Privacy policy
Last updated 30 August 2026
This policy sets out how Heartbeat Media Solutions Inc. collects, uses, discloses and retains personal data in connection with hbms.co and the services provided through it, the lawful bases on which we rely, and the rights available to you.
Scope
This policy applies to personal data processed through hbms.co, the loyalty club, and any related service we operate. It does not apply to third party websites to which we may link, each of which is governed by its own privacy policy.
Where we process personal data on behalf of a client under a separate written agreement, we act as a processor and that agreement governs our processing. This policy addresses the personal data for which we act as controller.
Controller and contact details
The controller of the personal data described in this policy is Heartbeat Media Solutions Inc., a company incorporated in Ontario, Canada, with its registered office at 71 Noake Crescent, Ajax, Ontario, Canada.
Enquiries concerning this policy, and requests to exercise the rights set out below, should be directed to raymond@hbms.co.
Personal data we collect
Registration data
When you create an account we collect your name, your email address, the page from which you registered and the referring page. Where you consent to receive marketing communications, we additionally record the wording of the consent presented to you and the date and time on which it was given, as we are required to be able to evidence consent rather than merely assert it.
Authentication data
Access to the loyalty club is by means of a single-use code sent to your email address. That code, and a record of its expiry, are held in temporary storage for the limited period required to complete authentication and are then discarded.
Loyalty club activity data
Where you participate in games within the loyalty club we collect your score, the identity of the game and the date and time of play, recorded against your account. This data is necessary to operate leaderboards and rewards.
Correspondence and support data
Where you contact us, including through any assistant made available within the loyalty club, we collect the content of your message together with your name and email address so that we may respond and maintain a record of the enquiry.
Usage data
Where, and only where, you have accepted analytics cookies, we collect standard usage measurement through Google Tag Manager, including pages viewed and approximate location derived from IP address. No analytics is loaded in the absence of consent, and consent may be withdrawn at any time using the cookie preferences link in the footer.
Data we do not collect
We do not collect payment card details through this site, we do not acquire personal data from data brokers, and we do not track users across third party websites.
Lawful bases for processing
We process personal data only where a lawful basis applies. The bases on which we rely are set out below.
| Category of data | Lawful basis | Purpose of processing |
|---|---|---|
| Registration data | Performance of a contract | To create and administer the account you have requested and to provide access to the service. |
| Authentication data | Performance of a contract | To verify that a person requesting access to an account is entitled to it. |
| Loyalty club activity data | Performance of a contract | To operate games, leaderboards and rewards, which cannot function without a record of participation. |
| Marketing communications | Consent | To send information about our services where you have expressly opted in. Consent may be withdrawn at any time. |
| Usage and analytics data | Consent | To measure use of the site, where consent has been given through the cookie banner. |
| Correspondence and support data | Legitimate interests | To respond to enquiries and maintain a record of them. Our interest in answering correspondence is not overridden by your rights and freedoms. |
| Records retained after deletion | Legal obligation | To evidence marketing consent, to honour unsubscribe requests, and to satisfy financial and tax record-keeping requirements. |
Disclosure to third parties
We disclose personal data to a limited number of service providers engaged to operate the service. Each processes personal data on our documented instructions, is bound by contractual confidentiality and security obligations, and is not permitted to process it for its own purposes.
- Netlify provides hosting, receives form submissions, and provides the temporary storage used for authentication codes.
- Twenty is the customer record system in which accounts, activity data and enquiries are held.
- Resend transmits transactional email, including authentication codes.
- Anthropic processes messages submitted to the assistant within the loyalty club in order to generate a response.
- n8n, operated on our own infrastructure, routes registrations between these systems.
- Google Tag Manager provides usage measurement, and is loaded only following consent.
We may additionally disclose personal data where required to do so by law, by a court of competent jurisdiction or by a regulatory authority, or where necessary to establish, exercise or defend legal claims. In the event of a corporate transaction, personal data may be disclosed to a prospective purchaser subject to equivalent obligations of confidentiality.
We do not sell personal data, and we do not disclose individual records to sponsors or commercial partners. Information provided to sponsors is aggregated and describes the size and composition of an audience segment. It does not identify any individual.
International transfers
Certain of the service providers identified above operate outside Canada, including in the United States and the European Union, and personal data may accordingly be processed in those jurisdictions. Where personal data is transferred out of the United Kingdom or the European Economic Area, that transfer is made subject to appropriate safeguards, including standard contractual clauses where applicable.
Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected, or for such longer period as is required by law.
- Registration and loyalty club activity data is retained while the account remains open, and for a period of up to twelve months following a request to close it, in order to prevent inadvertent reinstatement.
- Authentication codes are retained only until they expire or are used, whichever occurs first.
- Records of marketing consent are retained for three years following withdrawal of consent, as Canadian anti-spam legislation requires that the existence of consent be capable of demonstration.
- Analytics data is retained in accordance with the retention period configured in Google Tag Manager, presently fourteen months.
Data deletion
You may request the deletion of personal data held about you at any time and are not required to give a reason. Requests should be sent to raymond@hbms.co from the address associated with the account, or by the contact route set out above. We will confirm in writing once the request has been actioned.
Data is erased within 30 days except where retention is required by law. That period applies to our production systems and to the customer record systems identified above. Encrypted backups are overwritten on their own cycle and in any event within a further sixty days, and no data is restored from backup into production use during that period.
The exceptions to erasure are limited to the following, and exist because they are required by law:
- Evidence of marketing consent. Canadian anti-spam legislation requires that the existence of consent be capable of demonstration. The record of consent is therefore retained for three years following its withdrawal. It is retained solely as evidence and is not used to contact you.
- Suppression records. Where you unsubscribe or request erasure, we retain the minimum data necessary to ensure that you are not subsequently re-added. In practice this comprises a one-way cryptographic hash of the email address and nothing further.
- Financial and tax records. Where a payment or contractual relationship exists, the associated records are retained for the period prescribed by Canadian tax legislation.
- Data subject to legal claims. Where personal data is the subject of an actual or reasonably anticipated legal claim, it is retained until that matter is resolved.
Personal data falling outside these exceptions is erased. Where a processor holds a copy, we instruct that processor to erase it on the same timetable. Data which has been aggregated such that it no longer identifies an individual does not constitute personal data and is not within the scope of an erasure request.
Your rights
Subject to the exceptions set out above, you have the right to:
- Obtain confirmation as to whether we process personal data about you, and a copy of that data.
- Require the rectification of inaccurate or incomplete personal data.
- Require the erasure of personal data.
- Withdraw consent at any time, including consent to marketing communications and to analytics cookies.
- Object to processing carried out on the basis of legitimate interests, or require that such processing be restricted.
- Receive personal data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
No fee is payable in respect of these rights. Requests should be sent to raymond@hbms.co and will be responded to within thirty days. We may request information reasonably necessary to verify your identity before actioning a request.
Complaints
If you are dissatisfied with our response, you are entitled to complain to a supervisory authority. In Canada, complaints may be made to the Office of the Privacy Commissioner of Canada. In the United Kingdom, to the Information Commissioner's Office. In the European Economic Area, to the supervisory authority of the member state in which you reside.
Marketing communications
We send marketing communications only where you have expressly consented to receive them. Every such communication identifies us, provides our contact details, and includes a functioning unsubscribe mechanism. Withdrawal of consent takes effect immediately and in any event no later than ten business days, being the period prescribed by Canadian anti-spam legislation.
Communications relating to your account, including authentication codes and notice of changes to this policy, are transactional rather than promotional and are sent irrespective of marketing preferences.
Cookies and local storage
No analytics cookie is set prior to consent. We use your browser's local storage to record your authenticated session and your cookie preference. That information remains on your device, is not transmitted to us, and is not used for tracking purposes.
Security
We maintain technical and organisational measures appropriate to the risk, including transport encryption, access control on a least-privilege basis, and the storage of credentials in a secrets manager rather than in source code. No method of transmission or storage is entirely secure, and we do not warrant absolute security.
Children
The service is directed at professionals working in sport and media and is not intended for children under the age of sixteen. We do not knowingly collect personal data relating to children. If you believe that a child has provided us with personal data, please notify us and we will erase it.
Amendments
We may amend this policy from time to time. Where an amendment materially affects the processing of your personal data, we will update this page, revise the date shown above and, where you hold an account, notify you by email.