Privacy Policy

1. Privacy Officer

Our Privacy Officer is responsible for our privacy practices and compliance with this Policy. Questions, access and correction requests, consent withdrawals and complaints may be directed to:

The Privacy Officer can also answer questions about how service providers outside Canada collect, use, disclose or store personal information on our behalf.

2. What We Collect

We collect only the personal information reasonably needed for the purposes described in this Policy.

• Current interest and contact information: name, job title, organization, organization type, email, optional phone number, selected interests and any areas of interest or additional information you choose to provide.
• Current preferences and evidence: permission to contact you about your request, your Privacy Policy acknowledgement and its version and time, your separate optional marketing choice and its wording version and time, linked to your registration identifier. Earlier records may not include these newer acknowledgement or marketing fields; they are not treated as new consent.
• Website and device: IP address, browser/device information, pages viewed, timestamps, referrers, approximate country and basic usage or security information collected by the hosting platform and its analytics. Existing custom events measure site interactions and form outcomes without sending form names, email addresses or free-text responses as event properties.

Where future Event registration or participation activities are offered, we may also collect:

• Registration and eligibility: mailing address, registration category and information reasonably needed to confirm eligibility for discounted or complimentary rates. Eligibility evidence is generally reviewed without retaining a copy unless retention is necessary, separately approved and disclosed.
• Identification: confirmation that identity or eligibility was checked, where required. For ordinary registration or check-in, we do not store government-issued ID images or numbers. Any future process requiring retention must be separately approved and disclosed before collection.
• Payment: amount, date, status and transaction reference when paid registration is enabled. Our payment provider handles card processing; IndigiSEC does not store full card numbers or CVV data.
• Accessibility and dietary: information you choose to share so we can provide accommodations, support-person arrangements and Event services.
• Event preferences and activity: photography/video preference, sponsor-sharing choice, check-in records, badge scans you authorize, session attendance where tracked, incident and conduct reports, and security or accreditation records where applicable.
• Images and recordings: photographs and video created at the Event, subject to the rules and preferences below.
• Exhibitor and sponsor: company contacts, booth personnel names, contracts, insurance evidence, restricted-item disclosures and related operational information.

You may choose not to provide optional information. If required information is not provided, we may be unable to respond to a request, complete a registration, provide a requested accommodation or grant access to a restricted Event activity. Please do not put card details or government ID information in the interest form.

3. Why We Collect and Use It

For the current website, we use information to respond to requests, administer expressed conference interest, communicate necessary participation information, record choices, protect systems, prevent abuse and troubleshoot issues. Optional promotional messages depend on a separate choice.

Where the corresponding Event activities are offered, purposes may also include:

• processing registrations, payments, refunds, substitutions, contracts and invoices;
• confirming eligibility for discounted or complimentary participation;
• checking people in, issuing badges and managing credentials and access;
• planning Event safety and security, including a specific security plan or protected-person visit;
• arranging catering, accessibility support and accommodations;
• sending operational confirmations, schedules, changes, deadlines and safety notices;
• respecting photography preferences and using approved photographs and video for Event promotion, reporting and archives;
• managing exhibitor and sponsor participation, insurance, restricted items and operational requirements;
• responding to complaints, conduct concerns, incidents, legal obligations and insurance matters;
• sending promotional messages about future IndigiSEC events where you have consented or another lawful basis applies; and
• improving future events using aggregated or de-identified information where practical.

We do not use personal information for a materially new purpose without providing notice and, where required, obtaining consent.

4. Consent and Choices

The interest form requires permission for operational contact about your request and a distinct Privacy Policy acknowledgement. Neither is permission for promotional marketing. Optional marketing is a separate, initially unchecked choice; declining it does not prevent submission. Where future Event participation is offered, necessary operational uses and separate optional choices will remain distinct from Attendee Terms acceptance.

Photography and video. For Event registrations where photography preferences are offered, participants may choose their photography/video preference during registration. If you opt out, we use a visible opt-out identifier and reasonable measures to communicate the preference to IndigiSEC photographers, designees and accredited media operating under our control. We cannot control photographs taken independently by other attendees; incidental background capture in wide crowd images may sometimes be unavoidable.

Sponsor lists. Where IndigiSEC offers an optional sponsor-contact sharing choice, information will only be shared in accordance with the participant's affirmative opt-in choice.

Badge scanning. Where badge scanning is offered at the Event, a participant may choose to allow an exhibitor or sponsor to scan their badge and receive the business contact fields disclosed at the point of scanning. The recipient is responsible for its own privacy and anti-spam compliance.

Marketing emails. Promotional messages are sent only with consent or another lawful basis. Any marketing messages will identify IndigiSEC and include an unsubscribe mechanism. The current website records the optional choice; it does not operate a marketing campaign. Operational Event messages are not marketing messages and may still be required to respond to your request or deliver your registration.

You may withdraw consent or change an optional preference by contacting privacy@indigisec.com, subject to legal and contractual restrictions and reasonable processing time. Withdrawal may affect services that depend on the information or choice.

5. Youth Participants

IndigiSEC is primarily an adult conference. Participants aged 15–17 may attend only through an Organizer-approved youth or student program. Where such a program is offered, we may collect information reasonably required for registration, safeguarding, chaperone coordination, emergency contact, accessibility and Event safety. Where parent or guardian consent is required by law or by the program, we will obtain it before participation. We do not use youth-participant information for promotional marketing without appropriate consent.

6. Who We Share Information With

We do not sell personal information. Current interest submissions are stored using Replit-managed PostgreSQL and sent through Resend for internal notifications and confirmations. The internal notification includes the submitted information; the confirmation is sent to the email address you provide. The current providers are described in Section 8.

For relevant Event operations, we may also disclose information only as reasonably necessary to:

• the Event venue and its authorized service providers, where reasonably necessary for venue operations, catering, accessibility, safety, security or other Event services. The venue may operate CCTV and other systems under its own privacy practices.
• Service providers supporting registration, payments, Event management, badge printing, credentialing, cloud storage or security, only where engaged for those services and with appropriate notice. There is no separate registration, ticketing, badge or cloud-productivity service connected to the current interest workflow.
• Exhibitors and sponsors through badge scans you authorize, sponsor-sharing choices you make or another disclosed lawful basis.
• Police, protective-security personnel, government security officials, emergency services or other public authorities where required by law or reasonably necessary for a specific security plan, protected-person visit, emergency or safety incident. We do not provide attendee lists for routine, undisclosed government pre-screening. Affected registrants will be told in advance if a particular program requires pre-screening.
• Legal and professional advisers, insurers, auditors and claims administrators where reasonably necessary.
• A successor or purchaser in a proposed or completed business reorganization or transfer, subject to applicable privacy requirements.

7. Indigenous Data and Cultural Protocol

We recognize the importance of Indigenous data sovereignty and cultural protocol. We do not record ceremonies, prayers or protocol without permission communicated by the person leading the activity or through the Organizer. We do not intentionally publish information identifying a Nation or community as a participant, partner or sponsor without appropriate authorization. Requests concerning culturally sensitive images or content may be directed to the Privacy Officer and will be handled respectfully and promptly.

8. Service Providers Outside Canada

Some service providers process or store personal information outside Canada. Such information may be subject to the laws of the country where it is processed and accessible to courts, law-enforcement or national-security authorities there.

Replit — website/application hosting, deployment and platform analytics

Hosts the website and API, supports security and technical logs, and measures website usage. Replit's published privacy information indicates services are primarily hosted in the United States and may also be hosted in other jurisdictions, including jurisdictions used by its service providers. This is a provider-level disclosure, not verification of a specific server region.

Replit-managed PostgreSQL — database storage

Stores interest submissions, acknowledgement and marketing-choice evidence, and notification delivery status. Replit's provider-level disclosure above indicates primarily United States hosting and possible other hosting jurisdictions. The specific country and region of this individual production database have not been established; we do not claim a verified database location or identify a separate underlying infrastructure provider.

Resend — transactional/event email

Sends interest confirmations and internal registration notifications. Resend documents United States storage for all account data, including email metadata, logs and API records, regardless of sending region. Email content and recipient details are transmitted to Resend, and its API logs can include request payloads. The account-specific sending region and any message-content storage opt-out have not been verified. Email may also pass through recipients' email providers in their applicable jurisdictions.

Future payments only: When paid Event registration or other paid participation is enabled, payment-card information will be processed through Stripe's hosted/payment infrastructure, subject to its applicable privacy terms. Stripe may process information in Canada, the United States and other jurisdictions used by Stripe and its subprocessors. Stripe does not process current Register Interest submissions; paid ticketing is not live. IndigiSEC does not store full payment-card numbers or CVV data.

Written information about our policies and practices for service providers outside Canada is available from the Privacy Officer, who can answer questions about their collection, use, disclosure or storage of personal information.

9. How Long We Keep Information

We keep personal information only as long as reasonably necessary for its purposes, legal, tax, accounting, insurance or claims requirements, or to demonstrate compliance. Our general approach, for records we collect, is:

• interest, registration and attendance records: generally up to 24 months after the Event, unless longer reasonably required for a claim, dispute, legal obligation or ongoing relationship;
• financial and tax records: for the period required by applicable tax and accounting law;
• contracts, insurance, incident, safety and security records: as long as reasonably required for administration, claims, investigations or legal obligations;
• acknowledgement, marketing consent and unsubscribe records: as long as reasonably required to honour preferences and demonstrate compliance; and
• photographs and video, where created: as long as they remain in legitimate Event promotion or archival use, subject to photography rules and applicable legal rights.

When information is no longer required, we securely destroy it or make it anonymous, subject to practical limitations for backups and archival systems. These are retention practices, not a claim that automatic deletion is implemented on this website.

10. How We Protect Information

We use reasonable physical, administrative and technical safeguards appropriate to the sensitivity of the information. Depending on the activity and system, safeguards may include restricted administrative access, strong authentication, confidentiality obligations, encryption in transit where appropriate, logging and vendor security controls. Future payment processing will use the payment provider's hosted infrastructure. No system can guarantee complete security.

Application error logging uses sanitized operational details rather than full registration request bodies or raw provider error bodies. The interest email workflow does not use AI email-editing features or send registration content to an AI service.

If a privacy breach involving personal information under our control creates a real risk of significant harm, we will notify the Office of the Information and Privacy Commissioner of Alberta without unreasonable delay where required by PIPA. We will notify affected individuals where required by law or by the Commissioner, and may also notify individuals proactively where appropriate to reduce harm.

11. Your Privacy Rights

Subject to applicable law, you may ask to access personal information we hold about you, request correction of inaccurate or incomplete information, or withdraw/change an optional consent or preference. Formal access and correction requests should be made in writing to the Privacy Officer. We may take reasonable steps to verify your identity before responding.

Under Alberta PIPA, organizations generally have 45 calendar days to respond to an access request, subject to permitted extensions and exceptions. Where access is refused or limited, we will provide the information required by law about the decision and available review rights.

12. Website, Cookies and Analytics

The website uses necessary site technologies and existing basic Replit platform analytics. Replit's analytics script loads automatically on the published website, before any form choice. Replit documents network/browser-based visitor metrics, including pages, referrers, approximate countries, browser/device types and visitor trends. The website also records basic interaction events and form outcomes; it does not send form contact details or free-text contents as analytics properties.

Replit may set platform or analytics cookies and collect technical usage information required to operate, secure and understand use of the hosted website. A cookie named GAESA has been observed. Its precise purpose and category have not been verified, so we do not characterize it as an advertising cookie or as strictly essential. Provider-level processing locations are described in Section 8.

No advertising, retargeting or marketing tracking tool is currently enabled on the public conference website. If such tools are added later, IndigiSEC will update this Policy and implement any consent mechanism required by applicable law before enabling them. You can control many cookies through your browser settings; blocking necessary technologies may affect website functionality.

13. Third-Party Websites and Services

Our website may link to third-party websites or services, including payment, social-media, accommodation, government or partner sites. Their privacy practices are governed by their own policies. IndigiSEC is not responsible for the privacy practices of third parties that independently determine how they collect and use information.

14. Questions and Complaints

Please contact our Privacy Officer at privacy@indigisec.com first so we can try to resolve your concern. If you are not satisfied, you may contact the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca.

15. Changes to This Policy

We may update this Policy from time to time. The current version will be posted at https://indigisec.com/privacy with its effective date. Where a change is material and affects registered participants, we will provide additional notice where reasonably appropriate or required by law.