Privacy Policy

This Privacy Policy describes how Popcorn Universe Inc. ("Popcorn Universe", "we", "our", or "us") collects, uses, stores, and protects personal information provided through our waitlist registration at popcornuniverse.ca and any associated communications.

Popcorn Universe is a Canadian technology startup developing an all-in-one entertainment booking application for movies, live theatre, stand-up comedy, concerts, and sporting events across Canada. We are headquartered in Waterloo, Ontario, Canada.

This policy has been prepared in accordance with Canada's federal privacy law — the Personal Information Protection and Electronic Documents Act (PIPEDA), R.S.C. 2000, c. 5, and Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23. By submitting your information through our waitlist form, you acknowledge that you have read and understood this policy.

When you sign up for the Popcorn Universe waitlist, we collect only the following personal information. We practice data minimization — we collect no more than what is necessary for the stated purposes.

Under PIPEDA Principle 2 (Identifying Purposes), we are required to identify the purpose for collecting personal information at or before the time of collection. The purposes for collecting your name, email address, and city are:

• Waitlist Management: To maintain an accurate, ordered record of individuals who have expressed interest in Popcorn Universe ahead of our public launch.
• Email Communications: To send you relevant updates, announcements, and campaigns as described in Section 4 below, for which you have provided express consent.
• Market Analysis: To conduct internal, anonymized analysis of geographic demand across Canadian cities, which informs our launch sequencing and feature prioritization. This analysis uses aggregated, anonymized data and does not identify individual users.
• Business Development: To understand and report on early audience interest to potential investors, partners, and internal stakeholders. Any reporting uses aggregate statistics only — no individual personal data is disclosed.
• Product Development: To inform which cities, entertainment categories, and features to prioritize in the Popcorn Universe app. Insights are derived from anonymized, aggregated data (e.g., "42% of waitlist signups are from Toronto").

We will not use your personal information for any purpose other than those stated above without first obtaining your explicit consent for the new purpose.

Your email address is the primary channel through which we communicate with you. By submitting the waitlist form, you expressly consent to receiving the following categories of Commercial Electronic Messages (CEMs) as defined under CASL:

Transactional & Welcome Communications

• Waitlist Confirmation: A thank-you email confirming your successful registration on the Popcorn Universe waitlist, including your position and what to expect next.

Product & Service Updates

• App Launch Announcement: Notification when the Popcorn Universe mobile app becomes available for download, including early access instructions for waitlist members.
• Website Release Updates: Updates on the launch of the Popcorn Universe web platform, new features, beta access opportunities, and major product milestones.
• Waitlist Status Updates: Communications about your position on the waitlist, estimated access timelines, and any changes to the launch schedule.

Entertainment & Content Campaigns

• Upcoming Movies & Releases: Curated information about highly anticipated film releases, opening dates, IMAX availability, and booking opportunities relevant to your city.
• Entertainment News & Events: Updates about concerts, stand-up comedy shows, live theatre performances, and sporting events coming to your region.
• Exclusive Pre-Launch Content: Sneak peeks, behind-the-scenes updates, and exclusive previews of the Popcorn Universe app experience.

Future Opt-In Campaigns

• Additional Email Campaigns: Any future email campaigns beyond the categories listed above (such as promotional offers, loyalty programs, or partner announcements) will only be sent if you separately and explicitly opt in at the time those campaigns are introduced. Your consent to the waitlist does not constitute consent to all future marketing communications.

Under both PIPEDA Principle 3 (Consent) and CASL Section 10, consent must be express, informed, and freely given. Popcorn Universe uses express opt-in consent — the highest standard recognized under Canadian law.

How We Obtain Consent

When you submit the waitlist registration form, you are presented with a clear and accurate description of what you are consenting to, including the categories of emails listed in Section 4. Submission of the form constitutes your express consent to receive those communications. Checkboxes are never pre-ticked. No consent is assumed by default.

What We Record

As required by CASL, we maintain a verifiable consent record for each signup that includes:

• Date and time of form submission
• The specific consent language presented at the time of signup
• Source URL of the form (our waitlist page)
• An anonymized identifier confirming the submission originated from a human interaction

Renewing Consent

If we identify a new purpose for using your personal information that was not disclosed at the time of collection, we will contact you to obtain fresh, informed consent for that new purpose before proceeding. We will not use your data in ways that were not clearly described at signup.

Under PIPEDA Principle 5 (Limiting Use, Disclosure, and Retention), we will not use or disclose your personal information for purposes other than those for which it was collected, except with your consent or as required by law.

We Do Not Sell or Share Your Data

Popcorn Universe will never sell, rent, trade, or license your personal information — including your email address, name, or city — to any third party for their own marketing, advertising, or commercial purposes. This is a firm commitment and a core principle of how we operate.

Service Providers (Data Processors)

We may use carefully selected third-party service providers to assist with specific technical functions necessary to operate our waitlist and email communications. These providers act strictly as data processors on our behalf, meaning they may only process your data according to our written instructions and for no other purpose. They include:

• Email Delivery Services: To send transactional and marketing emails (e.g., a platform like Mailchimp, Klaviyo, or similar). These providers receive your email address and name for the sole purpose of delivering emails you have consented to receive.
• Data Storage & Hosting: Secure cloud infrastructure providers (such as AWS or Google Cloud) to store waitlist data securely.
• Analytics Tools: Anonymized, aggregated analytics to understand engagement with our emails (e.g., open rates, click rates at an aggregate level). No individual user data is profiled.

All service providers are contractually bound to handle your data in accordance with PIPEDA, maintain appropriate security safeguards, and immediately notify us of any data breach.

Legal Disclosure

We may disclose your personal information without your consent only where required by law — for example, if compelled by a valid court order, warrant, or other legally binding government authority. In any such case, we will disclose only the minimum information necessary and will notify you as permitted by law.

Business Transfers

In the event of a merger, acquisition, or sale of Popcorn Universe's assets, your personal information may be transferred to the acquiring entity. You will be notified by email prior to such a transfer and given the opportunity to withdraw consent and request deletion of your data.

Under PIPEDA Principle 5, personal information shall be retained only as long as necessary for the fulfilment of the purposes for which it was collected.

When your data is no longer required, it will be securely deleted or rendered permanently anonymous using industry-standard methods. We do not archive personal data beyond its stated retention period.

Under PIPEDA Principle 7 (Safeguards), personal information must be protected by security safeguards appropriate to the sensitivity of the information. Popcorn Universe implements the following technical and organizational measures to protect your data:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS). We do not accept unencrypted connections.
• Encryption at Rest: Waitlist data stored in our systems is encrypted at rest using AES-256 or equivalent standards.
• Access Controls: Access to personal data is restricted to authorized personnel only, on a strict need-to-know basis. All access is logged and reviewed.
• Data Minimization: We collect and retain only the minimum personal data necessary. We do not store full IP addresses, device fingerprints, or behavioral tracking data at the waitlist stage.
• Third-Party Security Obligations: All service providers are contractually required to maintain security standards consistent with or exceeding our own.
• Breach Response: In the event of a security breach involving your personal information that poses a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada (OPC) promptly, in accordance with PIPEDA's mandatory breach reporting requirements.
• Regular Review: Our security practices are reviewed regularly as our systems and threat landscape evolve.

Under PIPEDA Principles 9 (Individual Access) and 10 (Challenging Compliance), you have the following rights with respect to your personal information held by Popcorn Universe. These rights may be exercised at any time by contacting us at the address in Section 14.

We will respond to all privacy rights requests within 30 days of receipt. If additional time is required (e.g., for complex access requests), we will notify you within 30 days and provide an updated timeline. There is no charge for reasonable access requests.

Under CASL Section 11, every commercial electronic message we send must include a clearly visible, functional unsubscribe mechanism. Popcorn Universe complies with this requirement in the following ways:

• Unsubscribe Link in Every Email: Every marketing and promotional email we send includes a clear "Unsubscribe" link in the footer. Clicking this link will immediately record your opt-out request.
• 10-Business-Day Processing: As required by CASL, we will give effect to all unsubscribe requests within 10 business days of receipt. You will not receive further commercial electronic messages after this period.
• Email-Based Requests: You may also unsubscribe by sending a request to privacy@popcornuniverse.ca with "Unsubscribe" in the subject line. Please include the email address you wish to unsubscribe.
• Suppression List: Upon unsubscribing, your email address is added to our suppression list. This means it is retained solely to ensure we never contact you again — it is not used for any other purpose.
• Partial Opt-Out: Once we offer multiple types of email campaigns, you will have the option to unsubscribe from specific campaign types (e.g., promotional emails) while continuing to receive others (e.g., critical account notifications).

The Popcorn Universe waitlist and associated communications are intended for individuals who are 13 years of age or older. We do not knowingly collect personal information from children under the age of 13.

If you are a parent or guardian and believe your child has submitted personal information to our waitlist without your consent, please contact us immediately at privacy@popcornuniverse.ca. We will take prompt steps to verify the situation and, if confirmed, delete the relevant information from our records.

When the Popcorn Universe app launches, age-gating and enhanced parental consent mechanisms will be implemented in accordance with applicable Canadian law for any features or content accessible to minors.

We may update this Privacy Policy from time to time as our practices evolve, as the Popcorn Universe service expands, or as required by changes in Canadian privacy law.

Under PIPEDA Principle 8 (Openness), we are obligated to make information about our privacy policies and practices readily available. When we make material changes to this policy, we will:

• Post the updated policy on this page with a revised "Last Updated" date
• Send an email notification to all waitlist subscribers describing the nature of the change
• Where a change involves a new use of your personal information, obtain fresh consent before that new use begins

Your continued use of our services or continued membership on the waitlist after we post an updated policy constitutes your acknowledgment of the changes. Non-material changes (such as formatting updates or clarifications that do not affect how your data is used) will be posted without individual notification.

This Privacy Policy has been prepared with reference to the following Canadian laws, regulations, and official guidance:

• PIPEDA: Personal Information Protection and Electronic Documents Act, R.S.C. 2000, c. 5 — Canada's primary federal private-sector privacy law. Governs the collection, use, and disclosure of personal information in the course of commercial activities.
• CASL: Canada's Anti-Spam Legislation, S.C. 2010, c. 23 — Governs the sending of commercial electronic messages, requiring express or implied consent, sender identification, and unsubscribe mechanisms.
• OPC Guidelines: Office of the Privacy Commissioner — Guidelines for Obtaining Meaningful Consent (May 2018).
• CRTC Guidance: CRTC Guidance on CASL Implied Consent — Canadian Radio-Television and Telecommunications Commission.
• ISED CASL Guidance: Innovation, Science and Economic Development Canada — Getting Consent to Send Email.
• PIPEDA Mandatory Breach Reporting: Breach of Security Safeguards Regulations, SOR/2018-64 — Governs our obligation to report privacy breaches to the OPC and notify affected individuals.

Popcorn Universe is accountable under PIPEDA Principle 1 (Accountability) for all personal information under its control. Our Privacy Officer is responsible for ensuring compliance with these obligations and for handling all privacy-related inquiries and complaints.

For any privacy-related questions, concerns, access requests, correction requests, or complaints, please contact our Privacy Officer. We will acknowledge your request within 5 business days and provide a substantive response within 30 days.

Filing a Complaint with the OPC

If you are not satisfied with our response to a privacy concern, you have the right to file a formal complaint with the Office of the Privacy Commissioner of Canada:

• Website: www.priv.gc.ca/en/report-a-concern/
• Toll-Free: 1-800-282-1376
• TTY: 819-994-6591