Privacy policy

Deep Roots Music Festival Inc. ("Deep Roots", "we", "us") runs the festival in Pritchard, British Columbia, and this website. This page explains what personal information we collect, why, and what you can do about it. Questions and requests go to info@deeprootsmusicfestival.com, which reaches the person responsible for privacy at Deep Roots.

What we collect and why

Newsletter. When you sign up, we keep your email address, the time you gave consent, and a private unsubscribe code. We use it to send festival news: lineup drops, ticket alerts, and the like. Every email we send includes an unsubscribe link, and you can also unsubscribe on this site. Either way we take you off our list and keep a note of it so we never email you again by mistake. Signing up again renews your consent.

Contact form. When you write to us, we keep your name, your email address, your message, and the network address it came from, kept with the message in case the form is abused. Messages are delivered to our inbox and stay in our admin tools after they have been handled; email us if you want one deleted.

Accounts. If you create an account, we keep your name, your email address, and your password, stored only in scrambled form; we never see or store the password itself. To keep accounts safe we record the network address and browser type of each sign-in, kept for seven days after your last activity, and we email you when you sign in from a network or browser we have not seen on your account before. That email lists the address and browser used. If you turn on two-factor authentication, we email you a code at sign-in, and you can choose to trust a device for seven days. Actions taken in our admin tools are logged with the network address they came from. Accounts are mainly for the people who run the site; you do not need one to buy tickets or read anything here.

Ticket buyers. Tickets are sold through Tickit. When you buy one, Tickit passes us the contact details you gave at checkout and what you bought, so we can check you in at the gate, answer questions about your order, and send you anything you need to know before the festival. Payment details stay with Tickit; we never see your card.

Site traffic. We count page views and clicks ourselves, without cookies and without advertising trackers. A visitor is represented by a scrambled value that changes every day and cannot be linked back to you without our secret key. We store the page, the site a visit came from, and the time; never your address or browser string. Counts older than two years are cleared automatically, so we can compare one year with the next and no more.

Cookies and browser storage

Signed-in visitors get a session cookie that lasts seven days, a short-lived cookie during two-factor sign-in, and another if they choose to trust a device. Staff get one more that lets them see the site while it is private. Your browser also keeps a small local note of whether you were signed in and the address you used, so pages load without a flicker. We set no advertising or cross-site tracking cookies of our own.

Services we rely on

These companies process data on our behalf, or handle it directly when you use a feature:

• Vercel hosts the site and measures how fast pages load. Those measurements carry the page address and timings, not who you are.
• Neon stores our database.
• Resend delivers our email, including sign-in notices and copies of contact form messages.
• MailerLite holds our newsletter list and sends the newsletter. When you sign up, your email address, the time, and your network address go to MailerLite, and we keep our own record that you agreed. Unsubscribing happens through the link in any email.
• Cloudflare checks that the contact form is used by a person (its Turnstile service sees your network address for that check and may set a cookie) and stores the photos and videos we upload, which you load from our own address.
• Adobe Fonts serves the typeface used for headings on every page. Adobe sees your network address when the font loads and counts usage under its licence.
• SoundCloud provides the players on the Music page. Nothing loads from SoundCloud until you press play; then SoundCloud sets its own cookies under its own privacy policy.
• Tickit sells our tickets on its own website under Tickit's privacy policy, and shares with us what is described under Ticket buyers above.

We do not sell personal information. We share it only with the services above, and where the law requires. Most of these services keep data outside Canada, mainly in the United States, where it is subject to the laws there.

Security

We use reasonable safeguards to protect personal information: encrypted connections, scrambled passwords, admin access limited to staff, and a log of admin actions. No online system is perfectly secure, so we cannot promise absolute security.

Your choices

• Unsubscribe from the newsletter at any time with the link in any email.
• Ask us to show you, correct, or delete the personal information we hold about you, including deleting an account, by emailing info@deeprootsmusicfestival.com. We may ask you to confirm who you are first.
• The festival is 19+ and this site is not aimed at children. If you believe a child has given us personal information, email us and we will delete it.
• If you are not satisfied with how we handle your information, you can contact the Office of the Information and Privacy Commissioner for British Columbia.

Changes

We update the date at the top when we change this page.