Vortex Group

Privacy Statement

Effective 7 August 2026 · Last updated 7 August 2026

Vortex Group operates the Sandbox VR locations in Toronto, Ontario and Vancouver, British Columbia as a franchisee of Sandbox VR. This statement explains what personal information we collect, why we collect it, who we share it with, and the choices you have.

It applies to information we collect when you book or visit one of our locations, sign a waiver, respond to one of our forms or surveys, contact us, apply for a job, or interact with us online. It is written to meet our obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA), and Canada's Anti-Spam Legislation (CASL).

1. What we collect

Category	What it includes	Where it comes from
Booking information	Name, email address, phone number, party size, booking date and time, experience selected, promotion codes used	You, when you book online, by phone, or at the front desk
Waiver and check-in information	Name, email address, date of birth or age confirmation, the display name or handle you choose for gameplay, guardian details where a participant is a minor	You, through the waiver and check-in system operated by Sandbox VR (see section 4)
Gameplay media	Photographs and video recordings captured automatically during your session, including your likeness and your chosen display name	Generated in-store during your experience, by the Sandbox VR platform (see section 3)
Winner photographs	A photograph of you or your group, if you win one of our contests or draws and agree to be photographed	Taken in store by our staff, only with your permission at the time
Payment information	Confirmation that payment succeeded, the amount, the last digits and type of card	Our payment processor. We do not receive or store full card numbers.
Survey and contest entries	Answers you give, and any contact details you supply, such as name, email address and postal code	You, voluntarily, when you fill in one of our forms
Correspondence	Emails, messages, reviews and social media contact, and our replies	You
Video surveillance	CCTV footage of public and back-of-house areas of our premises, for safety and loss prevention	Cameras on our premises, which are signed at the entrance
Job applications	Résumé, contact details, work eligibility, references and interview notes	You, or a recruiting service you applied through
Website and analytics data	Aggregate traffic and advertising performance data	Advertising and analytics platforms we use, in aggregate form

We do not knowingly collect more than we need, and we do not sell personal information to anyone, ever.

2. Why we collect it

To provide the experience you booked — confirming reservations, staffing sessions, matching you to your gameplay media, handling refunds and rescheduling.
Safety and liability — waivers, age verification, incident records and video surveillance.
To run our business — accounting, payroll, forecasting demand, scheduling staff and understanding which experiences and channels are working.
To improve what we offer — survey responses and reviews tell us what to change. Survey answers are analysed in aggregate; we join them to booking records so we can understand patterns, not to build a profile of you.
To contact you — booking confirmations and service messages, and, if you have consented, promotional email about offers, events and new experiences.
Contests and draws — to administer entries, verify eligibility, notify winners, and — only where a winner agrees — to display a photograph in store showing that real people win.
Hiring — assessing applications.
Legal obligations — tax, employment and other records we are required to keep.

Consent

In most cases you give us information directly and it is obvious why. Where we rely on your consent — most importantly for marketing email — we ask for it separately, and you can withdraw it at any time. Withdrawing marketing consent does not stop us sending the transactional messages you need, such as a booking confirmation.

Every marketing email we send identifies us and includes a working unsubscribe link, as CASL requires. Unsubscribing takes effect promptly and permanently.

3. Photographs and video

Two different things happen here, and they are handled differently.

Gameplay media

Our experiences record photographs and video of your session automatically. This is captured and held by Sandbox VR's platform, not ours. It is made available to your booking party after the session and may be shared onward by members of that party, and Sandbox VR may display it on leaderboards where other Sandbox VR players can see it. On entering the premises you should assume your session is being recorded.

Vortex Group does not use guest gameplay media in its own marketing. Anything you see of other guests in Sandbox VR advertising comes from Sandbox VR, not from us. If you want your gameplay media removed, tell us and we will pass the request to Sandbox VR, who control that system, rather than leave you to chase it — and you can also contact them directly at privacy@sandboxvr.com.

Winner photographs

If you win one of our contests or draws, we may ask to photograph you or your group to display in store beside the prize, so that guests can see real people win. We will ask you at the time, and you are free to say no — declining does not affect your prize in any way. If you agree and later change your mind, tell us and we will take it down. We use these photographs only in our own stores and channels; we do not pass them to anyone else.

4. The Sandbox VR relationship

Vortex Group is an independent franchisee. Some of the systems we use to serve you — including the waiver and check-in platform, the gameplay media platform and parts of the booking flow — are operated by Sandbox VR, our franchisor, not by us. Personal information you enter into those systems is handled under Sandbox VR's own privacy practices as well as this statement.

Where you contact us about information held in a Sandbox VR system, we will help you reach the right party and will pass on your request rather than leave you to chase it.

5. Who we share it with

We share personal information only where it is needed, and only with:

Sandbox VR, our franchisor, for the systems described in section 4 and for franchise reporting.
Service providers acting on our instructions — booking and reservation software, payment processing, email delivery, survey and forms tools, cloud storage and IT support, payroll and accounting providers. They may use the information only to perform the service, and are contractually bound to protect it.
Professional advisors — accountants, auditors and lawyers, under a duty of confidentiality.
Law enforcement or regulators, where we are legally required to disclose, or where disclosure is necessary to investigate a suspected crime or protect someone's safety.
A purchaser, if our business or a location is sold or reorganised. Any purchaser would be bound to use the information for the same purposes.

We do not disclose personal information to third parties for their own marketing purposes.

6. Storage outside Canada

Some of our service providers, and Sandbox VR itself, store or process data on servers located outside Canada, including in the United States. While information is in another country it is subject to that country's laws, and may be accessible to courts, law enforcement and national security authorities there under the laws of that jurisdiction. We select providers that offer appropriate contractual and technical protections, but we cannot exempt them from local law. If you have questions about where a particular category of information is held, contact us and we will tell you what we know.

7. How long we keep it

We keep personal information only as long as it serves the purpose it was collected for, or as long as the law requires — whichever is longer. In practice:

Booking and transaction records are kept for at least seven years, to meet Canadian tax and accounting requirements.
Waivers and incident records are kept for the period of potential legal liability, which for a participant who was a minor at the time runs from the date they reach the age of majority.
Video surveillance footage is retained for 60 days and then overwritten automatically, unless a specific clip is preserved for an active investigation, incident or claim.
Marketing contact details are kept until you unsubscribe. We retain a minimal suppression record afterwards, so that we do not email you again by mistake.
Unsuccessful job applications are kept for a limited period in case a suitable role opens, then destroyed.
Winner photographs are displayed for as long as the promotion runs, and are taken down on request at any time.
Survey responses are retained in analysed form. Where we no longer need to identify an individual respondent, we remove the identifying fields.

When information reaches the end of its retention period we destroy, erase or de-identify it.

8. How we protect it

We use security measures appropriate to the sensitivity of the information: access is limited to staff who need it for their role, business systems require multi-factor authentication, data is encrypted in transit and at rest in our cloud environment, payment card data is handled entirely by our payment processor and never touches our own systems, and physical records are kept secured on our premises.

No safeguard is absolute. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the relevant privacy commissioner as the law requires.

9. Your rights, and how to use them

You may:

Ask what we hold about you, and get a copy, along with an account of how it has been used and to whom it has been disclosed.
Ask us to correct anything inaccurate or incomplete.
Withdraw consent to a use — most commonly marketing — subject to legal and contractual limits, which we will explain if any apply.
Ask us to delete information we no longer have a legal or business reason to keep.
Complain about how we have handled your information.

Write to our Privacy Officer:

Privacy Officer, Vortex Group
Vortex Group is a trading name of Vortex Gaming Ltd, the legal entity accountable for the personal information described here.
Email: privacy@sandboxvr.ca

This page and this mailbox are operated by Vortex Group, the independent franchisee of the Toronto and Vancouver locations. They are not Sandbox VR corporate channels, and this statement describes our practices, not Sandbox VR's. Where a request concerns information held by Sandbox VR rather than by us, we will say so and forward it.

We will acknowledge your request and respond within 30 days. There is no charge for a routine request. If a request is unusually large and we need to charge for the cost of producing it, we will tell you the estimate first and give you the chance to withdraw or narrow it. We may need to verify your identity before releasing information, so that we do not disclose your information to someone else.

If you are not satisfied with our response

You can complain to the privacy regulator with jurisdiction:

Office of the Privacy Commissioner of Canada — for our Toronto location and for federally regulated matters. priv.gc.ca, 1-800-282-1376.
Office of the Information and Privacy Commissioner for British Columbia — for our Vancouver location. oipc.bc.ca, 250-387-5629.

10. Children

Our experiences have minimum age requirements, and participants below the age of majority require a waiver signed by a parent or legal guardian. We collect information about a minor only in that context, only what is needed for safety and participation, and only with guardian involvement. We do not direct marketing at children.

11. Forms and surveys

Where we collect information through an online form or survey, the form itself will tell you what is being collected and why. Answering is voluntary unless the form states that a field is required to complete a booking or entry. Form responses are stored in our Microsoft 365 environment and are handled under this statement.

12. Changes to this statement

We will update this statement when our practices change. The effective date at the top always reflects the current version. If a change materially affects how we use information you have already given us, we will take reasonable steps to bring it to your attention rather than relying on you to re-read this page.