Privacy Policy

1. Who we are and what this policy covers

1.1 点点DianDian ("DianDian", "we", "us") is operated by DianDian, a sole proprietorship registered in BC (registration no. FM1118813) and based in Vancouver.

1.2 This policy covers personal information we collect, use and disclose through:

• our website, diandianevent.com;
• the 点点DianDian app;
• email; and
• the events we organize.

1.3 We handle personal information under BC's Personal Information Protection Act ("PIPA"). If you are outside BC (for example, if you attend events in Ontario), and where personal information moves across provincial or national borders, the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") applies. In this policy, PIPA and PIPEDA together are "applicable privacy law".

1.4 This policy explains how we handle your personal information. It is not part of our Terms of Service; when you sign up, you consent to our handling your personal information as this policy describes. Venues, Stripe and other third parties handle information under their own privacy policies (see sections 8 and 17).

1.5 "Personal information" means information about an identifiable individual. Aggregated or anonymized data that can no longer identify anyone is not personal information; we may use such data for statistical analysis and share it with partners.

2. Privacy Officer

2.1 The operator of DianDian is our Privacy Officer and is responsible for our compliance with applicable privacy law and this policy.

2.2 Contact:

• Email: diandian.event@gmail.com (please put "Privacy" in the subject line)
• Mail: 422 Richards Street, Unit 170, Vancouver, BC V6B 2Z4
• Phone: +1 416-829-6597

2.3 Contact the Privacy Officer with any question about this policy or how we handle your information, any request to access or correct it, or any complaint. Sections 14 and 19 explain how we handle these.

3. What we collect

3.1 Account details. These are the name, email address, password and birth year and month you give us when you sign up, and the account number we assign. Your password is stored only in encrypted form; we cannot see it.

3.2 "About you" details. These are the details about yourself and your preferences that you give us at sign-up and afterwards so we can arrange events, such as your gender, nationality, languages, MBTI type, industry, interests, relationship status, favourite cuisines, budget, and allergies and dietary needs. Which details are required, and the options for each, are as shown on the website or in the app.

Allergies and dietary needs may reveal health information, and relationship status is personal. We treat both as sensitive. We use them only for the purposes in section 4, and only DianDian admins can see them. When we tell a venue about allergies or dietary needs, we do not say whose they are (see section 8.3).

3.3 What you choose to send us, such as:

• event feedback and app ratings;
• how you heard about DianDian;
• the reason you select, and any note you add, when you cancel a booking;
• reports you file;
• emails and attachments you send us.

3.4 Information created as you use the service, such as:

• booking, grouping, rescheduling, cancellation and waitlist records, including the reason you choose when cancelling and how many times your bookings were cancelled or rescheduled;
• subscription and payment status, and the identifiers our payment provider returns (never your card number);
• the messages you send in event chats (see section 7);
• the notifications we send you, and records of the emails and push notifications we send;
• some records of what you do on the website and in the app, such as when you viewed a chat or your notifications;
• your settings, such as your interface language and notification settings;
• the device identifier for app push notifications and the city you choose in the app, recorded only if you allow the app to send push notifications;
• invitations and companion links, and any invite code you used, with the promotion channel it belongs to;
• people you block, and reports and blocks others make about you;
• photos and video taken at events by DianDian or creators we invite, which may include your image and voice (see section 12 of the Terms of Service);
• account status, such as when and why an account was suspended or closed, and records of admin actions on your bookings, reports or account.

3.5 Consent records. When you accept our Terms of Service and Community Guidelines and consent to this policy, acknowledge the risks of an outdoor or physical event, give or withdraw an optional consent (such as for promotional messages), or opt out of photos and video, we keep a record of it, such as the versions of the documents and wording, the exact wording shown to you (recorded as a wording ID and checksum), the language, the time, where you did it (website or app), your email address at the time, and the result of the age check.

When we record a consent, we also record your IP address and device information (such as the type and version of your browser or app, device and operating system), to show that you were the one who gave it.

3.6 Technical information collected automatically. When you use the website or app, we and our service providers log technical information such as your IP address, your browser, device or app type and version, the time of each visit and the pages you request, and sign-in and error logs. We use it for security, troubleshooting and preventing abuse.

We also use your IP address to estimate your approximate city, only to preselect a city when you have not chosen one yet; we do not store it.

3.7 Information from others, such as:

• Stripe tells us the status of payments, refunds and subscriptions;
• other people in your group may mention you in a report or in feedback;
• venues may tell us what happened at an event, such as damage, an unpaid bill or a safety incident.

3.8 What we do not collect:

• card numbers, CVCs or bank account details (Stripe handles these);
• copies of identity documents (see section 16);
• your precise location, your contacts, or any photos on your phone that you have not chosen to send us;
• specific health information, such as medical conditions, diagnoses or medication (for allergies and dietary needs, see section 3.2; when you cancel a booking, you may choose "Not feeling well" as the reason, see section 3.4). For outdoor events, you confirm your own fitness to take part; we do not ask about medical conditions.

4. Why we collect it and how we use it

4.1 We use personal information for these purposes:

4.2 Grouping. We form groups based on participants' profiles (such as age, gender, languages, industry, interests and budget), their bookings, and blocks and companion links: our system creates draft groups, and DianDian admins can review and adjust them. Nationality is not used for grouping. Groups formed from profiles, and any decision to cancel a booking, pause your ability to book, or suspend or close your account because of a breach, are made by DianDian admins. You may ask for a person to review a grouping that affects you, or a decision to cancel your booking because of grouping, by emailing diandian.event@gmail.com with "Group review" in the subject line.

4.3 We use your information only as reasonably needed, and never for purposes unrelated to DianDian. Before using it for a new purpose not described here, we will tell you, and we will ask for your consent where it is required, unless the law allows us to proceed without it.

5. Consent

5.1 When you sign up, you accept our Terms of Service and Community Guidelines and consent to our handling your personal information under this Privacy Policy. That consent covers only the purposes needed to provide the service, which are all the purposes in section 4 except promotional messages, the use of photos and video for promotion, and quoting your feedback or experiences.

When we ask for your allergies and dietary needs and your relationship status, we explain what they are for. By completing and submitting your "About you" details, you consent to our using them as this policy describes, including your allergies and dietary needs and your relationship status.

5.2 Some uses are not needed to provide the service:

• Promotional messages (promotional email and the new-events push): we ask for your consent separately, and the option is never pre-ticked (see sections 10.2 and 10.3).
• Photos and video at events: these are governed by section 12 of the Terms of Service. By accepting the Terms of Service, you agree that DianDian and the creators we invite may take photos and video at events and use them for promotion. You can opt out at any time (section 12.3 of the Terms of Service).
• Quoting your feedback or experiences: we ask for your consent separately before we quote you. You can withdraw it at any time by emailing us. Once you do, we will not quote you again, and within 7 days after we are notified, we will take down published quotes on accounts DianDian controls and ask the creators we invite to do the same.

Saying no to promotional messages or to being quoted, or opting out of photos and video, does not affect your use of the service.

5.3 You may withdraw consent at any time, and we will tell you what that means for you:

• if you withdraw consent we need to provide the service (for example, to use your "About you" details to arrange groups), we may no longer be able to arrange events for you;
• withdrawing does not affect anything we did before you withdrew;
• withdrawing does not affect records the law requires or allows us to keep (see section 12).

5.4 Where applicable privacy law permits, we may collect, use or disclose personal information without consent, for example:

• to investigate a breach of an agreement or of the law;
• for a legal proceeding;
• in an emergency that threatens someone's life, health or safety;
• to collect a debt.

6. Who can see your information

6.1 The people in your group. Once groups are released (the release time is as shown on the website or in the app), the people with a confirmed booking in the same group as you ("the people in your group") can see:

• your first name, but not your last name;
• how many people are in the group, and a summary of the group's industries and interests. The summary does not say whose they are or how many people have each, and is not shown for groups that are too small;
• the messages you send in the event chat, with the first name you had when you sent them (see section 7).

The people in your group do not see the rest of your profile, including your last name, email, birth year and month, gender, nationality, languages, MBTI type, relationship status, favourite cuisines, budget, or allergies and dietary needs. In a small group, others may be able to work out who an item in the summary belongs to.

6.2 Please keep in mind that we cannot control what you choose to tell people at an event or in a chat, or the contact details you exchange. Other participants are responsible for how they use that information. Our Community Guidelines require everyone to respect each other's privacy.

6.3 DianDian admins. For the purposes in section 4, our admins can see your account, profile and usage records. They look only at what a specific task needs. We do not read chats routinely (see section 7).

6.4 Venues, event partners, promotion partners, creators we invite and service providers: see section 8.

6.5 If you share an event invite link, anyone who opens it will see your first name. No one else can see your personal information, except as this section and section 8 describe, and except for photos and video of events published under section 12 of the Terms of Service.

7. Event chat

7.1 Once groups are set, the people in each group share an event chat. It is open for a period before and after the event; the exact times are as shown on the website or in the app.

7.2 We store the messages you send in the chat (including quick messages), when you sent them, and your first name at the time.

7.3 Only people with a confirmed booking in your group can see these messages, and only while the chat is open. You will not see messages from people you have blocked.

7.4 To keep people safe, our system may automatically stop inappropriate content. Apart from that, we do not read chats routinely; we look at the relevant records only when handling a report, a safety incident or a technical problem. When someone files a report, we keep the relevant chat messages separately as evidence, and only our admins can see them (see section 12.2 for how long).

7.5 When the chat closes, its messages are deleted and cannot be recovered. Records related to a report are kept as described in sections 7.4 and 12.2. If you would like to stay in touch with someone, swap contact details before the chat closes.

8. Who we share information with

8.1 We do not sell or rent your personal information, use it for third-party advertising, or trade it with data brokers.

8.2 Service providers. These types of service providers help us run DianDian:

Our service providers may process your information only on our instructions and to provide their services to us. They are bound by contract to keep it confidential and secure, and must protect it at least as well as this policy does. However, the provider's own terms of service and privacy policy govern information in our support and admin inbox (Gmail), information that the AI assistant we use to build and maintain our systems has access to, and information that Stripe, Apple and Google process for their own purposes, such as fraud prevention or running their app stores. When we replace a provider or add one of the same type, we update this list directly (see section 18.3).

8.3 Venues. When we book, we tell the venue only what the booking needs, such as the number of guests and the time; we do not give it participants' names or contact details. If someone has listed allergies or dietary needs, we may pass these on without naming anyone, so the venue can prepare. This does not replace telling the venue yourself (see section 8.2 of the Terms of Service).

8.4 Event partners and promotion partners. For special events, such as craft workshops, the studio or partner may need to know how many people are coming. We share your first or full name only if the event genuinely requires it, for example when the partner needs a booking list or a safety register, and we will tell you in advance. Promotion partners receive only aggregate numbers, such as how many people signed up or subscribed with their invite code, never your personal information.

8.5 Creators we invite. Creators we invite may take photos and video at events and post content made in collaboration with DianDian on their own social media accounts (see section 12 of the Terms of Service). If you opt out, we will tell them and ask them not to photograph or film you, or publish content in which you can be identified.

8.6 Insurers, lawyers and professional advisers. If there is an incident, complaint, dispute or claim, we may share relevant information, limited to what is needed, with any insurer we may have, claims adjusters, lawyers, accountants and other professional advisers.

8.7 Legal requirements and safety. We may disclose information to authorities or other appropriate people:

• when the law requires it, such as under a court order, warrant or subpoena;
• to assist a lawful investigation by a law enforcement agency;
• in an emergency, to protect someone's life, health or safety;
• in other circumstances applicable privacy law allows.

Where the law allows, we will tell you.

8.8 Business transfers. If another entity takes over DianDian's business (for example, a company set up by the operator), or the business is sold or merged, your information moves with it. The new operator must keep using it in line with this policy, and will ask you to accept its agreement with you (see section 18.4 of the Terms of Service).

8.9 With your consent. Otherwise, we share your information only with your consent.

9. Storage and processing outside Canada

9.1 Our main database is stored in Canada. Some of the providers in section 8, however, process and store information in the United States or other countries, so your information may be transferred outside Canada.

9.2 Information stored in another country is subject to that country's laws and may be accessed by its courts, law enforcement and national security authorities under those laws.

9.3 We choose providers that maintain reasonable security safeguards, and we require them by contract to protect your information. To find out more about how our providers handle information outside Canada, contact our Privacy Officer.

10. Service messages and promotional messages

10.1 Service messages. To provide the service, we send you messages by email, as notifications on the website and in the app, and as push notifications if you allow them, about your account, bookings, event arrangements and changes, the waitlist, subscriptions and payments, our terms and policies, and account security. Examples include booking confirmations, venue details, renewal reminders, and the copy of the agreement we email you after you accept a new version of the Terms of Service. These messages are needed to provide the service, and we send them while your account is open. They do not include promotional content; a next step directly related to the message (for example, suggesting other events after a waitlist ends without a spot or after an event is cancelled) is not promotional content; service emails say who we are and how to contact us.

10.2 Promotional messages. Emails about new events, offers and other promotions are sent by DianDian only if you turn them on. This option is off by default and never pre-ticked.

Every promotional email identifies the sender, gives our mailing address and contact details, and includes an unsubscribe link. You can also opt out on the website or in the app, or by emailing us. We act on unsubscribe requests within 10 business days.

10.3 Push notifications. The app sends push notifications only if you allow them on your phone, and you can turn them off at any time in your phone's settings. The new-events push is off by default, is sent only if you turn it on, and can be turned off at any time.

11. Cookies and local storage

11.1 Our website uses only two kinds of cookies: those it needs to work, such as keeping you signed in, and those that remember your preferences and choices, such as your language and city, an invite link you opened, and your choice on the terms confirmation page.

11.2 Apart from cookies, the website stores a small amount of data in your browser, such as which icebreaker question you were on. This data stays in your browser and is never sent to us.

11.3 Actions such as paying and changing your payment method take place on Stripe's pages. Stripe may set its own cookies there to process payments and prevent fraud, under Stripe's privacy policy.

11.4 Our website fonts come from Google Fonts. When you open a page, your browser requests the font files from Google's servers, so Google receives your IP address and browser details.

11.5 We do not use advertising trackers, third-party analytics or social media pixels. You can clear or block cookies in your browser, but if you block the sign-in cookie, you will not be able to sign in.

11.6 The app stores your sign-in session on your phone, along with preferences and progress such as your language, your city and how far you have got in an icebreaker. Signing out clears the session, and uninstalling the app clears everything.

12. How long we keep information

12.1 We keep personal information only as long as needed for the purposes in section 4, and to meet legal requirements. If we use your personal information to make a decision that directly affects you, such as closing your account, we keep the information behind that decision for at least one year. When we no longer need information, we delete it or make it anonymous.

12.2 How long we keep each type of information:

12.3 Deleted information may remain in our providers' system backups for a limited time, until the backups are overwritten in the normal cycle.

13. Deleting your account

13.1 You can delete your account yourself on the website or in the app, without contacting us. Deletion is permanent and cannot be undone. For what happens to a subscription and upcoming bookings, see section 15.1 of the Terms of Service.

13.2 What we delete. Your sign-in account, your name and birth year and month, your "About you" details, and the usage records linked to your account, such as your chat messages, blocks and invitations, notifications and notification settings, waitlist records, app ratings, how you heard about DianDian, your push notification device identifiers and the city you chose in the app, except what section 12.1 requires us to keep and what section 13.3 says we keep.

Upcoming bookings are cancelled, with refunds as set out in section 15.1 of the Terms of Service. Photos and video of events that have already been published are not taken down when you delete your account; you can opt out under section 12.3 of the Terms of Service.

13.3 What we keep (never shown to anyone):

• Unlinked from your account: booking and transaction records, for tax and accounting; and your feedback ratings, with any comments erased.
• To prove consent and deal with possible disputes and claims: your consent records, including the email address, name and IP address needed to show they are yours.
• For safety: reports and how we handled them, including reports others made about you, and admin logs. We may also keep the minimum information needed to recognize the same person if they sign up again.

Section 12.2 sets out how long. Information that our payment provider, Stripe, keeps for payments, refunds, fraud prevention and legal requirements is kept under its own policies.

13.4 Accounts closed for breaking our rules:

• We keep the records needed to stop the same person from signing up again, such as the email address and the date and reason for closure, along with the related reports and records. We keep them for as long as the closure is in effect; if it is lifted, the account is treated like any other.
• A closed account cannot be deleted in the app or on the website. Email us to ask for deletion, and we will delete everything else while keeping these records.

14. Your rights

14.1 Access. You may ask to see the personal information we hold about you, how it has been used, and to whom it has been disclosed. You can see most of it yourself on the website or in the app.

14.2 Correction. You can edit your profile on the website or in the app at any time. For anything you cannot change yourself, such as an error in a booking record, email us. If needed, we will tell any organization that received the incorrect information about the correction.

14.3 Withdrawing consent: see section 5.3.

14.4 Deleting your account: see section 13.

14.5 How to make a request. Write to our Privacy Officer (section 2):

• to protect your information, we will first confirm your identity, usually by asking you to write from the email address on your account;
• we will respond within 30 days of receiving your request. If we need more time, we will extend as applicable privacy law allows and tell you why;
• access requests are usually free. If a minimal, reasonable fee applies, we will tell you the amount first.

14.6 Exceptions. Where applicable privacy law permits or requires, we may refuse all or part of an access request, for example where:

• the information would reveal someone else's personal information, such as who made a report;
• it relates to a legal proceeding or an investigation;
• it is protected by solicitor-client privilege.

If we refuse, we will tell you why.

14.7 Complaints. Please contact our Privacy Officer first (section 19). If you are not satisfied with the outcome, you can complain to:

• if you are in BC: the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca);
• if you are outside BC, or for processing across provincial or national borders: the Office of the Privacy Commissioner of Canada (priv.gc.ca).

15. Security and data breaches

15.1 We use reasonable security safeguards suited to how sensitive the information is, including:

• encrypted connections (HTTPS);
• passwords stored only in encrypted form;
• access controls, so guests can read only the data they are entitled to see;
• admin access limited to those who need it, with admin actions logged;
• payments handled by Stripe, so we never see your full card number or security code;
• contractual confidentiality and security obligations for our service providers.

15.2 No system is completely secure. Please use a password you do not use anywhere else, and do not share your account. If you notice anything unusual on your account, change your password right away and contact us.

15.3 If a security incident involves your personal information, we will act promptly to contain it and assess its impact. If there is a real risk of significant harm to you, such as identity theft, financial loss or harm to your reputation, we will:

• notify you as soon as feasible, and tell you what steps you can take;
• report it to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia, as the law requires;
• where it may help reduce the harm, notify other organizations.

We keep a record of every security incident (see section 12.2 for how long).

16. Minors

16.1 DianDian is only for people aged 19 or older. We check your age against the birth year and month you give us when you sign up and each time you book (section 3.1 of the Terms of Service sets out the rule). If you are under 19, you cannot sign up or book.

16.2 Where needed, we may ask to see photo ID to confirm your age. We only look at it and record the result; we do not keep a copy.

16.3 If we find that someone under 19 has signed up, we will close and delete the account, keeping only the minimum needed to prevent them signing up again, and refund any events that have not taken place.

16.4 If you believe a minor is using DianDian, please let us know.

17. Third-party websites and services

Our website and app include some third-party links and features, such as map directions, adding an event to your calendar, Stripe's checkout and subscription management pages, the app store rating window that may open in the app, and venues' websites. When you use one of these, the relevant details (such as the venue address or event time, or any rating or review you leave in the rating window) go to that third party, and its own privacy policy applies. We are not responsible for third parties' practices.

18. Changes to this policy

18.1 We may update this policy when our service, the law or our service providers change. Each version has a version number and an effective date. We keep every version on file at its own fixed link, and you can ask us for a copy.

18.2 Material changes include collecting a new type of information, a new purpose, or sharing with a new type of recipient. For these:

• before the change takes effect, we will tell you on the website and in the app, explaining what is changing;
• where a change needs your consent (for example, a new purpose, collecting a new type of information, or sharing with a new type of recipient), we will ask for your consent before we start. We will not treat your continued use of the service as consent.

18.3 We may update the version number and date directly for changes that do not widen what we collect, use or share or reduce your protection, such as corrections and clarifications, updated names and contact details, replacing a service provider or adding one of the same type, collecting less information, or keeping it for a shorter time. Names of pages, settings and features in this policy are used for convenience only. Changes to the features, design or names on the website and in the app are not by themselves changes to this policy, do not widen what we collect, use or share as set out in this policy, and do not reduce your rights under this policy.

18.4 Where the law requires otherwise, we will follow the law.

19. Contact and complaints

19.1 Privacy Officer: the operator of DianDian

• Email: diandian.event@gmail.com
• Mail: 422 Richards Street, Unit 170, Vancouver, BC V6B 2Z4
• Phone: +1 416-829-6597

19.2 How we handle complaints:

• tell us what your concern is, with any details or documents that help;
• we will acknowledge your complaint within 5 business days and give you a written response within 30 days;
• if we need more time, we will tell you why and when to expect our response.

If you are not satisfied with the outcome, you can contact the regulators listed in section 14.7.

20. Language

The official versions of this policy are in Simplified Chinese, Traditional Chinese and English, and the three versions have the same meaning. Korean and Japanese translations are also provided for reference only; if a translation differs from the English version, the English version prevails. The version in the language you used when you accepted it is the one that applies to you; if you accepted it in Korean or Japanese, the English version applies. We keep a record of that language (see section 3.5).