Privacy Statement

Effective 9 August 2026 · Last updated 16 August 2026

Vortex Group operates the Sandbox VR locations in Toronto, Ontario and Vancouver, British Columbia as a franchisee of Sandbox VR. This statement explains what personal information we collect, why we collect it, who we share it with, and the choices you have.

It applies to information we collect when you book or visit one of our locations, sign a waiver, respond to one of our forms or surveys, contact us, apply for a job, or interact with us online. It is written to meet our obligations under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia’s Personal Information Protection Act (PIPA), and Canada’s Anti-Spam Legislation (CASL).

1. What we collect

Category	What it includes	Where it comes from
Booking information	Name, email address, phone number, party size, booking date and time, experience selected, promotion codes used	You, when you book online, by phone, or at the front desk
Waiver and check-in information	Name, email address, date of birth or age confirmation, the display name or handle you choose for gameplay, guardian details where a participant is a minor	You, through the waiver and check-in system operated by Sandbox VR (see section 4)
Gameplay media	Photographs and video recordings captured automatically during your session, including your likeness and your chosen display name	Generated in-store during your experience, by the Sandbox VR platform. The waiver you sign at check-in grants rights over this material — see section 3
Winner photographs	A photograph of you or your group, if you win one of our contests or draws and agree to be photographed	Taken in store by our staff, only with your permission at the time
Payment information	Confirmation that payment succeeded, the amount, the last digits and type of card	Our payment processor. We do not receive or store full card numbers.
Survey and contest entries	Answers you give, and the contact details you supply. For an in-store survey entry that is your name, email address, postal code and the booking code for your visit. For a free entry sent by mail it is your name, full mailing address, telephone number, email address and date of birth, handwritten on a card. Where the entrant is under the age of majority we also collect the name and signature of the parent or legal guardian who consents to the entry.	You, voluntarily, when you fill in one of our forms, or by mail for a free contest entry
Correspondence	Emails, messages, reviews and social media contact, and our replies	You
Video surveillance	CCTV footage of public and back-of-house areas of our premises, for safety and loss prevention	Cameras on our premises, which are signed at the entrance
Job applications	Résumé, contact details, work eligibility, references and interview notes	You, or a recruiting service you applied through
Website and analytics data	Aggregate traffic and advertising performance data	Advertising and analytics platforms we use, in aggregate form

We do not knowingly collect more than we need, and we do not sell personal information to anyone, ever.

2. Why we collect it

• To provide the experience you booked — confirming reservations, staffing sessions, matching you to your gameplay media, handling refunds and rescheduling.
• Safety and liability — waivers, age verification, incident records and video surveillance.
• To run our business — accounting, payroll, forecasting demand, scheduling staff and understanding which experiences and channels are working.
• To improve what we offer — survey responses and reviews tell us what to change. Survey answers are analysed in aggregate; we join them to booking records so we can understand patterns, not to build a profile of you. Where a survey response is also a contest entry, we additionally match it to the booking it relates to in order to check the entry is valid — see the contests bullet below.
• Gameplay media — under the waiver you sign at check-in, recordings of your session may be used to analyse and improve the experience, for statistical purposes, and for promotional purposes. Section 3 explains what this means in practice and what we actually do.
• To contact you — booking confirmations and service messages, and, if you have consented, promotional email about offers, events and new experiences.
• Advertising to our own guests — where you have consented to marketing, we may use your contact details to show you our own advertising on platforms such as Facebook, Instagram, Google and TikTok, and to avoid showing our ads to people who have already booked. Section 5 explains how this works and how to stop it.
• Contests and draws — to administer entries, to check an entry against our booking records so that it relates to a real visit, to verify eligibility and age, to notify winners, to publish the result, and — only where a winner agrees — to display a photograph in store showing that real people win.
• Hiring — assessing applications.
• Legal obligations — tax, employment and other records we are required to keep.

Consent

In most cases you give us information directly and it is obvious why. Where we rely on your consent — most importantly for marketing email — we ask for it separately, and you can withdraw it at any time. Withdrawing marketing consent does not stop us sending the transactional messages you need, such as a booking confirmation.

Every marketing email we send identifies us and includes a working unsubscribe link, as CASL requires. Unsubscribing takes effect promptly and permanently. Messages that are part of running a contest you entered — the result of a draw, and a prize or a code you have earned under the published rules — are notifications rather than marketing, and we send those whether or not you have unsubscribed.

3. Photographs and video

Two different things happen here, and they are handled differently.

Gameplay media

Our experiences record photographs and video of your session automatically, including your likeness and the display name you choose. This is captured and held by Sandbox VR’s platform, not ours. It is made available to your booking party after the session and may be shared onward by members of that party, and Sandbox VR may display it on leaderboards where other Sandbox VR players can see it. On entering the premises you should assume your session is being recorded.

What we actually do. Vortex Group does not use guest gameplay media in its own marketing. Anything you see of other guests in Sandbox VR advertising comes from Sandbox VR, under their privacy practices rather than ours. If that ever changes, we will change this page before it does, not after.

If you would rather we did not. Tell us and we will act on it. We will not use your gameplay media in our own marketing, and we will pass a removal request to Sandbox VR — who control the system that holds it — rather than leave you to chase it. You can also write to them directly at privacy@sandboxvr.com. We would rather be straight with you about the limits: the waiver gives rights we are choosing not to exercise, we cannot promise the same restraint on behalf of Sandbox VR, and anything already shared by someone in your own booking party is beyond either of us to retrieve.

Winner photographs

If you win one of our contests or draws, we may ask to photograph you or your group to display in store beside the prize, so that guests can see real people win. We will ask you at the time, and you are free to say no — declining does not affect your prize in any way. If you agree and later change your mind, tell us and we will take it down. We use these photographs only in our own stores and channels; we do not pass them to anyone else.

Publishing a result

When we run a draw we publish two things. The first is a redacted list of entries carrying a position number, an entry number and the date of the visit — or, for a free entry sent by mail, the date we received it — with no names and no contact details, so that anyone can check the draw was not tampered with. The second is the winners, shown by first name, entry number, the month, the store and that same date, so that a winner can recognise themselves. We never publish a surname, an email address, a telephone number or a booking code. The contest rules say all of this before you enter, and entering is your agreement to it.

The full entry list, which does contain names and contact details, is not published and is not released on request. We will produce it to a privacy regulator or a court, and to our professional advisors. Separately, we will show an entrant their own entry on request — but that is their own entry, not the list.

4. The Sandbox VR relationship

5. Who we share it with

We share personal information only where it is needed, and only with:

• Sandbox VR, our franchisor, for the systems described in section 4 and for franchise reporting. Our licensing agreement also permits Sandbox VR to access our in-store systems, including video surveillance, so that it can review the guest experience and check that we are meeting its standards. We are not aware of it having done so, but the right exists and you are entitled to know that.
• Service providers acting on our instructions — booking and reservation software, payment processing, email delivery, survey and forms tools, cloud storage and IT support, payroll and accounting providers. They may use the information only to perform the service, and are contractually bound to protect it.
• Professional advisors — accountants, auditors and lawyers, under a duty of confidentiality.
• Law enforcement, regulators or a court, where we are legally required to disclose, or where disclosure is necessary to investigate a suspected crime or protect someone’s safety.
• A purchaser, if our business or a location is sold or reorganised. Any purchaser would be bound to use the information for the same purposes.

Advertising platforms

Where you have consented to hear from us, we may provide your email address to advertising platforms — such as Meta (Facebook and Instagram), Google and TikTok — so that we can show our own advertising to our own guests, and so that we can avoid spending money advertising to people who have already booked.

When we do this, the email address is converted into an irreversible code before it leaves our systems. The platform compares that code against codes it holds for its own users, and uses the match only to decide who sees a Vortex advertisement. We do not send them your name, your booking history, or anything you told us in a survey.

Some platforms also offer to find new customers who resemble our existing ones. Where we use that, the platform works from the matched group as a whole; no individual guest is identified to anyone as a result.

You can stop this at any time, without unsubscribing from anything else — write to the Privacy Officer in section 9 and say you do not want your details used for advertising. You can also limit ad personalisation in your own account settings on each platform.

Beyond that, we do not disclose personal information to third parties for those parties’ own marketing purposes. An advertising platform receiving a matching code from us may use it to show you our advertising; it is not permitted to use it to market its own products or anyone else’s to you.

6. Storage outside Canada

Some of our service providers, and Sandbox VR itself, store or process data on servers located outside Canada, including in the United States. While information is in another country it is subject to that country’s laws, and may be accessible to courts, law enforcement and national security authorities there under the laws of that jurisdiction. We select providers that offer appropriate contractual and technical protections, but we cannot exempt them from local law. If you have questions about where a particular category of information is held, contact us and we will tell you what we know.

7. How long we keep it

We keep personal information only as long as it serves the purpose it was collected for, or as long as the law requires — whichever is longer. In practice:

• Booking and transaction records are kept for at least seven years, to meet Canadian tax and accounting requirements.
• Waivers and incident records are kept for the period of potential legal liability, which for a participant who was a minor at the time runs from the date they reach the age of majority.
• Video surveillance footage is retained for 60 days and then overwritten automatically, unless a specific clip is preserved for an active investigation, incident or claim.
• Marketing contact details are kept until you unsubscribe. We retain a minimal suppression record afterwards, so that we do not email you again by mistake.
• Unsuccessful job applications are kept for a limited period in case a suitable role opens, then destroyed.
• Gameplay media is held on Sandbox VR’s platform under their retention practices, not ours. We do not keep our own copy.
• Winner photographs are displayed for as long as the promotion runs, and are taken down on request at any time.
• Survey responses are retained in analysed form. Where we no longer need to identify an individual respondent, we remove the identifying fields.
• Contest entries are kept for the contest period they relate to plus twelve months, so that we can answer a query about a draw after the fact, and are then destroyed. Published winner details and redacted entry lists stay on our results page as a permanent record of each draw.
• Free entries sent by mail are paper records. They are held securely at our premises for the same period and then shredded.

When information reaches the end of its retention period we destroy, erase or de-identify it.

8. How we protect it

We use security measures appropriate to the sensitivity of the information: access is limited to staff who need it for their role, business systems require multi-factor authentication, data is encrypted in transit and at rest in our cloud environment, payment card data is handled entirely by our payment processor and never touches our own systems, and physical records are kept secured on our premises.

No safeguard is absolute. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the relevant privacy commissioner as the law requires.

9. Your rights, and how to use them

You may:

• Ask what we hold about you, and get a copy, along with an account of how it has been used and to whom it has been disclosed.
• Ask us to correct anything inaccurate or incomplete.
• Withdraw consent to a use — most commonly marketing email, or the use of your details for advertising described in section 5 — subject to legal and contractual limits, which we will explain if any apply. One such limit is worth naming here rather than leaving you to find it: the waiver signed at check-in grants rights over gameplay media that it does not, on its face, let you take back. Section 3 sets out what we will do about that in practice.
• Ask us to delete information we no longer have a legal or business reason to keep.
• Complain about how we have handled your information.

Write to our Privacy Officer:

If you are not satisfied with our response

You can complain to the privacy regulator with jurisdiction:

• Office of the Privacy Commissioner of Canada — for our Toronto location and for federally regulated matters. priv.gc.ca, 1-800-282-1376.
• Office of the Information and Privacy Commissioner for British Columbia — for our Vancouver location. oipc.bc.ca, 250-387-5629.

10. Children

Our experiences have minimum age requirements, and participants below the age of majority require a waiver signed by a parent or legal guardian. Our contests are open from 13 years of age, so information about a minor can reach us by more than one route. It reaches us through the waiver and check-in needed for them to take part safely, and the gameplay media recorded during the session it covers; through a contest entry made in store after a visit, where the waiver signed at check-in is the guardian’s consent to it; and through a free contest entry sent by mail, which the entrant makes themselves and which, where the entrant is under the age of majority, a parent or legal guardian signs to consent to. In each of those a parent or legal guardian has consented, and we collect only what the purpose needs. Section 1 sets out in full what we collect and where each category comes from. Marketing email is sent only to someone who has consented to receive it, and every one of those messages carries an unsubscribe link that works. If you are a parent or guardian and would rather we held nothing about your child, write to the Privacy Officer in section 9: we will delete what we are not required to keep, and tell you what we are.

11. Forms and surveys

Where we collect information through an online form or survey, the form itself will tell you what is being collected and why. Answering is voluntary unless the form states that a field is required to complete a booking or entry. Form responses are collected in our Microsoft 365 environment, and are also copied into our own business records so that we can analyse them and keep track of who has asked not to hear from us. Both are covered by this statement. Contest entries sent by mail are not collected through that system: they are handled as paper records, entered into our own business records for the draw, and then retained and destroyed as set out in section 7.

12. Changes to this statement, and other documents you may have seen

We will update this statement when our practices change. The effective date at the top always reflects the current version. If a change materially affects how we use information you have already given us, we will take reasonable steps to bring it to your attention rather than relying on you to re-read this page.

If you have seen an older privacy policy of ours, this one is the current statement of our practices. A shorter privacy and data collection policy has been attached as a schedule to the waiver signed at check-in. Where the two describe our practices differently, this page is the one we stand behind, and it is the one we keep up to date. Nothing here is intended to reduce any right the law gives you.