BDH Streams (bdhstreams.com) is a video streaming service run by BDH Collective Inc. This policy explains what personal information we collect on this site, why we collect it, who receives it, how long we keep it and what rights you have. It applies to the English, French and Spanish versions of the site.

1. Who we are

The company responsible for your personal information on this site is:

• BDH Collective Inc.
• 200-4388 Rue Saint-Denis, Montréal, QC H2J 2L1, Canada
• Quebec enterprise number (NEQ): 1171250237
• Email: [email protected]

When this policy says “we”, “us” or “our”, it means BDH Collective Inc. We also run other websites: bdhcollective.com, bdhworkshops.com, bdhcreative.com, bernardson.com, pixelconvos.link, econovisuals.com, bowc.xyz, tsoml.xyz and ennov-action.com. Each of them has its own privacy policy.

2. Person in charge of personal information

Quebec law requires every business to have a person in charge of the protection of personal information. At BDH Collective Inc., that person is our Founder. You can reach the Founder at [email protected] or by mail at the address above.

3. What we collect and why

Below, we describe each thing we do with personal information on this site. For each one, we say what we collect, why, on what legal basis, who receives it and how long we keep it.

About legal bases. If you are in the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) requires us to name a legal basis under its article 6. Under Quebec law, we use your information for the purpose we gave when we collected it. We ask for your consent before we use it for any other purpose. Before we turn on any tool on this website that can identify you, locate you or build a profile of you, we will ask for your consent.

3.1 Visiting the site

• What we collect: the technical information your device sends with every request, such as your IP address, your browser and device type, the page you ask for, and the date and time.
• Why: to deliver the pages you ask for, keep the site secure and block abusive traffic.
• Legal basis: under the GDPR, our legitimate interest in running a working and secure website (article 6(1)(f)). Under Quebec law, this is necessary to provide the site you ask for.
• Who receives it: Hostinger, which hosts the site; Cloudflare, which sits between your device and our server and protects the site. Our pages no longer load fonts from Google Fonts.
• How long we keep it: only as long as needed to deliver and secure the site. Hostinger, Cloudflare and Google apply their own retention periods to their own logs.

3.2 Your account

• What we collect: your username, first name, last name, email address and password when you register, the page you came from when you registered, and whether you ask us to remember you when you sign in. We also keep the plans and shows you have access to.
• Why: to create and manage your account, let you sign in, and give you access to the shows your plan includes.
• Legal basis: under the GDPR, the performance of our contract with you (article 6(1)(b)). Under Quebec law, this is necessary to provide the account you asked for.
• Who receives it: accounts are managed by ARMember, a membership tool that runs on our own website, hosted by Hostinger. Our website may send member details from your account to our automation tool, n8n, and n8n may copy them into our customer records in Boost.space. n8n runs on a server BDH controls, hosted by Hostinger.
• How long we keep it: for as long as your account is open. After you close it, we keep only what we need to meet our legal, tax and accounting duties and to handle any dispute, and then we delete it or make it anonymous.

3.3 Purchases and payments

• What we collect: the plan or show you buy, its price, the payment cycle, the date, and whether the payment went through. We also receive the details the payment provider sends back to us about your payment, which can include your name, your email address and a transaction reference.
• Why: to sell you the plan you choose, give you access to it, and keep the business records the law requires.
• Legal basis: under the GDPR, the performance of our contract with you (article 6(1)(b)) and our legal obligations for accounting and tax records (article 6(1)(c)). Under Quebec law, this is necessary to complete the purchase you asked for.
• Who receives it: the payment provider you use. Our plan forms are set up to offer PayPal, Stripe, 2Checkout, Authorize.net and bank transfer. The payment provider you choose processes your payment and tells us whether it went through. If you pay by bank transfer, we receive the details of your transfer. On payment pages, the payment provider you use may set its own cookies so that your payment can go through.
• How long we keep it: for as long as tax and accounting laws require us to keep proof of a sale, and then we delete it.

3.4 Watching videos

• What we collect: when a video player loads on a page, and when you play a video, your device asks the video player for that title. The request includes your IP address, your browser and device type, and which video you asked for. For episodes reserved for members, our site checks whether you are signed in and have access. The video player does not load until you click the box shown in its place or allow Embedded content in the banner or the Privacy settings panel. Once loaded, our video players are set to start playing on their own, where your browser allows it. When a video plays, the player also sends viewing statistics to Publit.io at api.publit.io. They include a code for the video, a random ID for that play, the time the play started, how long the video took to load, the address of the player page, the length of the video, how much of it has played and which seconds of it have played, sent at set points from the start to the end.
• Why: to play the video you chose and to give members access to what they paid for.
• Legal basis for the episodes your plan includes: under the GDPR, the performance of our contract with you (article 6(1)(b)). Under Quebec law, this is necessary to provide the service you paid for.
• Legal basis for trailers and free episodes: under the GDPR, our legitimate interest in showing our shows to the people who visit our pages (article 6(1)(f)). Under Quebec law, this is necessary to show the video on the page you open.
• Viewing statistics: the player sends these statistics to Publit.io as a built-in feature. They are not needed to play the video. The legal bases above cover the requests needed to play a video, not these statistics.
• Who receives it: the video player is run by Publit.io and reaches you through our address streams.bdhstreams.com, which is protected by Cloudflare. The player loads its files from static.publit.io. The videos themselves come from Publit.io, through streams.bdhstreams.com or media.publit.io. The player sends its viewing statistics to api.publit.io. When a video starts, the player may also load an icon font from Google Fonts (fonts.gstatic.com), so your IP address reaches Google LLC, in the United States.
• Why this matters: which videos you watch can say something about you. Publit.io, which runs our video player, receives which video plays and how much of it is watched, as described above. On the free episodes page and on the pages for a single show or episode, our consent tool keeps the Meta pixel and the TikTok pixel off even if you allowed them, so no advertising company receives which shows or episodes you open here. If you allow Analytics, Google Analytics records the address of every page you open on this site, including those pages, so Google receives which show and episode pages you opened (section 3.7).
• How long we keep it: Publit.io and Cloudflare apply their own retention periods to the requests they handle. Your access to shows is kept with your account, as described in section 3.2.

3.5 Contact form

• What we collect: your name, your email address and your message. The form is protected against spam by Cloudflare Turnstile, which loads when you open the contact page, whatever you choose in the banner or the Privacy settings panel, and checks that a person, not a robot, is sending it.
• Why: to answer you. That is the only thing we use it for.
• Legal basis: under the GDPR, our legitimate interest in answering the people who write to us, or steps you ask us to take before a contract (article 6(1)(f) or 6(1)(b)). Under Quebec law, we do not ask for your consent here, because we are handling a request you sent us.
• Who receives it: your message reaches us by email, sent through Emailit, our email service, and received by Microsoft’s email service, which handles email for our addresses. n8n may copy it into our customer records in Boost.space. Cloudflare runs the spam check.
• How long we keep it: for as long as needed to deal with your request and any follow-up, and then we delete it, unless it becomes part of your account or purchase records. In any case, this information is deleted no later than 2 years after our last exchange, unless one of the rules above requires us to keep it longer.

3.6 Email

• What we collect: your name and email address, the emails we send you, whether you open them and which links you click.
• Why: to send you messages about your account and purchases and to reply to you, and to see whether our emails are opened and which links are clicked. No form on this site asks for your consent to marketing email today. We need your consent before we send you marketing email, and you can withdraw it at any time by writing to [email protected].
• Legal basis: under the GDPR, the performance of our contract with you for account and purchase messages (article 6(1)(b)), and your consent for any marketing email (article 6(1)(a)). We do not ask for your consent before we record opens and clicks. For that, we rely on our legitimate interest in knowing whether our emails are opened (article 6(1)(f)), and you can object at any time. Under Quebec and Canadian law, marketing email needs your consent.
• Who receives it: Emailit, the email service we use. Emailit records whether you open our emails and which links you click, through tracking links on trackgo.bdhstreams.com. To object to this tracking, write to [email protected].
• How long we keep it: for account and purchase messages, as long as your account is open. For open and click records, until you object or we no longer need them to manage our email. Emailit applies its own retention period to its own records. Our website also keeps a log of the emails it sends, including contact form messages, for 14 days.

3.7 Analytics and advertising

• What we collect: the pages you open on this site, the site that sent you, your IP address, your browser and device type, and identifiers stored in cookies. Google Analytics also records how you use our pages: scrolling, clicks on links to other sites, file downloads, use of our forms and searches on the site. In addition, the settings of our Google tag allow it to detect an email address, phone number or postal address that you type into a form on our pages, and to send it to Google. The Meta pixel records the pages you open, the buttons you click and details of the page. The TikTok pixel records the pages you open and what you do on them, and its settings allow it to detect an email address or phone number that you type into a form on our pages, and to send it to TikTok.
• Why: Google Analytics, run by Google LLC in the United States, counts visits and shows us which pages and shows people look at. It runs only after you allow Analytics in the banner or the Privacy settings panel. The Meta pixel, run by Meta Platforms, Inc. in the United States, lets Meta follow what you do here and match it to your Meta account, so that we can show you ads and count sales. It runs only after you allow Advertising and social media. The TikTok pixel does the same for TikTok. It runs only if you also switch TikTok on by itself in the Privacy settings panel, under Advertising and social media: Accept all does not turn it on. TikTok sends data to China. All three are loaded by our Google Tag Manager container (GTM-W4FLCXBM), run by Google, which loads only after you allow Analytics or Advertising and social media. On the free episodes page and on the pages for a single show or episode, the Meta pixel and the TikTok pixel never run.
• Legal basis: under the GDPR, your consent (article 6(1)(a)). Under Quebec law, your express consent. These tools do not load until you allow them, and you can withdraw your consent at any time with the Privacy settings link.
• Who receives it: Google LLC, in the United States (Google Analytics and Google Tag Manager); Meta Platforms, Inc., in the United States (Meta pixel); TikTok, which sends data to China (TikTok pixel, only if you switch it on). A server-side Google Tag Manager container was also set up for this site, with tags for Meta and TikTok. Nothing on this site sends data to it.
• How long we keep it: cookies last as described in our Cookie Policy. Analytics and advertising data is kept only as long as the settings of each tool allow, and never longer than we need it to measure our site and our ads.

4. Cookies and similar technologies

Our Cookie Policy lists the cookies and similar tools used on this site, the category each one belongs to and the company behind it. Google Analytics runs only after you allow Analytics, the Meta pixel only after you allow Advertising and social media, and the TikTok pixel only if you also switch TikTok on by itself (section 3.7). The video player sends its own viewing statistics once you load it (section 3.4).

Our consent tool is active on this site. On your first visit, a banner asks for your choice, with the buttons Reject all, Choose and Accept all. Nothing optional loads before you choose. It holds back the video player until you click the box shown in its place or allow Embedded content. The Privacy settings link at the bottom of every page opens a panel where you can change or withdraw your choice at any time, category by category. The Your Privacy Choices link opens the same panel at its US privacy choices. If your browser sends a Global Privacy Control signal, we treat it as a refusal of advertising and data sharing. We keep your choice in your browser for 6 months, in a cookie named bdhc_consent and a copy in your browser’s local storage, and ask again after that. It also sends your choice to this website so the website can set the same cookie. The website does not keep a copy of your choice. To limit abuse, it counts those requests for about an hour under a scrambled form of your IP address. We also keep a record of each choice on our consent server, as proof of what you chose and when; it is described just below. The Cloudflare Turnstile check on the contact page still loads whatever you choose. You can change or withdraw your choice at any time with the Privacy settings link.

Records of your consent

Each choice you make in the banner or the Privacy settings panel is kept as a record. The record is our proof that you were asked and what you answered. Your browser sends it to our consent server, consent.bcall.dev, which runs on a server BDH Collective Inc. controls, hosted by Hostinger. A record contains:

• a random consent ID for this choice, and the ID of your previous choice, if there was one;
• what you did, for example accept all, reject all, save your choices or withdraw, and how you did it: through the banner, the settings panel, a link at the bottom of the page or your browser’s Global Privacy Control signal;
• your choice for each of the seven consent categories, your choices for individual companies where the tool offers them, your three US opt-out choices, and whether your browser sent a Global Privacy Control signal;
• the exact value stored in your consent cookie;
• the date and time of your choice, the time our server received the record, and the date your choice expires;
• the language and the exact version of the text you were shown, the version of this policy and the version of the consent tool;
• the page where you made the choice (the path only, without any query string), the host name of the site that sent you there, and a general device type such as mobile or desktop;
• a one-way coded value made from a shortened version of your IP address, using a key that changes every month;
• if you were logged in to the site, your WordPress user number and a one-way coded version of your email address.

A record never contains your email address or your IP address in clear. Legal basis: under the GDPR, our legal obligation to be able to show that consent was given (articles 6(1)(c) and 7(1)); under Quebec law, this information is necessary to comply with the law. Each record is kept for the life of the consent, which is 6 months, plus 5 years, and is then deleted from our consent log. Encrypted backup copies are removed within 400 days after that.

You can withdraw any consent you have given us at any time by writing to [email protected].

5. Who receives personal information

We share personal information only as described in section 3 and in this section. These are the companies involved, by name:

• Hostinger: hosts this website and the server BDH controls where our automation tool n8n runs.
• Cloudflare: protects this site and streams.bdhstreams.com, and runs the spam check on the contact form (Cloudflare Turnstile).
• Publit.io: runs the video player, delivers the videos and receives the player’s viewing statistics. Publit.io is run by Publitio doo, in Serbia, and stores files in the United States by default; its data processing agreement uses the European Commission’s standard contractual clauses for transfers.
• PayPal, Stripe, 2Checkout and Authorize.net: the payment options our plan forms are set up to offer.
• Boost.space: keeps our customer records, which may include member details and contact form messages.
• Emailit: sends our email, including the messages you send through the contact form, and records whether you open our email and which links you click.
• Microsoft: runs the email service that receives email sent to our addresses, including contact form messages and messages you send to [email protected].
• Modular DS: a website management service connected to our website for backups, updates and monitoring. It may have access to the information stored on our website.
• Google LLC, in the United States: Google Tag Manager, which loads only after you allow Analytics or Advertising and social media; Google Analytics, which runs only after you allow Analytics (section 3.7); and Google Fonts, which our video player may load once you load it.
• Meta Platforms, Inc., in the United States: advertising and ad measurement, through the Meta pixel, which loads only after you allow Advertising and social media.
• TikTok: advertising and ad measurement, through the TikTok pixel, which runs only if you switch TikTok on by itself in the Privacy settings panel. TikTok sends data to China.

Some of the tools named in this policy run on our own website: WordPress, ARMember (accounts), Kadence (the contact form), WPML (languages) and LiteSpeed Cache (page speed). When one of them passes your information to another company, such as a payment provider or Emailit, that company is named in this policy. If your browser cannot show an emoji on one of our pages, WordPress may load that emoji as an image from s.w.org, a WordPress.org server, and your IP address reaches that server.

We may also give information to a court, a regulator or the police when the law requires it, or when it is needed to protect our rights or the safety of others.

Our footer links to our pages on Facebook, Instagram, TikTok and YouTube. Nothing is sent to those companies until you follow a link. After that, their own privacy policies apply.

6. Information handled outside Quebec and Canada

We are based in Quebec, Canada. The companies named in section 5 may store or process your information outside Quebec and outside Canada, including in the United States. If you switch the TikTok pixel on (section 3.7), information also goes to China.

When your information is in another country, it is subject to the laws of that country. It may be accessible to the courts, law enforcement and national security authorities of that country.

Before personal information is communicated outside Quebec, Quebec law requires an assessment of whether it will be adequately protected there. If you have a question about where your information goes, write to [email protected].

7. Your rights

Depending on where you live, you have some or all of these rights:

• Access: ask what personal information we hold about you and get a copy.
• Correction: ask us to correct information that is wrong, incomplete or out of date.
• Deletion: ask us to delete your information when we no longer need it or have no right to keep it.
• Portability: ask for the information you gave us in a structured, commonly used technological format, or ask us to send it to someone you name.
• Withdraw consent: withdraw any consent you gave us, at any time. This does not affect what we did before you withdrew it.
• Objection: object to our use of your information based on our legitimate interests, and object to marketing email at any time.
• Restriction: ask us to limit how we use your information while a request is being dealt with.
• De-indexing: under section 28.1 of the Quebec private sector privacy act, ask us to stop spreading your personal information, or to de-index a hyperlink attached to your name, when this breaks the law or a court order, or causes serious harm to your reputation or privacy.

We do not make automated decisions about you today.

How to use your rights: write to [email protected], or by mail to BDH Collective Inc., 200-4388 Rue Saint-Denis, Montréal, QC H2J 2L1, Canada. We may ask for information to confirm your identity before we act. We answer within 30 days, as Quebec law requires. If we refuse a request, we tell you why and how you can challenge our decision.

8. Complaints

If you are not satisfied with how we handle your personal information, please write to us first so we can try to fix it. You can also complain to a regulator:

• in Quebec: the Commission d’accès à l’information du Québec;
• in Canada: the Office of the Privacy Commissioner of Canada;
• in the European Union or the European Economic Area: the data protection supervisory authority where you live or work;
• in the United Kingdom: the Information Commissioner’s Office (ICO).

9. For residents of the United States

This section gives the information that US state privacy laws, including those of California, Colorado, Connecticut, Virginia, Texas, Oregon and Montana, require.

Categories of personal information we collect:

• identifiers: name, username, email address and IP address;
• account log-in details: username and password, used only to let you sign in;
• commercial information: the plans and shows you buy;
• internet or other electronic network activity: the pages and videos you request, how much of a video plays, your browser and device type, and whether you open our emails and which links you click;
• the content of messages you send us through the contact form.

Sensitive personal information: we use your log-in details, which are sensitive personal information, only to let you sign in and keep your account secure, so we do not offer a right to limit their use.

Sources: you, your device, the payment provider you use, which tells us whether a payment went through, and Emailit, which tells us whether you open our emails and which links you click.

Purposes: the purposes described in section 3.

Third parties that receive personal information, by name: Hostinger, Cloudflare, Publit.io, PayPal, Stripe, 2Checkout, Authorize.net, Boost.space and Emailit, for the purposes in section 3; Microsoft, which receives email sent to our addresses; Modular DS, which manages our website; Google LLC, for Google Fonts, and for Google Analytics and Google Tag Manager once you allow them. For advertising: Meta Platforms, Inc., through the Meta pixel once you allow Advertising and social media, and TikTok, through the TikTok pixel, only if you switch it on.

Selling, sharing and targeted advertising: we do not sell personal information for money. This site uses advertising tools. Once you allow Advertising and social media, Meta may receive identifiers and internet activity from your visit, such as the pages you open and the buttons you click, from its pixel in your browser. If you also switch TikTok on, TikTok may receive the same, and an email address or phone number that you type into a form on our pages. Neither pixel runs on the free episodes page or on the pages for a single show or episode. We treat this as “sharing” of personal information for cross-context behavioral advertising, and as a “sale” and “targeted advertising” under the state laws that use those terms. We do not knowingly sell or share the personal information of anyone under 16.

Your three opt-outs: you have the right to opt out of (1) the sale or sharing of your personal information, (2) targeted advertising, and (3) profiling used for decisions that have legal or similarly significant effects on you.

The Your Privacy Choices link at the bottom of every page lets you record these opt-outs in your browser. If your browser sends the Global Privacy Control signal, the consent tool records them for you. You can also opt out by writing to [email protected]. No account is needed.

Your other rights: you can ask to know and access the personal information we hold about you, to correct it, to delete it and to get a portable copy. You can use an authorized agent; we may ask the agent for proof that you authorized them. We will not treat you differently because you used your rights.

How long we keep each category: see “How long we keep it” for each activity in section 3.

Appeals: if we decline your request, you can appeal. Reply to our decision, or write to [email protected] with “Appeal” in the subject line. We will tell you in writing what we decided and why. If we deny your appeal, you can contact the Attorney General of your state.

10. Children

This site is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, write to [email protected] and we will delete it.

11. Security

We use safeguards that fit the sensitivity of the information. The site is served over encrypted connections (HTTPS). No method of storing or sending information is perfectly secure. If a confidentiality incident creates a risk of serious harm, we will tell the people affected and the Commission d’accès à l’information du Québec, as the law requires.

12. Changes to this policy

When we change this policy, we update the date at the top of this page. When a change is material, for example a new purpose or a new company that receives your information, we tell you and we ask for your consent where consent is needed.

13. Contact

For any question about this policy or your personal information, contact our person in charge of personal information, the Founder, at [email protected], or by mail at BDH Collective Inc., 200-4388 Rue Saint-Denis, Montréal, QC H2J 2L1, Canada.