Privacy Policy

Brighton Shores Summer Estates Ltd., operating as Timber House Resort

Last updated: September 2026

Privacy of personal information is an important principle to Brighton Shores Summer Estates Ltd. We are committed to collecting, using and disclosing personal information responsibly and only to the extent necessary for the premises, accommodation, goods and services we provide. We also try to be open and transparent about how we handle personal information. This document describes our privacy policy.

This policy is made under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law, which applies to our commercial activities in Ontario.

Where this policy applies

This is the privacy policy for everything Brighton Shores Summer Estates Ltd. does:

• On the property at Timber House Resort, 116 Cedardale Road, Brighton, Ontario — seasonal sites, residential tenancies, guest rooms and cottages, weddings, events, and the waterfront.
• On this website, timberhouse.net — our public website and online store (see "Website and online store" below).
• On our online property portal, app.modelpie.ca — the private portal where seasonal licensees, residential occupants, partners and staff manage contracts, billing and other resort matters. The portal has its own supplementary privacy policy, published at app.modelpie.ca/privacy, which adds disclosures specific to that platform. Where the two overlap, the portal policy is more specific and governs the portal.

A copy of this policy is posted at the resort office and on this website.

What is personal information?

Personal information is information about an identifiable individual. It includes information about a person's characteristics (for example age, home address or phone number, family status), their health (for example a disability), and their activities and views (for example opinions expressed by or about an individual). Personal information is different from business contact information (for example a person's business address and phone number), which is not protected by privacy legislation.

Who we are

Brighton Shores Summer Estates Ltd. is an Ontario corporation that owns and operates Timber House Resort, an 18-acre waterfront property on Lake Ontario in Brighton, Ontario. We are a small, owner-operated business. We offer seasonal trailer and park-model sites under licence of occupation, residential tenancies, hotel rooms and cottages for overnight guests, and a venue for weddings, reunions, festivals and other events.

To provide these services we employ staff and use consultants and contractors who may, in the course of their duties, have access to personal information we hold. These include maintenance, cleaning and grounds contractors, security, accountants, lawyers, software and IT consultants, and seasonal or temporary workers. We restrict their access to personal information as much as is reasonably possible and require them to follow appropriate privacy principles.

Why we collect personal information — primary purposes

Seasonal licensees and residential occupants

For people who occupy a site, trailer, park model or residential unit at Timber House Resort, our primary purposes for collecting personal information are to ensure their safety, security and reasonable enjoyment and that of other occupants; to ensure they have access to the premises, utilities, equipment and services we have agreed to provide; to preserve the property; to comply with our obligations under the Residential Tenancies Act, 2006 where it applies; and to collect rent, licence fees, utility charges and other amounts owing.

Examples of the information we collect for these purposes include:

• Names of all occupants of the site or unit, including secondary occupants
• Home, business and emergency contact information
• Vehicle, trailer and park-model information (make, model, plate, serial or VIN)
• Insurance company and policy number for the trailer or park model
• Use and intended use of the site or unit
• Compliance with the licence of occupation or tenancy agreement and the Property Rules
• Payment and other financial information relating to amounts owing to us
• Rent, licence fees, utility allocations and other charges for each site or unit

We disclose limited personal information to suppliers of services (for example telecommunications or utility providers) so they can make their services available to occupants. We may also disclose personal information to our insurers, lenders, or a prospective purchaser of the property, under confidentiality obligations.

It would be rare for us to collect personal information without the occupant's express consent, but this might occur in a case of urgency (for example the occupant is unavailable), where we believe the occupant would consent if asked and it is impractical to obtain consent (for example information provided by a relative about an absent occupant), from appropriate public sources (for example government, court or tribunal records), or to investigate a breach of the agreement or a contravention of the law.

We use an online commercial screening service to obtain credit and criminal background information about prospective occupants. We collect your full legal name and date of birth so that those records are accurate, and we obtain your written consent to the checks in the application form. The screening service has its own privacy policy governing how it collects and holds the information it reports to us.

Prospective occupants

People applying for a seasonal site or residential unit are asked to complete an application so we can assess their suitability and have the basic information we need if they become occupants. This may include past and current tenancy or seasonal history, employment, contact information, references, financial means, vehicle and trailer information, and intended use of the site. We confirm this information, check references, run the credit and criminal background checks described above, and may consult appropriate public sources (for example court or tribunal records). By completing an application you agree to us collecting this information and conducting these checks.

Overnight guests, event hosts and attendees

For guests booking hotel rooms, cottages or short-term accommodation, and for couples, families and organizations hosting weddings, reunions and events, we collect the information needed to take and honour the booking: names, contact details, dates, party size, special requests, and payment. For event ticket purchasers we collect attendee names and email addresses to issue and validate tickets. We use this information to deliver the booking or event, communicate with you about it, and meet our legal and accounting obligations.

Text messages to short-term accommodation guests. For guests staying in our hotel rooms, cottages and short-term accommodation, we use Akia (akia.com), a guest-messaging service, to send and receive text messages about your stay — arrival instructions, check-in and check-out details, Wi-Fi and property information, and answers to your questions. Akia receives your name, mobile number, booking dates and unit, and the content of the messages exchanged. These messages are part of delivering your booking; by providing your mobile number with a reservation you agree to receive them. Standard message and data rates from your carrier may apply, and you can stop messages at any time by replying STOP. We do not use Akia to send marketing without your separate consent.

Members of the general public

For visitors and members of the public, our primary purpose for collecting personal information is to promote the safety of occupants and guests and the security of the property. For example, we may operate security cameras and monitor the presence, vehicles and conduct of visitors on the property. We believe the collection of this information is implied by the private nature of the property.

We may also gather personal information in the course of marketing the resort. This information is collected either from appropriate public sources or directly from individuals with their consent.

Suppliers and contractors

We deal with suppliers and contractors who provide goods and services to the resort. We monitor their performance, including promptness, reliability, quality and value. Most of this is business information not covered by privacy legislation, but occasionally it relates to the conduct of an individual (for example the skill of a particular tradesperson or inappropriate behaviour by a representative). We reserve the right to collect this information, use it in deciding on future services, and disclose it to others involved in related operations. We may also collect home contact information to reach contractors in an emergency.

Employees and contract staff

For people who work for us, our primary purpose for collecting personal information is to contact them, manage their employment or engagement, and meet payroll, tax and workplace obligations. Examples include home addresses, phone numbers, SIN and banking information for payroll, and emergency contacts. It is rare for us to collect such information without consent, but it might happen in an emergency (for example a contagious illness outbreak) or to investigate a possible breach of law.

Related and secondary purposes

Like most businesses, we also collect, use and disclose personal information for purposes related to or secondary to our primary purposes. The most common examples are:

• To collect rents, fees and accounts, including through collection agencies or legal proceedings where necessary.
• To communicate with occupants and guests about the resort, events, rule changes and notices, including by email and the online portal.
• To review occupant, guest and other files to ensure we provide high-quality service and to assess the performance of our staff, consultants and suppliers. External consultants (for example auditors, lawyers or business consultants) may do audits and reviews on our behalf, including reviewing files and interviewing staff.
• Government agencies (for example the Canada Revenue Agency, the Privacy Commissioner of Canada, the Ontario Human Rights Commission, the Landlord and Tenant Board, and municipal officials) have the authority to review our files and interview our staff as part of their mandates. We also believe we should report information suggesting serious illegal behaviour to the authorities, keeping such disclosure to a minimum.
• If an occupant's rent or fees are paid by a third party (for example an employer, trustee or government program), we may be asked to provide that party with certain information.
• To respond to questions about the services we provided. We retain occupant and guest records after the relationship ends so we can answer those questions and meet our accountability obligations.

You can choose not to be part of some of these related purposes (for example by not having a third party pay your fees). We do not have much choice about others (for example external regulation).

Website and online store (timberhouse.net)

This website is hosted on Shopify Inc.'s e-commerce platform.

Information collected automatically. When you visit timberhouse.net, Shopify and our website collect certain information about your device: browser type, IP address, time zone, referring pages, the pages and products you view, and how you interact with the site. This is collected through cookies, log files, and similar technologies. We use it to keep the site working, to screen for fraud, and to understand how the site is used.

Analytics. We use Google Analytics to understand how visitors use the site. You can read Google's privacy policy at policies.google.com/privacy and opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

Advertising. From time to time we run advertising campaigns through Google Ads and Meta (Facebook and Instagram). When a campaign is active, those platforms may place a tag or pixel on this site so that we can measure whether our ads led to a visit or booking and show our ads to people who have visited the site. You can opt out of personalized advertising at adssettings.google.com (Google), in your Facebook or Instagram ad preferences (Meta), and through the Digital Advertising Alliance of Canada at youradchoices.ca. Opting out does not stop you from seeing ads; it stops them being tailored to you.

QR codes on products and signage. Some of our products (for example jars of jam) and signs carry QR codes that link to product information, room-rate offers or other pages on this site. The codes are generated by Shopify and point to Shopify-hosted links. When you scan one, Shopify records the scan — the time, your IP address, device and browser type — so that we can see how many people used each code, and then sends you to the page. Scanning is optional, we cannot tell who scanned a code, and the information is handled under Shopify's privacy policy in the same way as any other visit to this site. If we use another QR or link-shortening service in future, we will name it here.

Cookies. Cookies are small files placed on your device. We use them to help you navigate the site, keep items in your cart, and keep you logged in. They are not used to track you across other websites. You can disable cookies in your browser, but parts of the site may then not work.

Purchases and bookings. When you buy something, book accommodation, or purchase an event ticket on this site, we collect your name, email address, phone number, billing address, and the details of your order or booking. Payment is processed by Shopify Payments or the payment provider you choose at checkout. We do not see or store your full credit card number. The payment provider handles card details under its own privacy policy. Hotel room, cottage and short-term accommodation reservations are made through InnRoad, our property-management and booking system, which you reach through the booking links on this site and which also connects us to online travel agencies. When you follow a booking link you leave the Shopify store and enter InnRoad's booking engine; InnRoad receives the guest and booking details needed to manage availability, reservations, payment and check-in, and holds them under its own privacy policy (innroad.com). If you book through a third-party travel site, that site's privacy policy also applies to what you gave it. Guest communication during your stay is handled through Akia, described above.

Event tickets and the portal. When you buy an event ticket on this site, your order details (attendee name, email address, and the items purchased) are automatically sent to our property portal at app.modelpie.ca, which generates your ticket and QR code and emails it to you. That transfer is described in the app.modelpie.ca privacy policy.

Newsletter and marketing email. If you subscribe to our newsletter or opt in at checkout, we will send you news and offers about the resort. Every message includes an unsubscribe link, and you can withdraw consent at any time. We comply with Canada's anti-spam legislation (CASL).

Shopify. You can read how Shopify handles personal information at shopify.com/legal/privacy. Shopify stores data in Canada and the United States.

Do Not Track. We do not alter our practices in response to browser Do Not Track signals.

Online property portal (app.modelpie.ca)

Seasonal licensees, residential occupants, event partners and staff use our online portal at app.modelpie.ca to complete onboarding, keep their profile and emergency contacts current, view contracts and notices, view utility billing explanations, manage fractional sharing of their trailer within a closed group they choose, and (for authorized partners) access financial information under a non-disclosure agreement. The portal also publishes a map of the property showing which lots are occupied or available; the map shows lot status only and never occupant names. The portal runs on the ModelPie software platform.

The portal is covered by this policy and by a supplementary policy at app.modelpie.ca/privacy that describes the specific data the portal holds, the cloud services it uses, and how to manage your consents there. Please read both.

Protecting personal information

We understand the importance of protecting personal information. We have taken the following steps:

• Paper records are kept under supervision or in a locked or restricted area.
• Computers, phones and other devices are password-protected, kept under supervision or secured, and updated regularly.
• Electronic records are stored in cloud services that encrypt data in transit and at rest, with access limited by role. Details for the portal are in the app.modelpie.ca privacy policy.
• Paper records are transmitted in sealed, addressed envelopes or boxes by reputable carriers.
• Staff are trained to collect, use and disclose personal information only as necessary to do their jobs and in accordance with this policy.
• External consultants and agencies with access to personal information must give us appropriate privacy assurances.

Retention and destruction of personal information

We keep personal information long enough to answer questions about the services we provided and to meet our obligations to regulators, but not longer than necessary.

• Occupant files (seasonal licensees and residential tenants): at least 5 years from the last month of occupancy. Financial records that support tax filings are kept for the period required by the Canada Revenue Agency (currently 6 years from the end of the tax year to which they relate).
• Guest and event bookings, and ticket orders: kept for our accounting records for the same 6-year period, after which they are deleted or anonymized.
• Applications from prospective occupants who do not become occupants: approximately 12 months.
• General correspondence with people who are not occupants or guests: approximately 3 months.
• Contact directories and mailing lists: removed when we do not expect to contact you again, and immediately on request.
• Video recordings: 60 days, unless needed longer for an ongoing incident, a legal requirement, or contemplated litigation.

We destroy paper records by shredding. We destroy electronic records by deletion and, when hardware is retired, by physically destroying or fully wiping the storage.

Access to and correction of your personal information

With some exceptions, you have the right to know what personal information we hold about you, how it is used, and to whom it has been disclosed, and to see it. Often all you have to do is ask. We will help you identify what records we might have and help you understand them. We will need to confirm your identity before providing access. We reserve the right to charge a nominal fee for extensive requests.

If your request is complex we may ask you to put it in writing, and we will help you prepare it if you tell us you need assistance. We will respond within 30 days of receiving your request. If we cannot respond within 30 days we will send you a notice of extension explaining why.

In some situations we cannot provide access to all of the information we hold — for example where it contains personal information about other people, where it is subject to solicitor-client or litigation privilege, where disclosure is prohibited by law or would reveal confidential commercial information, or where providing it would be prohibitively costly. If we deny access we will tell you the reason, as best we can.

If you believe there is a mistake in your information, you have the right to ask for it to be corrected. We may ask for documentation. Where we agree we made a mistake, we will correct it and notify anyone to whom we sent the incorrect information. If we do not agree, we will still include a brief statement from you on the point in your file and forward that statement to anyone who received the earlier information.

If you believe there has been an unauthorized disclosure of your personal information, please put your complaint in writing to our Information Officer.

Video surveillance

Video cameras operate at several outdoor locations on the property: near the main building entrance, near the utility buildings, and near the waste and recycling bins. The cameras record video only; they do not record sound, and we do not use facial recognition or other automated identification. Cameras operate at all times and recordings may be reviewed at any time. We may add cameras at other outdoor common areas; if we do, this policy and the posted signs will be updated.

The purpose of the cameras is to ensure the safety, security and reasonable enjoyment of occupants and guests, to protect the buildings, utilities and property, to monitor use of the waste facilities, and to deter crime.

Signs are posted advising that video recording is in operation, with contact information for our Information Officer, whom you can contact with questions or to request access to recorded images of yourself.

Your image, movements, actions and vehicle may be recorded when you are within view of a camera. Recordings are stored in a secured location with limited access and are kept for 60 days before being overwritten or destroyed, unless needed longer for an ongoing incident, a legal requirement, or contemplated litigation.

Disclosure without your knowledge or consent

PIPEDA permits us to disclose personal information without your knowledge or consent in certain circumstances, and we may do so where: disclosure is required by law; the information is provided to our lawyers; disclosure is for the purpose of collecting a debt you owe us; we are complying with a subpoena, warrant, court order or rules of court; a government institution has requested the information, identified its lawful authority, and indicated that the request relates to national security, law enforcement, or the administration of a law of Canada or a province; or an investigative body reasonably requires it to investigate a breach of an agreement or a contravention of law.

On our own initiative, we may disclose information to an investigative body or government institution where we have reasonable grounds to believe it relates to a breach of an agreement or a contravention of law that has been, is being or is about to be committed.

If we disclose information because of an emergency that threatens the life, health or security of an individual, and that individual is alive, we will inform them in writing of the disclosure without delay.

We may also use personal information without your knowledge or consent where we have reasonable grounds to believe it could be useful in investigating a contravention of law, where it is used to act in respect of an emergency that threatens life, health or security, or where it was collected in circumstances in which consent is not required.

Employees, agents and contractors who fail to comply with this policy are subject to disciplinary action.

Children

Our services, this website and the portal are not directed to individuals under 18. Individuals under 18 cannot enter a licence of occupation, tenancy or accommodation booking without a parent or guardian. If we learn that we have collected personal information from a child without parental consent, we will delete it.

Changes to this privacy policy

Brighton Shores Summer Estates Ltd. may change this policy from time to time. If we make a material change we will post the updated policy here and at the resort office, and, for occupants and portal users, notify you by email or through the portal. We recommend that you review this policy periodically. The date at the top shows when it was last revised.

Questions and complaints

Our Information Officer, Jordan Johnston, can be reached at:

Brighton Shores Summer Estates Ltd. (Timber House Resort) 116 Cedardale Road, PO Box 903 Brighton, ON K0K 1H0 jjohnston@timberhouse.net

The Information Officer will try to answer any questions or concerns you have. If you wish to make a formal complaint about our privacy practices, put it in writing to the Information Officer, who will acknowledge receipt, ensure it is investigated promptly, and provide you with a written decision and reasons.

This policy is made under the Personal Information Protection and Electronic Documents Act. It is a complex Act with some additional exceptions to the privacy principles that are too detailed to set out here.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, which oversees the administration of privacy legislation in the private sector and acts as an ombudsman for privacy disputes:

Office of the Privacy Commissioner of Canada 30 Victoria Street, Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 Phone: 819-994-5444 TTY: 819-994-6591 www.priv.gc.ca