may unsubscribe at any time.
• Detect and prevent fraud, abuse, or unauthorized access.
• Comply with our legal obligations under Canadian law.
• Improve our website and services through aggregated, anonymized analytics.

We do not sell, rent, or trade your personal information to any third party for their own marketing purposes.

We are subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Where PIPEDA requires, we rely on your consent for processing. For residents of the European Economic Area, we additionally rely on the following bases under the GDPR:

• Contract performance — processing necessary to register you for the festival and complete your purchase.
• Legitimate interests — fraud prevention, website security, and service improvement.
• Consent — optional marketing communications and non-essential cookies.
• Legal obligation — retention of financial records as required by tax law.

Account creation and login are powered by Clerk, Inc. Clerk handles password hashing, session management, multi-factor authentication, and optional social sign-in. Your password is never accessible to us. Clerk processes personal data in accordance with its own Privacy Policy and is compliant with GDPR and SOC 2 Type II. By creating an account you also acknowledge Clerk's data practices.

All payment transactions are processed by Square, Inc. Square is a PCI DSS Level 1 certified payment processor. Card numbers, CVVs, and full payment credentials are entered directly into Square's secure hosted fields and are never transmitted to or stored on our servers. We retain only a transaction reference ID and masked payment summary for your records and our accounting.

Square's handling of your payment data is governed by Square's Privacy Policy.

For Interac e-Transfer payments, your banking institution processes the transfer directly. We receive confirmation of payment from your bank but no banking credentials or account details.

We use the following third-party tools to measure how the website is used and to help market the festival. These tools only run after you grant consent through our cookie banner. If you decline, the tools either fall back to anonymized aggregate signals (Google Analytics) or do not run at all (Meta Pixel). You can withdraw consent at any time — see Section 12.

If a friend invites you to register using an ambassador code or ambassador link (a URL containing a `?ref=...` parameter), we associate that invitation with your registration so the inviter can be credited. The invitation code is recorded on your registration record and is visible to you in your account. We do not share your identity with the inviter beyond confirming the registration was made.

We use the following types of cookies and browser storage. Where consent is required, non-essential items only set after you accept the cookie banner.

You can manage or delete cookies via your browser settings. Disabling strictly necessary cookies will prevent you from logging in or registering. To change your consent choice for analytics or advertising cookies, clear `lp_cookie_consent` from your browser's site data — the consent banner will reappear on your next visit.

• Account data — retained for the lifetime of your account. You may request deletion at any time (see Section 12).
• Registration and financial records — retained for 7 years after the festival to satisfy Canadian tax and accounting requirements.
• Marketing preferences — retained until you withdraw consent.
• Server logs — retained for 90 days for security purposes, then deleted.

We may share your information with:

• Service providers — Clerk (authentication), Square (payments), Brevo (transactional email), Google LLC (analytics and tag delivery), Meta Platforms, Inc. (advertising measurement, only when you grant advertising consent), and other vendors used to deliver services on our behalf, bound by confidentiality obligations.
• Festival operations — internal staff and volunteers who need access to registration details to organize workshops, milongas, and check-in.
• Legal authorities — if required by law, court order, or to protect the safety of participants or the public.
• Business transfers — in the event of a merger, acquisition, or transfer of assets, your data may be transferred with appropriate notice.

We do not share your personal information with any other third parties without your explicit consent.

Under PIPEDA and, where applicable, the GDPR, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request erasure of your personal data, subject to legal retention requirements.
• Withdraw email-marketing consent — at any time via the unsubscribe link in any email or by contacting us.
• Withdraw cookie consent — clear `lp_cookie_consent` from your browser's site data; our consent banner will reappear on your next visit so you can change your choice. You can also disable analytics or advertising cookies at the browser level at any time.
• Data portability — request your data in a structured, machine-readable format (GDPR registrants).
• Objection / restriction — object to or request restriction of certain processing activities (GDPR registrants).

To exercise any of these rights, contact us at info@lapromesatangofestival.com. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your national supervisory authority (EEA residents).

We implement commercially reasonable technical and organizational safeguards to protect your personal information, including TLS encryption in transit, access controls limited to authorized personnel, and delegating sensitive credential management to certified third-party providers (Clerk, Square). No method of transmission over the internet is 100% secure. We cannot guarantee absolute security and encourage you to use a strong, unique password for your account.

La Promesa Tango Festival is operated from Toronto, Ontario, Canada. Our service providers, including Clerk (United States), Square (United States and Canada), Google LLC (United States), and Meta Platforms, Inc. (United States), may process your data in jurisdictions outside Canada. These providers maintain appropriate safeguards (such as Standard Contractual Clauses for EEA transfers) to ensure your data is protected to an equivalent standard.

The festival and this website are not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated by posting the revised policy on this page with an updated effective date. Continued use of the website or your account after changes are posted constitutes acceptance of the revised policy.

For any privacy-related questions, requests, or complaints, please contact: