Privacy Policy

Last Updated: June 2025

This Privacy Policy explains how Quietcadarcreative Inc. ("we", "us", "our") collects, uses, stores, discloses, and protects your personal data when you visit or use our website at quietcadarcreative.com (the "Website"), make reservations, use our hotel and casino services, or otherwise interact with us. We are committed to protecting your privacy and processing your personal data in full compliance with applicable data protection legislation, including the British Columbia’s Personal Information Protection Act ("BC PIPA"), Canada’s Personal Information Protection and Electronic Documents Act ("PIPEDA") where applicable, and other Canadian privacy requirements.

Please read this Privacy Policy carefully. By accessing our Website or using our services, you acknowledge that you have read, understood, and agree to the terms described herein.

1. Organization Responsible for Personal Information

The entity responsible for the collection and processing of your personal data is:

As the organization responsible for personal information, we determine the purposes and means by which your personal data is processed. If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing activities, please contact us using the details provided in Section 14 of this Policy.

2. Privacy Officer

We have appointed a Privacy Officer who is responsible for overseeing our data protection strategy and ensuring compliance with applicable data protection laws. You may contact our DPO at any time:

3. Scope of This Privacy Policy

This Privacy Policy applies to all personal data we collect and process in connection with:

• Your use of our Website (quietcadarcreative.com) and any related mobile applications;
• Hotel reservations, check-in, check-out, and accommodation services;
• Casino gaming activities, loyalty programmes, and related entertainment services;
• Restaurant, spa, event, and other ancillary services offered at our premises;
• Customer support enquiries and complaints;
• Marketing and promotional communications;
• Participation in surveys, competitions, or promotional activities;
• Employment applications (see Section 13);
• Any other interaction between you and Quietcadarcreative.

This Policy does not apply to third-party websites, platforms, or services that may be linked to or from our Website. We encourage you to review the privacy policies of any third-party sites you visit.

4. Personal Data We Collect

We collect various categories of personal data depending on the nature of your interaction with us. Personal data means any information relating to an identified or identifiable natural person.

4.1 Data You Provide Directly

• Identity Data: Full name, title, date of birth, gender, nationality, passport or government-issued identification details;
• Contact Data: Email address, telephone number, postal address, city, country of residence;
• Reservation & Booking Data: Arrival and departure dates, room preferences, number of guests, special requests, dietary requirements, accessibility needs;
• Payment & Financial Data: Credit/debit card details (processed securely via PCI-DSS compliant payment processors), billing address, transaction history;
• Account Data: Username, password (stored in hashed form), loyalty programme membership number, preferences and settings;
• Casino & Gaming Data: Gaming activity records, wager amounts, winnings, losses, responsible gambling preferences, self-exclusion requests, age verification documents;
• Communications Data: Records of correspondence with us by email, phone, live chat, or post, including support tickets and complaint records;
• Marketing Preferences: Opt-in/opt-out choices for various communication channels, interests, and promotional preferences.

4.2 Data Collected Automatically

• Technical Data: IP address, browser type and version, operating system, device identifiers, time zone settings, browser plug-in types and versions;
• Usage Data: Pages visited, links clicked, time spent on pages, referring URLs, search terms used on our Website, and navigation paths;
• Location Data: Approximate geographic location derived from IP address (general city/region level only, unless you grant more precise location permissions);
• Cookie Data: Information collected via cookies, web beacons, pixels, and similar tracking technologies (see Section 11 for full Cookie Policy details).

4.3 Data Received from Third Parties

• Booking Platforms: Personal data provided when you make a reservation through third-party booking platforms (e.g., Booking.com, Expedia, Hotels.com);
• Payment Processors: Confirmation of payment authorisation and fraud screening results;
• Identity Verification Services: Results of age and identity verification checks required for casino gaming access;
• Anti-Money Laundering (AML) & Sanctions Screening: Results from regulatory screening databases as required by applicable gambling and financial regulations;
• Social Media Platforms: If you log in or interact with us via social media accounts, we may receive profile information you have consented to share with third-party applications;
• Analytics Providers: Aggregated and pseudonymised data regarding how users interact with our Website.

4.4 Special Categories of Personal Data

In limited circumstances, we may process sensitive personal information requiring enhanced safeguards under Canadian privacy law. This includes:

• Health & Disability Information: If you inform us of accessibility requirements, dietary restrictions related to medical conditions, or similar needs to enable us to provide appropriate services;
• Responsible Gambling Data: Information you provide relating to problem gambling or self-exclusion, which may include health-related data.

We process such special category data only where you have provided explicit consent (applicable Canadian privacy law), where processing is necessary for reasons of substantial public interest, or where you have manifestly made the information public. We apply enhanced safeguards to all special category data.

4.5 Data Relating to Criminal Convictions and Offences

In the context of our casino operations, we may be required by law or regulatory obligation to collect and process data relating to criminal convictions or offences (e.g., as part of AML compliance checks). Such processing is carried out only under official authority or as required by applicable law.

5. Legal Bases for Processing Personal Data

We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, with meaningful consent unless Canadian law permits or requires otherwise. Our principal grounds are described below:

5.1 Providing Requested Services

We process your personal data where it is necessary to perform a contract to which you are a party, or to take steps at your request prior to entering into a contract. This includes:

• Processing hotel reservations, check-in, and check-out;
• Managing your casino gaming account and transactions;
• Processing payments for services rendered;
• Managing loyalty programme memberships;
• Providing customer support and handling complaints.

5.2 Compliance with Canadian Legal Obligations

We process your personal data where it is necessary to comply with a legal obligation to which we are subject. This includes:

• Anti-money laundering (AML) and counter-terrorism financing (CTF) obligations;
• Know Your Customer (KYC) and age verification requirements under gambling regulations;
• Tax reporting and financial record-keeping obligations;
• Compliance with court orders, regulatory investigations, or law enforcement requests;
• Data breach notification obligations.

5.3 Protection of Health and Safety

In exceptional circumstances, we may process personal data where it is necessary to protect the vital interests of you or another natural person, for example in a medical emergency on our premises.

5.4 Reasonable Business Purposes

We process your personal data where it is necessary for the purposes of our legitimate interests or those of a third party, provided that those interests are not overridden by your interests or fundamental rights and freedoms. Our legitimate interests include:

• Ensuring the security and integrity of our Website, systems, and premises;
• Fraud prevention and detection;
• Improving and personalising our services based on usage patterns;
• Conducting analytics and business intelligence to optimise operations;
• Direct marketing of similar products and services to existing customers (where permitted by applicable law);
• Maintaining and defending legal claims;
• Operating CCTV surveillance on our premises for security purposes;
• Network and information security.

When we rely on legitimate interests, we conduct a balancing test to ensure your rights and interests are appropriately considered. You have the right to object to processing based on legitimate interests (see Section 12).

5.5 Consent

Where we do not have another lawful basis for processing, or where required by law, we will ask for your consent. We rely on consent for:

• Sending you marketing emails, SMS messages, or push notifications where you are not an existing customer;
• Placing non-essential cookies and tracking technologies on your device;
• Processing special categories of personal data (e.g., health information for accessibility purposes);
• Sharing your data with selected third-party partners for their own marketing purposes (we will only do this where you have explicitly opted in).

Where we process data based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, please contact us at privacy@quietcadarcreative.com or use the opt-out mechanisms provided in our communications.

5.6 Authorized Regulatory and Public-Safety Purposes

In limited circumstances, we may process personal data where necessary for the performance of a task carried out in the public interest or in the exercise of official authority, for example, in cooperation with gambling regulatory authorities.

6. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

6.1 Hotel Services

• Processing and managing room reservations and cancellations;
• Facilitating guest check-in and check-out procedures;
• Communicating pre-arrival, in-stay, and post-stay information;
• Managing special requests, accessibility requirements, and dietary needs;
• Processing payments and issuing invoices and receipts;
• Managing loyalty programme enrolment, points accrual, and redemption.

6.2 Casino & Gaming Services

• Verifying your identity and age to comply with gambling regulations;
• Creating and managing your casino player account;
• Recording and managing your gaming transactions and account balance;
• Administering responsible gambling tools including deposit limits, cool-off periods, and self-exclusion;
• Conducting AML and sanctions screening as required by law;
• Detecting and preventing fraudulent activity, cheating, or money laundering;
• Communicating casino promotions, bonuses, and events (subject to your marketing preferences).

6.3 Website & Technology

• Operating, maintaining, and improving our Website and digital services;
• Personalising your online experience based on your preferences and browsing behaviour;
• Performing website analytics to understand user behaviour and optimise performance;
• Ensuring the security, stability, and integrity of our IT systems;
• Detecting, investigating, and preventing cybersecurity incidents.

6.4 Marketing & Communications

• Sending you promotional offers, newsletters, and information about events and services we believe may interest you;
• Conducting targeted advertising on social media platforms and other digital channels;
• Inviting you to participate in surveys, competitions, and market research;
• Measuring the effectiveness of our marketing campaigns.

6.5 Legal, Compliance & Security

• Complying with our legal and regulatory obligations under applicable laws;
• Responding to and cooperating with regulatory enquiries and law enforcement requests;
• Establishing, exercising, or defending legal claims;
• Operating CCTV surveillance for the safety and security of guests, staff, and assets;
• Conducting internal audits, risk assessments, and compliance reviews.

7. Sharing Your Personal Data

We do not sell your personal data to third parties. We may share your personal data with the following categories of recipients where necessary and lawful:

7.1 Service Providers and Data Processors

We engage trusted third-party service providers who process personal data on our behalf and under our instructions as data processors. These include:

• Payment Processors: To securely process credit/debit card transactions and manage refunds;
• Booking Platforms: Third-party hotel and travel booking platforms through which reservations are made;
• IT & Cloud Service Providers: Hosting, data storage, and infrastructure service providers;
• Identity & Age Verification Providers: Services that verify your identity and age for casino compliance purposes;
• AML Screening Providers: Services that screen against sanctions lists and politically exposed persons (PEP) databases;
• Customer Relationship Management (CRM) Providers: Platforms used to manage guest and player communications;
• Email & SMS Marketing Platforms: Providers used to send marketing and transactional communications;
• Analytics Providers: Services such as web analytics tools that help us understand Website usage (e.g., Google Analytics);
• Security & Fraud Prevention Services: Providers that help us detect and prevent fraud and cyber threats;
• Legal & Professional Advisors: Lawyers, auditors, and accountants who require access to data to provide professional services.

All data processors are bound by contractual obligations (Data Processing Agreements) requiring them to protect your data and process it only as instructed by us.

7.2 Regulatory and Law Enforcement Authorities

We may disclose your personal data to governmental, regulatory, or law enforcement authorities where required or permitted by law, including:

• Canada Revenue Agency (CRA) and other tax authorities;
• Provincial gaming and liquor regulatory authorities;
• Financial intelligence units and AML authorities;
• Police services and other law enforcement agencies (in response to lawful requests);
• Courts and tribunals in connection with legal proceedings.

7.3 Business Partners

We may share data with carefully selected business partners who assist us in delivering services, such as co-branded loyalty programmes, event management companies, or technology partners. Data sharing with business partners is governed by appropriate data sharing agreements.

7.4 Group Companies

We may share your personal data with other companies within our corporate group where necessary for internal administrative purposes, subject to appropriate safeguards.

7.5 Business Transfers

In the event of a merger, acquisition, asset sale, or restructuring of our business, your personal data may be transferred to the relevant acquiring party as part of the business assets, subject to appropriate confidentiality and data protection undertakings.

7.6 With Your Consent

We may share your personal data with third parties where you have given us your explicit consent to do so, for example, with third-party marketing partners.

8. International Transfers of Personal Data

Our operations are primarily based in Kelowna, British Columbia, Canada. However, some of our service providers and partners may be located in countries outside Canada, including countries that may not provide the same level of data protection as your home country.

Where we transfer personal data outside Canada or the EEA, we ensure that appropriate safeguards are in place to protect your data, including:

• Comparable Protection Assessments: Transferring data to countries assessed as providing appropriate contractual or legal protection;
• Contractual Safeguards: Using written contracts that require service providers to protect information and use it only for authorized purposes;
• Binding Corporate Rules (BCRs): Where applicable, relying on approved BCRs within our corporate group;
• Other Appropriate Safeguards: As permitted under applicable Canadian privacy law.

Canada is generally recognised as providing an adequate level of data protection for commercial organisations subject to PIPEDA. You may request further information about the safeguards applicable to international transfers of your data by contacting us at privacy@quietcadarcreative.com.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements. When determining the appropriate retention period, we consider the nature and sensitivity of the data, the purposes for which we process it, and applicable legal obligations.

Upon expiry of the applicable retention period, your personal data will be securely deleted, anonymised, or pseudonymised in accordance with our internal data retention and disposal procedures. In some circumstances, we may retain your data for longer periods where required by law, regulatory guidance, or where data is necessary for the establishment, exercise, or defence of legal claims.

10. Your Privacy Rights in Canada

Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data. These rights are provided under applicable Canadian privacy legislation. We will respond to verified requests generally within 30 days, subject to lawful extensions and identity verification.

10.1 Right to Access Personal Information

You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with supplementary information about how it is processed. This is also known as a Subject Access Request (SAR).

10.2 Right to Request Correction

You have the right to request the correction of inaccurate personal data we hold about you, and the completion of incomplete personal data, without undue delay.

10.3 Right to Request Deletion Where Applicable

You have the right to request the deletion of your personal data where:

• The data is no longer necessary for the purposes for which it was collected;
• You withdraw consent and there is no other legal basis for processing;
• You object to processing and there are no overriding legitimate grounds;
• The data has been unlawfully processed;
• Erasure is required to comply with a legal obligation.

This right is not absolute and does not apply where processing is necessary for compliance with a legal obligation, the exercise of official authority, or the establishment, exercise, or defence of legal claims.

10.4 Right to Limit or Challenge Certain Uses

You have the right to request that we restrict the processing of your personal data in certain circumstances, including where the accuracy of the data is contested, or where you have objected to processing pending verification of our legitimate grounds.

10.5 Right to Receive Available Records

Where processing is based on your consent or on a contract, and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.

10.6 Right to Withdraw Consent or Object

You have the right to object at any time to the processing of your personal data where Canadian privacy law permits the processing without fresh consent for reasonable business, legal, security, or public-safety purposes. You also have an unconditional right to object to the processing of your personal data for direct marketing purposes at any time.

10.7 Automated Decisions and Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Where we use automated decision-making (for example, in fraud detection or player risk assessment), you have the right to request human review of the decision, to express your point of view, and to contest the decision.

10.8 Right to Withdraw Consent

Where we process your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

10.9 Right to Lodge a Complaint

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a supervisory authority. You may contact the Office of the Privacy Commissioner of Canada:

• Office of the Privacy Commissioner of Canada
  30 Victoria Street, Gatineau, Quebec K1A 1H3, Canada
  Website: priv.gc.ca
  Telephone: 1-800-282-1376

We encourage you to contact us first so that we can address your concerns before you escalate to a supervisory authority.

How to Exercise Your Rights

To exercise any of the rights listed above, please submit your request by:

• Email: privacy@quietcadarcreative.com
• Post: The Privacy Officer, Quietcadarcreative Inc., 238 Bernard Avenue, Kelowna, BC V1Y 6N4, Canada

We may require you to verify your identity before processing your request to protect your data from unauthorised access. We will not charge a fee for handling your request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse the request.

11. Cookies and Tracking Technologies

Our Website uses cookies and similar tracking technologies (such as web beacons, pixels, and local storage) to enhance your browsing experience, analyse Website performance, and deliver personalised content and advertising.

11.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They allow the website to recognise your device on subsequent visits and to remember your preferences and settings.

11.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Website to function and cannot be switched off. They are typically set in response to your actions such as logging in, completing forms, or setting privacy preferences. Legal basis: Legitimate interests / contract performance.
• Performance & Analytics Cookies: These cookies allow us to count visits and measure traffic sources so we can measure and improve the performance of our Website. All information these cookies collect is aggregated and anonymous. Legal basis: Consent.
• Functionality Cookies: These cookies enable the Website to provide enhanced functionality and personalisation, such as remembering your language preferences or login details. Legal basis: Consent / Legitimate interests.
• Targeting & Advertising Cookies: These cookies may be set through our Website by our advertising partners to build a profile of your interests and show you relevant advertisements on other websites. Legal basis: Consent.

11.3 Managing Cookies

When you first visit our Website, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. You can manage and withdraw your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of our Website.

You may also control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality and performance of our Website. For more information on managing cookies in your browser, visit www.allaboutcookies.org.

12. Marketing Communications

We may send you promotional and marketing communications about our hotel and casino services, special offers, events, and loyalty programme benefits. We will only send you marketing communications where we have a legal basis to do so:

• Existing Customers (Soft Opt-In): Where you have previously purchased or enquired about our services, we may send you marketing communications about similar products and services by email or SMS, unless you have opted out;
• New Contacts: Where you are not an existing customer, we will only send marketing communications where you have given your explicit prior consent.

You can opt out of receiving marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email we send you;
• Replying "STOP" to any marketing SMS;
• Updating your marketing preferences in your online account settings;
• Contacting us at privacy@quietcadarcreative.com.

Please note that opting out of marketing communications does not affect the delivery of transactional or service-related communications (e.g., booking confirmations, invoices, or security alerts).

13. Security of Your Personal Data

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security measures include:

• Encryption of data in transit using Transport Layer Security (TLS) protocols;
• Encryption of sensitive data at rest using industry-standard encryption algorithms;
• PCI-DSS compliant payment processing for all card transactions;
• Role-based access controls and least-privilege principles for system access;
• Regular security assessments, penetration testing, and vulnerability management;
• Staff training on data protection and information security;
• Incident response procedures and data breach notification processes;
• Physical security measures at our premises and data facilities.

While we implement robust security measures, no transmission of data over the internet or electronic storage system is completely secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by applicable Canadian breach-notification requirements.

14. Job Applicants and Employees

If you apply for a position at Quietcadarcreative, we will collect and process personal data provided in connection with your application, including your CV/résumé, cover letter, qualifications, references, and interview notes. We process this data for the purpose of assessing your suitability for employment and, if successful, for the purposes of employment administration.

Personal data of unsuccessful job applicants will be retained for up to 12 months from the date of application, after which it will be securely deleted, unless you consent to us retaining it for a longer period for future vacancies.

Employee personal data is processed in accordance with a separate Employee Privacy Notice provided to all staff at the commencement of their employment.

15. Children's Privacy

Our hotel and casino services are not directed at children. Our casino gaming services are strictly restricted to individuals who are 19 years of age or older in accordance with British Columbia gambling regulations, and we will not knowingly collect or process personal data from individuals under the age of 19 (or the applicable legal age of majority in your jurisdiction) in connection with casino services.

Our hotel services may be used by families with children; however, we do not knowingly collect personal data directly from children under the age of 13 without verifiable parental or guardian consent. If we become aware that we have inadvertently collected personal data from a child under 13 without appropriate consent, we will take prompt steps to delete such data.

If you believe we may have collected data from a child without appropriate consent, please contact us immediately at privacy@quietcadarcreative.com.

16. Third-Party Links

Our Website may contain links to third-party websites, plug-ins, and applications (including social media platforms, booking portals, and partner websites). Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to review the privacy policy of every website you visit.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or regulatory guidance. When we make material changes, we will notify you by posting the updated Privacy Policy on this page with a revised "Last Updated" date and, where appropriate, by sending you an email notification or displaying a prominent notice on our Website.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal data. Your continued use of our Website or services after the publication of a revised Privacy Policy constitutes your acknowledgement of the updated terms.

18. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing activities, or if you wish to exercise any of your data protection rights, please contact our Data Protection Officer:

We are committed to addressing your concerns promptly and transparently. We will acknowledge receipt of your request and provide a substantive response within one month, or within the timeframe required by applicable law.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection supervisory authority, as described in Section 10.9 of this Policy.