Pre-launch working version. Proposed effective date and last update: July 19, 2026. No public drop is active. The final version must display the complete corporate identity, be approved by the privacy lead and receive the legal review required by the launch gate.
Operator and privacy lead
- Legal operator
- Confetio enr
- Mailing address
- 1029 rue Alphonse-Cyr, Sherbrooke (Québec) J1H 5C8
- General contact
- Use the contact form.
- Privacy lead
- Responsable de la protection des renseignements personnels
- Privacy requests and complaints
- Use the contact form.
1. Scope
This policy explains how Confetio handles personal information collected through its website, announcement list, drops, contact and brand inquiry forms, promotional coupons and winners page. It does not govern sponsor, merchant or social-platform websites reached through a link.
2. What we collect
- Sign-up and entry: first name, email, country, province or state, language, selected drop, and age and eligibility confirmations.
- Proof and preferences: acknowledgement of this policy and the rules, separate marketing choices, date and time, version and URL of the documents presented, and confirmation code.
- Abuse prevention: a one-way fingerprint of the IP address, a duplicate-prevention fingerprint and temporary rate-limit data. Confetio does not store the raw IP address in the form record; the hosting provider may retain it in technical logs.
- Brand inquiries: company, contact person, email, website, market and message.
- Messages: name, email, subject, message, language and receipt time.
- Draw and fulfilment: candidate status, skill-testing-question result, eligibility checks, information needed to deliver a prize and, only with authorization, the winner’s public name and region.
Confetio currently collects no payment, financial information, identity document, health data, precise location or biometric information through its public forms.
3. Why we use it
We use this information to record a voluntary request for announcements, administer an entry, enforce dates, territory and minimum age, prevent duplicates, send a service-related confirmation, select and verify a candidate, fulfil the prize, answer messages and produce aggregated campaign statistics. We may also preserve evidence needed to handle a complaint, fraud, dispute or legal obligation.
Required information is identified in each form. Without it, we cannot process the request or entry. Marketing choices never affect the odds of winning.
4. Screening and selection
The system automatically checks the drop period, declared country and province or state, confirmed minimum age and duplicate entries. After closing, it may randomly select a candidate from eligible entries. An administrator must then review the file and, in Canada, the skill-testing question before confirming a winner. You may request the main factors used or a human review through the Contact page.
5. Email and consent choices
A confirmation or follow-up required to administer an entry is not a general marketing subscription. Confetio news and sponsor offers use two separate, optional and unchecked choices. For the general announcement list, the person expressly asks to receive new drops. Every Confetio commercial message must identify the sender and include a working unsubscribe method.
If you authorize sponsor marketing, the form must identify its legal name and the rules must provide its contact details and explain what is shared. Unsubscribing through Confetio disables choices kept by Confetio. If information has already been shared with the sponsor, you must also use that sponsor’s unsubscribe method unless a synchronized withdrawal process is then offered.
6. Access, providers and disclosure
Only authorized administrators who need the information may view records. The pre-launch site is hosted by Web Hosting Canada. Hosting, backup, security, email, support or delivery providers may process the minimum needed to provide their service. The final email provider and processing locations will be published before activation.
A sponsor or carrier may receive information required to verify eligibility and fulfil a prize. Marketing information is provided to a sponsor only under the separate choice described above. Information may also be disclosed to professional advisers or authorities when legally required.
Before entrusting personal information outside Québec, Confetio must conduct a privacy impact assessment and put appropriate contractual safeguards in place. The relevant countries and providers will be identified when those choices are finalized.
7. Proposed retention
- Entries, confirmations and draw trail: normally 24 months after the drop closes, or longer while a documented complaint or obligation remains active.
- Winner file and proof of fulfilment: for the period required by applicable accounting, tax, contractual and dispute obligations.
- Messages: normally 12 months after the request is resolved.
- Brand inquiries: normally 24 months after the last useful interaction.
- Marketing profile: while subscribed; consent and withdrawal evidence is then kept for the period reasonably needed to demonstrate compliance, normally up to three years.
- Rate-limit data: about 10 minutes; a form-related IP fingerprint follows that record’s retention. Logs and backups follow the provider’s documented schedule.
When the purpose and any mandatory period end, information must be securely destroyed or anonymized as permitted by applicable law. This working schedule must be confirmed and implemented through a deletion procedure before the first real drop.
8. Security
Confetio uses measures such as HTTPS, non-public records, restricted administrative access, anti-bot and abuse controls, controlled administrative exports and a one-way IP fingerprint. No system can guarantee absolute security. An incident presenting a real risk of significant harm will be assessed, documented and reported to affected people and authorities when required.
9. Your rights
Depending on applicable law, you may request access, correction, portability of computerized information collected from you, withdrawal of consent, permitted deletion, information about an automated decision or submit a complaint. Reasonable identity verification may be required. The privacy lead will normally answer within Québec’s 30-day period. Use the Contact page and choose Privacy.
10. Minors
The announcement service and Confetio drops are intended for people aged 18 and older. Confetio does not seek to knowingly collect information from a child under 14 without required parental or guardian consent. A record identified as such will be closed and deleted when permitted.
11. Cookies, local storage and external links
The public site currently uses no advertising pixel or behavioural analytics and stores no preference in browser local storage. Essential WordPress and security functions may use technical cookies, particularly for administration. Share buttons and merchant links send information to the external site only after a click. That external site then applies its own policy.
12. Changes
The date and version of this policy will be updated when a practice changes. A material change will be brought to affected people’s attention through an appropriate method before it applies, and renewed consent will be requested when required.