Top Tier Boxing Club, operated by Club de Boxe TopTier inc.
8050 Boul Taschereau, Local N, Brossard (Québec) J4X 1C2, Canada
Phone: 1 514-224-7238 — Email: [email protected]
This Privacy Policy explains how Club de Boxe TopTier inc., doing business as Top Tier Boxing Club ("we", "us"), collects, uses, discloses, and protects your personal information when you use our website, member portal, and gym services — whether you are a member, a free-trial visitor, an event ticket buyer, a sparring participant, or a person who contacts us. We are subject to Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25, and, where applicable, to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).
1. Privacy Officer
In accordance with Law 25, we have designated a person responsible for the protection of personal information:
Privacy Officer: The management of Club de Boxe TopTier inc.
Mail: Privacy Officer, Club de Boxe TopTier inc., 8050 Boul Taschereau, Local N, Brossard (Québec) J4X 1C2
Phone: 1 514-224-7238
The Privacy Officer oversees our compliance with privacy laws and handles all requests and complaints relating to personal information.
2. Personal Information We Collect
We collect only the information necessary for the purposes described in this Policy:
Identity information: first and last name, date of birth (to verify age requirements, apply guardian rules for minors, and adapt training where relevant).
Emergency contact: the name and phone number of a person to contact in case of emergency, collected when you sign the Membership Agreement.
Payment information: payments are processed by Stripe. Your card details are transmitted directly to Stripe and never touch our servers. We retain only non-sensitive references such as the payment status, the last four digits and brand of your card, and Stripe customer and transaction identifiers.
Membership and attendance information: membership type, billing history, class bookings, check-ins, attendance records, and credit balances.
Signed agreements: the full text of the agreement as you signed it, your signed name, date of birth, guardian information for minors, emergency contact, and the date, IP address, and browser identification of the signature — kept as tamper-evident proof of signature.
Sparring fighter profile: if you register for a sparring session — name, email, weight, age, number of fights, and boxing club.
Event ticket orders: purchaser name, email, tickets purchased, any donation amount, and QR check-in status.
Leads and contact forms: name, email, phone, and message when you submit our contact form or request a free trial before creating an account.
Photos you upload: such as a profile photo, stored on our behalf by Cloudflare R2.
Health-related disclosures: any medical condition or limitation you choose to disclose to us for safety purposes. We ask that you disclose only what is relevant to your safe participation.
Anti-fraud verification data: because the free trial is limited to one per person, we record your normalized email, a one-way digest (hash) of your last name and date of birth, your phone number, a card fingerprint provided by Stripe (not your card number), and hashed IP and device identifiers. These values only allow us to recognize a repeat redemption; they are not used for any other purpose.
Technical information: log data, email delivery status (sent, delivered, bounced), and cookie data as described in section 9. Administrative actions on your file are recorded in an audit log.
We do not collect personal information from third parties without your consent, and we never sell your personal information.
3. Purposes of Collection and Use
We use your personal information to:
create and manage your account, membership, bookings, and gym access;
process payments, issue receipts, and manage billing (via Stripe);
send transactional messages: receipts, booking and ticket confirmations, schedule changes, account and security notices, and agreement updates (via Resend, our email provider);
reach your emergency contact if an incident occurs;
adapt coaching to age or disclosed medical limitations, for your safety;
organize events and sparring sessions, deliver and validate tickets, and manage entry;
enforce the one-free-trial-per-person limit and prevent fraud and abuse;
follow up on free-trial requests and incomplete signups you initiated;
send marketing communications — promotions, the newsletter, sparring invitations, class reminders, and SMS campaigns — only with your consent, which you may withdraw at any time (see section 4);
measure the performance of our website and advertising (see section 9);
comply with our legal obligations, including tax and accounting requirements;
establish, exercise, or defend legal claims, including in connection with the signed liability waiver.
We do not use your personal information for other purposes without your consent, unless permitted or required by law.
4. Marketing Consent (CASL)
Marketing email is organized in categories (promotions, newsletter, sparring invitations, class reminders). You choose your categories in the member portal, and every marketing email includes an unsubscribe link. Unsubscribing from marketing never affects transactional messages.
We use your mobile number to text you: transactional messages answering a request you made (such as confirming a free-trial request), and marketing campaigns, which are sent only with your express consent. Every message lets you opt out by replying STOP, and we record that opt-out against your number so it applies across the club's systems. Message and data rates may apply.
Unsubscribe requests are honoured without delay, and at the latest within 10 business days.
5. Third-Party Service Providers and Transfers Outside Québec
We entrust personal information to service providers who process it on our behalf, under contracts requiring protection equivalent to this Policy:
Provider
Role
Information involved
Stripe
Payment processing
Name, email, payment data (held by Stripe), card fingerprint
Resend
Transactional and consented marketing email
Name, email address, message content, delivery status
Cloudflare (R2)
Storage of uploaded images
Photos you upload
Railway
Application and database hosting
Account, membership, and event data
Meta Platforms
Advertising measurement (Facebook/Instagram), where enabled
Site usage events and hashed identifiers (see section 9)
Google
Display of our Google reviews on our site
No information about you is sent to Google for this purpose
These providers may store or process personal information on servers located outside Québec, including elsewhere in Canada and in the United States. Before communicating personal information outside Québec, we assess the sensitivity of the information, the purposes of its use, and the legal framework of the destination, as required by Law 25. Information transferred outside Québec may be subject to the laws of the jurisdiction where it is held.
6. Retention Periods
We keep personal information only as long as necessary for the purposes for which it was collected, and then destroy it or anonymize it securely:
Account and membership records: for the duration of your membership and up to 3 years after your last activity, corresponding to the general limitation period under Québec law.
Signed agreements and waivers:3 years after the end of your membership, or longer where necessary for the defence of legal claims.
Billing and tax records:7 years, as required by tax legislation.
Event and ticket records: up to 3 years after the event, for accounting and dispute purposes.
Uploaded photos: until you delete them or your account is closed, after which they are deleted from storage within a reasonable delay.
Emergency contact and health disclosures: for the duration of your membership, then deleted with your account records.
Anti-fraud trial records: these minimal, largely hashed records are kept even if your account is deleted, because deleting them would defeat the one-trial-per-person limit. They cannot be used to reconstruct your identity.
Email logs and audit logs: up to 3 years, for security and dispute purposes.
7. Your Rights
Subject to the exceptions provided by law, you have the right to:
Access the personal information we hold about you;
Rectify information that is inaccurate, incomplete, or ambiguous;
Withdraw consent to uses that are not necessary to provide our services, including marketing;
Request deletion (de-indexing/cessation of dissemination) of your information where the law permits, including when the purposes of collection have been fulfilled;
Data portability: obtain computerized personal information you provided to us in a structured, commonly used technological format, as provided by Law 25;
Complain to the Privacy Officer, and to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada if you are not satisfied with our response.
8. How to Exercise Your Rights
Send a written request to the Privacy Officer at [email protected] (subject "Privacy") or by mail to the address in section 1. We may need to verify your identity before responding. We will respond within 30 days of receiving your request. If we refuse a request in whole or in part, we will provide the reasons and the recourses available to you. You may also update basic profile information directly in the member portal.
9. Cookies and Tracking Technologies
Strictly necessary cookies: used to keep you signed in, secure your session, and remember essential preferences (such as language). These are required for the portal to function.
Advertising and measurement (Meta Pixel and Conversions API): where enabled, our website uses Meta's tools to measure the performance of our Facebook and Instagram advertising (for example, that a visit or purchase occurred). This may involve cookies and the transmission of site events and hashed identifiers to Meta Platforms. Where consent is required by law, we request it before activating these technologies. You can also limit this tracking through your browser settings and your Facebook/Instagram ad preferences (facebook.com/adpreferences).
Embedded content: our site may display our Instagram feed and our Google reviews. Interacting with embedded content from these platforms is subject to their own privacy policies.
You can configure your browser to refuse or delete cookies; some portal features may stop working as a result.
10. Safeguards
We apply security measures proportionate to the sensitivity of the information, including encryption of data in transit, hashing of anti-fraud identifiers, access controls limiting access to staff who need it, audit logging of administrative actions, hosting with reputable providers, and contractual safeguards with processors. No system is perfectly secure; we cannot guarantee absolute security.
11. Confidentiality Incidents
If a confidentiality incident involving your personal information presents a risk of serious injury, we will notify the Commission d'accès à l'information and the affected persons, as required by Law 25, and take reasonable measures to reduce the risk of harm. We maintain a register of confidentiality incidents.
12. Minors
Information concerning members under 18 — including participants in our kids program — is collected with the consent of a parent or guardian, who signs the Membership Agreement, except where the law allows a minor 14 or older to consent alone. We do not knowingly send marketing communications to minors under 14.
13. Changes to This Policy
We may update this Policy from time to time. The current version, with its revision date, will always be available on our website. Material changes will be communicated through the Services or by email.
14. Contact
For any question about this Policy or your personal information, contact the Privacy Officer: [email protected] (subject "Privacy"), 1 514-224-7238, or by mail at 8050 Boul Taschereau, Local N, Brossard (Québec) J4X 1C2. If you are not satisfied with our response, you may contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
