Privacy policy

1. Who we are

Down.Town ("Down.Town", "we", "us") publishes the website at down.town, an independent guide to 42 downtowns. We are based in Montréal, Québec, Canada, and we are responsible for the personal information described in this policy (in European terms, we are its "controller").

Under Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25, the person in charge of the protection of personal information at Down.Town is, by default, its publisher. You can reach that person, and anyone else who handles privacy for us, through the contact form (topic: Privacy request).

2. What we collect

Information you give us

We only receive personal information when you choose to send a form. We ask for what we need for that form and mark optional fields as optional.

Form	What we ask for
Get matched and other requests for introductions (including the short forms in city guides and tools)	Name, email, phone (optional), company (optional), city and area, the kind of space or help you need, size, budget, timing, must-haves, notes, preferred contact method and, optionally, good times to call
Downtown Dispatch newsletter	Email address and the editions you choose
Contact form	Name, email, topic, city (optional) and your message
Business listings	Business name, category, city, address, website, contact name, email, phone (optional), listing tier and description
Advertising and prize sponsorship enquiries	Name, email, company, website, the packages you're interested in, cities, budget range, timing and message
Partner network applications	Business and contact details, your role, the services you offer, cities served, capacity, the way you would like to work with us and, where a trade requires it, licence or registration details
Contest entries and nominations	Name, email, city, country of residence, category, a link to your photo, title and caption, or the block you nominate and why, plus confirmation of your age and acceptance of the rules
Careers applications	Name, email, role, city, portfolio link, availability and a short pitch
Reader support pledges	Name, email, amount, currency, where you'd like it to go and, optionally, a name and message for the supporter wall

Details that travel with a form

When you send a form, it also carries: the page you sent it from; the date and time; the name of the form; whether you were on a mobile-sized or desktop-sized screen; and how your visit began, meaning the website that referred you (if any), the first page you landed on and any campaign tags in the link you followed (such as utm_source or a Google Ads click identifier). The visit details are held in your browser for the session and attached only to forms you choose to send. We use them to understand which guides and campaigns are genuinely useful.

The Get matched form also works out a simple priority score from the type of request, its timing and size, and whether you gave a phone number or company. It helps an editor decide which requests to read first. An editor reviews every request, and the score never decides on its own whether you receive an introduction.

Information stored in your browser

Your theme, your cookie choice, your saved guides and your progress through Get matched are kept in your own browser so the site works the way you left it. That information stays on your device and is not sent to us. The cookie policy lists every item.

Information others collect when you visit

Like any website, Down.Town is delivered by servers that receive your IP address and basic browser details. That includes our host and the services that supply parts of each page, such as Google's advertising and font services. They are described in advertising and cookies and services we use.

We do not run a separate analytics or tracking service of our own, we don't create accounts or passwords, and we don't buy information about you from anyone.

3. How we use it, and why

Where the European Union's GDPR or the UK GDPR applies, we must have a legal basis for each use. Those bases are shown alongside each purpose.

Purpose	Legal basis
Replying to your message and doing what you asked: reviewing a listing, answering an enquiry, handling a pledge, assessing an application	Steps taken at your request; our legitimate interest in answering readers; your consent where the form asks for it
Sharing a request for introductions with up to three partners	Your consent
Sending the Downtown Dispatch	Your consent
Running contests: judging, verifying and contacting winners, publishing results	Performing the official rules you accepted; legal obligations
Showing ads	Your consent where it is required; otherwise our legitimate interest in funding a free site
Keeping forms free of spam and the site secure	Legitimate interests
Understanding which pages and campaigns lead to useful requests	Legitimate interests
Keeping records, meeting legal duties, resolving disputes	Legal obligation; legitimate interests

We do not make decisions about you based solely on automated processing.

4. Requests for introductions (Get matched)

This section explains exactly what happens when you ask us for introductions through Get matched or one of the shorter request forms in our city guides and tools.

Who reads it first

A Down.Town editor reviews each request by hand, usually within one business day. Nothing is passed to partners automatically.

Who we share it with

Up to three partners who fit your city, need, size, budget and timing. Depending on what you asked for, they may be tenant-side commercial real estate brokers, rental agents or apartment locators, residential realtors, coworking operators, event venues or movers. They are independent businesses, not part of Down.Town.

What we share

Only what a partner needs to respond: your name, your contact details (email, and phone if you gave it), your preferred contact method and call times, your company if you gave one, and the details of your request (city and area, the kind of space or help, size, budget, timing, must-haves and notes). We do not pass on your newsletter choice, the technical details that travel with the form, or the priority score.

On what basis

Your explicit consent, given by ticking the box that says we may share your request with up to three relevant partners. If you don't tick it, the form can't be sent, and we don't share requests that arrive without consent. The optional newsletter box is separate: ticking it, or not, makes no difference to your introductions.

What partners may do with it

Contact you about your request, by the method you chose. We ask partners to use your details for that purpose only and not to add you to marketing lists. Once a partner has your details, it is responsible for them under its own privacy policy and the law that applies to it.

Referral fees

Partners may pay Down.Town a fee for introductions, a featured-partner fee, or a referral fee if you choose to work with them. So that fees can be worked out, a partner may tell us whether an introduction went ahead, for example that a lease was signed or a venue booked. You never pay Down.Town anything.

How long we keep it

Up to 24 months from your request, after which we delete it. You can ask us to delete it sooner.

Changing your mind

You can withdraw your consent at any time through the contact form (topic: Privacy request). If we haven't made introductions yet, we won't. If we have, we will tell the partners we introduced you to that you have withdrawn, ask them to stop contacting you about the request and to delete your details, and delete our own copy, keeping only the minimum record needed for any referral fee already earned. Withdrawing doesn't undo sharing that took place while your consent was in force.

What we never do

Sell, rent or trade lists of readers; share a request with more than three partners; or share it with anyone at all without your consent.

5. The Downtown Dispatch

If you sign up, or tick the optional box on another form, we use your email address to send the editions you chose. We send it only with your express consent, as Canada's anti-spam law requires. Every issue includes a way to unsubscribe, or you can ask us through the contact form. We keep your address until you unsubscribe, and then keep only a note of the unsubscribe so we don't email you again.

6. Advertising and cookies

Down.Town is funded in part by ads served through Google AdSense (publisher ID ca-pub-6620975821265271). We keep ads off the Get matched page and our form confirmation pages.

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
• Google's use of advertising cookies, including the DoubleClick cookie, enables it and its partners to serve ads to you based on your visit to Down.Town and/or other sites on the internet.
• You may opt out of personalised advertising by visiting Google's Ads Settings.
• You can opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info/choices.
• Learn more about how Google uses cookies in advertising and how Google uses information from sites that use its services.

Your choices on Down.Town

On your first visit, a cookie notice offers two choices. Accept all allows personalised ads. Essential only tells Google to show non-personalised ads, which are not based on your past browsing; Google may still use cookies or similar technologies with them for frequency capping, aggregated ad reporting and to combat fraud and abuse.

For visitors in the European Economic Area, the United Kingdom and Switzerland, Down.Town uses Google's certified consent message, which asks for your consent before personalised ads and advertising cookies are used. Your choice in that message is the one Google applies to your visits from those regions.

You can change your mind at any time. The cookie policy explains how to bring the notice back and lists everything we store in your browser.

7. Services we use

• FormSubmit (form relay). Every form on the site is sent over an encrypted connection to FormSubmit, a third-party form relay service, which delivers it to Down.Town's private inbox. FormSubmit handles the content of your submission in order to deliver it.
• Our email service. Submissions arrive in, and replies are sent from, an inbox hosted by an email service provider. Only the editors who need to see a message can open it.
• GitHub Pages (hosting). The site is served by GitHub Pages, which may log technical information such as IP addresses to operate and secure the service.
• Google AdSense (advertising). As described in advertising and cookies.
• Google Fonts (typefaces). Our fonts are delivered by Google Fonts. Your browser requests them from Google's servers on each page, which means Google receives your IP address and browser details.
• YouTube (videos). Videos are embedded with YouTube's privacy-enhanced (youtube-nocookie) player, which loads only when you press play. Until then, the page shows the video's preview image, which your browser fetches from YouTube's image server. Once you press play, YouTube's own privacy policy applies to the video.
• OpenStreetMap (map). On the city directory, map tiles load from OpenStreetMap's servers only when you choose to open the map. The mapping library is fetched from the cdnjs content network at the same moment.
• Payment providers. If you pay through a checkout link we provide, the payment service (such as PayPal or Stripe) processes your payment under its own privacy policy. We never receive your full card number.

8. When else we share information

• Partners, only as described in requests for introductions.
• Prize sponsors, who receive a winner's name and delivery details only if they deliver the prize, as set out in the official contest rules. Winners' names, cities and winning entries are published.
• Regulators and authorities, where the law requires it, including the Régie des alcools, des courses et des jeux for contests registered in Québec.
• Professional advisers, such as lawyers or accountants, where needed, under a duty of confidentiality.
• A new owner. If Down.Town, its domain or its website is sold or transferred, the personal information we hold may pass to the new owner, who must continue to protect it in line with this policy. We will post a notice here if that happens.

We do not sell personal information.

9. How long we keep it

Information	How long
Requests for introductions	Up to 24 months from the request
Downtown Dispatch subscription	Until you unsubscribe, then only a record of the unsubscribe
Contact messages, listing, advertising and partner enquiries	Up to 24 months after our last exchange
Careers applications	12 months
Contest entries and nominations	For the season, then as long as the law requires for contest records
Pledges and payments	As long as accounting and tax law requires
Items stored in your browser	On your device until you clear them

10. Security

Forms are sent over encrypted connections. Submissions go to a private inbox that only the editors who need it can open. Forms include a hidden spam trap, and we never ask for passwords or payment card numbers. No system is perfectly secure; if a breach involving your information creates a risk of serious harm, we will notify you and the relevant authorities as the law requires.

11. Your rights

Wherever you live

You can ask us for a copy of the personal information we hold about you, ask us to correct or delete it, withdraw any consent you gave and unsubscribe from the Dispatch. It costs nothing. We reply within 30 days, and may ask you to confirm a detail, such as the email address you used, so that we release information only to the right person.

European Economic Area and United Kingdom (GDPR and UK GDPR)

You also have the right to restrict our use of your information, to object to uses based on legitimate interests, and to receive information you gave us in a portable format. You can complain to your local data protection authority; in the United Kingdom, that is the Information Commissioner's Office.

Canada (PIPEDA) and Québec (Law 25)

You have the right to access and correct your information and to withdraw consent. Québec residents may also ask for information they gave us in a structured, commonly used technological format, and ask us to stop disseminating it where the law allows. You can complain to the Office of the Privacy Commissioner of Canada or, in Québec, to the Commission d'accès à l'information du Québec.

California and other US states (CCPA/CPRA): do not sell or share

You have the right to know what personal information we collect and how we use it, to delete and correct it, to opt out of its sale or sharing, and not to be treated differently for using these rights.

• We do not sell personal information.
• Introductions happen only at your direction. We disclose a request to partners only when you tick the consent box asking us to, and you can withdraw that at any time.
• Advertising cookies. Google's personalised advertising cookies may count as "sharing" for cross-context behavioural advertising under California law. To opt out, choose "Essential only" in our cookie notice (the cookie policy shows how to bring it back) and use Google's Ads Settings.
• We don't collect sensitive personal information for the purpose of inferring characteristics about you, and we don't knowingly sell or share information about anyone under 16.
• You may use an authorised agent to make a request; we may ask the agent for proof of authority.

12. Children

Down.Town is written for adults and is not directed at children. We do not knowingly collect personal information from anyone under 16, and contest entrants must be 18 or older (or the age of majority where they live, if higher). If you believe a child has sent us personal information, tell us and we will delete it.

13. International transfers

Down.Town is based in Canada. Our service providers, including FormSubmit, Google, GitHub and our email service, may process information in other countries, including the United States, where privacy laws differ from yours. Where the GDPR or UK GDPR applies, transfers to Canada rely on adequacy decisions, and transfers elsewhere rely on safeguards such as the standard contractual clauses our providers offer. Before personal information about Québec residents is communicated outside Québec, we consider whether it will be adequately protected, as Law 25 requires.

14. Contact us about privacy

Use the contact form and choose the topic Privacy request, or email us. Tell us your name, the email address you used with us and what you would like us to do. We will reply within 30 days.

15. Changes to this policy

We update this policy when our practices or the law change, and revise the date at the top of the page. If a change materially affects how we use information you have already given us, we will tell you before it applies, where we have a way to reach you.