Privacy Policy

The Existential Art Gallery of Scarborough, Inc.

Operating as Gallery X Scarborough — Privacy Policy

Effective and updated August 1, 2026. This policy replaces the version dated January 1, 2023.

Scope

The Gallery X Scarborough site (the "Site") is owned and operated by The Existential Art Gallery of Scarborough, Inc., a Canadian not-for-profit registered in Ontario. This policy applies to all visitors, members, and donors, regardless of location. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) for all users, and additionally with the EU/UK General Data Protection Regulation (GDPR) for users in the EU/UK, and the California Consumer Privacy Act (CCPA/CPRA) for California residents, as described below.

Consent

By using this Site, subscribing to our newsletter, becoming a member, or making a donation, you agree to the terms of this Privacy Policy.

Information We Collect

Automatically collected ("Device Information"): browser and device type, IP address, time zone, referring pages, and cookies. Collected via cookies, log files, and pixels/web beacons, as described under Cookies below.

Information you provide to us:

• Newsletter signup: name and email address, processed via Ghost's built-in newsletter feature and delivered through Mailgun, our email delivery provider.
• Membership accounts: name, email address, membership tier, and signup date, stored in Ghost.
• Paid memberships and donations: billing name, email, and payment method details are collected and processed directly by Stripe, our payment processor. We do not store your full card number; Stripe shares with us only the information needed to confirm your membership status or donation (e.g., last 4 digits, amount, date).
• Comments (if enabled): your name, email, and comment content.

Cookies

We use essential cookies required for member sign-in and site function; these do not require consent. If we introduce analytics or marketing cookies in the future, we will only set them with your consent via a cookie banner. Cookies do not contain your personal information directly; they reference data held securely on our systems or our providers' systems.

Other Websites and Embedded Content

Our Site may include embedded content (e.g., YouTube videos) or links to other sites (e.g., Instagram, Facebook, LinkedIn). Visiting those sites is subject to their own privacy policies; they may set their own cookies.

How We Use Your Information

Device information helps us understand Site usage, improve performance, and detect fraud. Personal information you provide is used to: send you newsletters and updates about exhibitions and events; process and confirm memberships and donations; issue donation/tax receipts where applicable; and respond to your inquiries. We do not sell or rent your personal information to third parties.

Sharing Information

We share information only with: staff and volunteers who need it to run the organization; our service providers (Ghost(Pro) — website hosting and membership platform; Mailgun — newsletter delivery; Stripe — payment processing for memberships and donations), each of whom processes data on our behalf under their own privacy and security commitments; and when required by law.

International Data Transfers

Our website hosting and membership platform, Ghost(Pro), stores and processes data on servers located in Amsterdam, Netherlands (European Union). Our other service providers, Mailgun (newsletter delivery) and Stripe (payment processing), may process and store data in the United States, Canada, and other countries where they operate. Where personal information is transferred outside Canada or the European Economic Area/UK, we rely on standard contractual clauses or equivalent safeguards provided by these processors.

Your Rights

Canada (PIPEDA): You may request access to, or correction of, your personal information at any time by contacting us.

EU/UK (GDPR): You have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You may also lodge a complaint with your local data protection supervisory authority.

California (CCPA/CPRA): You have the right to know what personal information we collect, request deletion or correction, and opt out of any sale or sharing of personal information. We do not sell or share personal information as defined under CCPA.

To exercise any of these rights, contact us at privacy@galleryxscarborough.com.

Data Retention

We retain member and donor information for as long as your membership is active or as needed to fulfill the purposes described in this policy, and afterward as required to meet our legal, accounting, and tax recordkeeping obligations. Newsletter subscriber information is retained until you unsubscribe.

Protecting Your Information

We take reasonable, industry-standard steps to protect your information, and rely on the security practices of Ghost(Pro), Mailgun, and Stripe (all of which maintain their own security certifications) for data they process on our behalf. No method of transmission over the internet is 100% secure.

Children's Privacy

We do not knowingly collect personal information from anyone under sixteen (16) years of age. If we learn we have collected such information, we will delete it. Parents or guardians who believe their child has provided us information should contact us.

Marketing Emails (CASL)

We send newsletters only to those who have given express or implied consent. Every newsletter includes a one-click unsubscribe link and identifies Gallery X Scarborough as the sender, in accordance with Canada's Anti-Spam Legislation (CASL).

Policy Updates

We may amend this policy to reflect changes in our practices or legal requirements. The effective date at the top will be updated accordingly. We encourage you to review this policy periodically.

Concerns

If you have concerns about our Site or this policy, contact us at privacy@galleryxscarborough.com.