Privacy policy

Effective date: 27 September 2026

We run a warehouse venue, not a data business. This page explains the little we collect, why, where it lives, and how to ask us about it.

Who we are

DERA Collective is an event venue at 6680 152A Street, Unit 106, Surrey, British Columbia. This policy covers deracollective.com and the personal information we handle when you inquire, book, visit or attend an event here.

The person accountable for how we handle personal information is the Privacy Officer, DERA Collective. You can reach them at bookings@deracollective.com or 672 699 8689.

We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).

What we collect and how

The inquiry form

The form on our home page does not send anything to a server. When you press Check Your Date, it opens your own email app with a message addressed to us and the details you typed. You see exactly what is being sent before you send it, and you can edit or discard it.

The form on our private events page sends what you type to Netlify, which hosts our site: your name, email, phone number, event date, guest count, event type, AV needs, layout, event details and your agreement to this policy. Netlify keeps it in our account, screens it for spam and emails it to us, so we can check your date, reply, quote and arrange a walkthrough. If the form cannot reach Netlify, it opens your email app instead, the same way the home page form does.

Email and phone inquiries

When you email or call us we keep your name, your contact details and what you told us about your event, so we can reply, quote and follow up.

Forms on Facebook and Instagram

Some of our ads on Facebook and Instagram open a short form. Meta, which runs both apps, may fill in your name, email and phone number from your account, and you can change them before you send. When you send the form, Meta passes us the name, email and phone number on it and the answers you chose to give, along with the time you sent it, which of our ads and forms you answered, and whether you used Facebook or Instagram.

We use these details to reply to you, send a quote, suggest rental companies if you ask, and arrange a walkthrough of the space. If you book, we use them to run the booking as this policy sets out. We do not send you marketing unless you clearly say yes, and we never sell your details. Only the people at DERA who answer inquiries and run bookings can see them, along with the service providers named below that hold our records. Each form reaches us through Meta's Leads Center, where we can download it for up to 90 days after you send it. We copy it into our own records and keep it as set out under How long we keep it. What Meta itself does with your form, including using it to fill in future forms for you, is covered by Meta's privacy policy.

To see, correct or delete what you sent us, write to the Privacy Officer at bookings@deracollective.com or call 672 699 8689. We delete our copy unless you have booked with us or the law requires us to keep it.

Booking and contract details

When you book, we collect what a venue agreement needs: your name, the name of your organization if there is one, your address, contact details, the event details, insurance certificates, permit details where alcohol is served, and the vendors you are bringing in.

Payment details

Deposits and balances are paid by bank transfer or cheque, as set out in your invoice, so your bank handles them under its own privacy policy. This website never stores card numbers or bank account details. We do not ask for them by email, and if one reaches us we delete it once the payment is settled.

Photography and video at the venue

We photograph and film the space, and sometimes events, for our own records and to show what the room can do. We only shoot an event when the renter has agreed to it in the booking confirmation. Where guests may be identifiable, the renter posts a notice we provide at the entrance, and any guest can tell our team or the photographer that they do not want to be in the pictures. We do not use an identifiable image of a guest in marketing without that person's express consent, and we take an image down when the person in it asks.

Safety and incident records

If someone is hurt or something is damaged, we write down what happened and who was involved so we can respond properly and meet our legal duties.

Why we collect it

We use personal information for these purposes only:

• to answer your inquiry, send you a quote and arrange a walkthrough of the space
• to form and manage a booking, including the venue agreement, deposit and invoices
• to run the event safely, including permits, insurance and vendor access
• to meet legal duties, including tax records and liquor licensing
• to record and respond to an incident, injury, damage or complaint
• to show the space in our own marketing, with consent where a person is identifiable
• to send you marketing messages, only when you have said yes

If we ever want to use your information for something else, we will ask you first.

Consent and how to withdraw it

When you contact us about an event, you are consenting to us using your details to reply and to help you book. When you book, you are consenting to the uses a booking needs. Where we want anything beyond that, such as using your image or sending you marketing, we ask for a clear yes.

You can withdraw consent at any time by writing to bookings@deracollective.com. We will explain what withdrawing means in practice before we act on it, because some uses are needed to complete a booking or to meet a legal duty, and we will then stop the use you have withdrawn from.

Cookies, analytics and tracking

This site sets no cookies, runs no analytics and carries no tracking pixels, chat widgets or advertising scripts. The only third party it loads is Google Fonts, which serves the typefaces you are reading and receives the technical request that any web page load involves.

If we ever add analytics or any other tracking, we will update this policy first, tell you what it collects, and ask for your consent before it runs.

Service providers and where data is processed

A small number of companies handle data on our behalf:

• Netlify hosts this website. Its servers are in the United States. Netlify keeps ordinary server logs of the requests your browser makes for each page, including the requesting IP address, to keep the site running and secure. It also receives and stores the inquiries sent through the form on our private events page, screens them for spam and emails them to us.
• Google Workspace provides our email and calendar. Your inquiries and booking correspondence live there. Google may process that data outside Canada.
• Notion holds our inquiry and booking records. Notion may process that data outside Canada.
• Meta runs Facebook and Instagram. Forms you send us there sit in our Leads Center on Meta's systems, and Meta also handles them under its own privacy policy, not only on our behalf. Meta may process that data outside Canada.
• Payments are handled as set out under Payment details above.
• Anthropic provides the AI assistant that helps us sort booking email and keep our inquiry records. Anthropic may process that data outside Canada.

We choose providers whose terms commit them to protecting personal information to a standard comparable to ours, and we share only what each one needs to do its job. While data is outside Canada it may be subject to the laws of that country. Canadian and British Columbia privacy law still governs how we handle your information, and you can ask us at any time how a given provider handles it.

We give personal information to police, a court or a regulator only when the law requires or allows it, for example to comply with a warrant, subpoena or court order, and then only what the request covers.

How long we keep it

We keep personal information only as long as it is needed for the purpose we collected it, or as long as the law requires, and then we delete it.

• Inquiries by email, by our website form or by a Facebook or Instagram form that do not become a booking: 24 months after our last contact with you
• Booking agreements, invoices and payment records: seven years after the end of the tax year they relate to
• Incident, injury and damage records: 15 years after the entry, or where anyone involved was under 19, 15 years after that person turns 19, whichever is later, because a young person's right to bring a claim does not start to run until they turn 19
• Privacy breach records: at least 24 months
• Photographs and video: until the person in them withdraws consent, or until we stop using them

Safeguards

We protect your information with measures that fit its sensitivity. We keep our accounts behind strong passwords and two step verification, we limit access to the people who need a record to do their job, we use encrypted services from the providers named above, and we keep no personal data on the website itself. We keep any paper record locked at the venue.

Your rights

You can ask us what personal information we hold about you, how we use it and who we have shared it with. You can ask us to correct anything that is wrong. You can withdraw consent as described above. Write to the Privacy Officer at bookings@deracollective.com and we will respond within 30 days. We may ask you to confirm who you are first. If the law stops us from sharing something, or if we need longer than 30 days, we will tell you why. We do not charge for a simple request.

If you are not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca or to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Children

Renters confirm they are at least 19 under our booking terms, so we do not knowingly collect personal information from anyone under 19 as a renter. Guests under 19 may attend an event, and where a photograph or an incident record includes a young person we treat that information with extra care and use it only for the purpose it was collected. Information about young players at the Pavilion cricket nets, which is part of DERA Collective, is handled under the Pavilion privacy policy at pavilioncricketclub.com/privacy/.

If something goes wrong

We keep a record of every privacy breach. If a breach creates a real risk of significant harm to you, we will tell you and the Office of the Privacy Commissioner of Canada as soon as we can, explain what happened, and tell you what we are doing about it and what you can do to protect yourself.

Marketing messages

An inquiry is answered, and that is all it is. We do not send marketing to anyone who has not clearly agreed to receive it. Every commercial message we send identifies DERA Collective, gives our mailing address and contact details, and carries an unsubscribe link or instruction. Unsubscribe requests are honoured within 10 business days, and usually the same day.

Changes to this policy

When we change this policy we update the effective date at the top of the page. If a change affects how we use information you have already given us, we will tell you directly and ask for consent where the law requires it.

Contact

Privacy Officer, DERA Collective