Origin Media Privacy Policy

Origin Media is a product of CoreOrbit Systems Ltd., based in Vancouver, British Columbia. The Origin Media site can be accessed globally, while its local stories and business features currently focus on Surrey. This policy explains how we handle personal information when you visit originmedia.io, contact us, nominate a business, sign in, subscribe to the newsletter, or use other Origin Media features. Our editorial stories may also include information about the people and businesses featured in them.

For Origin Media privacy questions or requests, contact CoreOrbit's designated Privacy Officer at [email protected]. You can also contact CoreOrbit's privacy address at [email protected].

#Information we collect and why

#Visiting and searching

When you visit, we handle your Internet Protocol (IP) address, browser and device information, requested pages, and technical request information to deliver the site, maintain security, prevent abuse, and diagnose problems. When you search, Algolia handles your search terms and related request information to return relevant published stories and business profiles.

For protected forms and account actions in the new application, we use temporary request counters associated with a keyed hash derived from an IP address or account identifier. These help limit repeated requests across our servers. A hash used for this purpose is not a claim that the information is anonymous. Infrastructure and security providers may also handle the original request information.

#Contacting us

If you use the contact form, we handle your name, email address, subject, message and chosen language. Our application sends these details through Amazon SES to the company inbox so that we can respond. The application does not create a contact-message record in its database or route new inquiries through n8n. Technical request information is handled as described under Visiting and searching. If a delivery response is unavailable, the form returns an error and you can email us instead; an error does not establish that the email was never accepted.

#Nominating a business

If you nominate a business, we collect its name and street, your reason for the nomination, and any name or email address you choose to provide. We use this information to review the nomination and, if needed, contact you. A nomination is not published automatically. Please share only information you are entitled to provide.

#Signing in

If you sign in, we handle your email address, email verification and account identifiers, sign-in links, session information, and security-related request information. We use these to verify your email, keep you signed in, protect your account, and control access to account, merchant, and administration features. Sign-in uses an emailed link rather than a password on this site.

#Subscribing to the newsletter

If you subscribe, we handle your name, verified email address, language choice, consent and subscription history, sign-up IP address, and delivery or unsubscribe records. We use these to send the newsletter, record your choice, prevent duplicate or unwanted sends, and honour opt-outs. Newsletter consent is a separate choice; asking for a sign-in link does not itself subscribe you.

If you participate in an Origin Media story, we may collect and publish the name, words, image, video, and business details agreed for that story. We may also keep material and correspondence needed to prepare, verify, and manage it. Information in a published story or business profile may be indexed by our search provider and visible to anyone on the internet. We handle permission for filming and publication through the editorial process for that story.

#Passport and private profiles, when available

Origin Passport is not currently open to the public. For the first British Columbia pilot, participants aged 19 or older who activate it will have an account identifier and records of age self-confirmation and terms acceptance. For new activations, we record the time and interface language and link the account to a shared copy of the Terms and Privacy Notice versions displayed for review, including any English fallback. These records do not independently verify age or establish that someone read the notices, and reviewing the Privacy Notice is not blanket consent to every use of personal information. When a participant collects a stamp using a staff-issued or printed shop QR code, the service records the participating business, the claim method, and the time. Approved merchant staff and administrators have role and access records. Passport does not require your device's GPS location for a stamp.

Participants can choose an optional private display name and neighbourhood, a preferred language, and an optional profile photo. We use these details to personalize their own account. They are not published as a visitor directory or included in the site's public search index. The verified sign-in email is shown read-only and cannot be changed through the profile form. Profile editing does not change newsletter consent, staff permissions, stamps or the recorded activation confirmation.

Before storing an uploaded photo, our server checks it, removes embedded metadata, resizes and crops it, and compresses it. This does not remove identifying information visible in the image. We store the processed image in private Neon Object Storage and keep its reference with the profile; the source upload is processed temporarily and is not saved as the stored profile photo. The app serves the current photo through the holder's signed-in account; authorized operators and service providers may also handle the underlying information to operate and protect the service. The photo feature does not verify identity or age and does not require a home address or device location. A neighbourhood is optional and does not verify where you live.

#Merchant rewards, when available

Merchant rewards are not currently open to the public. When an eligible participant asks to show a reward code, we create or update a record linked to their Passport account, the participating business and the offer. It includes a copy of the offer details, a hashed representation of the presentation code, its expiry, and whether and when redemption was confirmed. A confirmed redemption also records the account identifier of the approved merchant staff member who confirmed it. We use these records to operate the offer, apply its eligibility and use limits, prevent duplicate fulfilment, and review questions or disputes about a redemption.

Presenting a reward code lets approved staff at the participating business view the offer details and redemption status needed to review and confirm it. The reward desk does not provide them with the participant's sign-in email, private profile, full stamp collection or internal account identifier. Visitor reward history is not published in a public directory or search index. Reward participation is optional, and redemption leaves the permanent stamp collection unchanged. Newsletter choices remain separate.

The presentation code permits a new redemption only within its five-minute lifetime. Expiry does not delete the underlying reward record or a confirmed redemption receipt.

An authorized administrator may record a reviewed finding about an inaccurate receipt or a correction request that was not made. The application retains the original receipt and displays the latest review outcome and its date alongside it. It also retains a private case reference and the administrator who recorded the outcome. This annotation does not replace the recorded staff identity or offer details; the Privacy Officer must review any further correction and the information supplied to others separately.

#Cookies, local storage, and external services

We use necessary session and security technologies to run sign-in and protect the site. The site also stores your language and theme choices and an acknowledgement of its storage notice in your browser. Origin Media does not currently set optional site analytics cookies. See our Cookie Policy for the details and your browser choices.

Cloudflare helps deliver and protect the site and provides the human-verification check on the newsletter form. When you use that form, your browser interacts with Cloudflare, and our server sends Cloudflare the verification token and your IP address to validate it.

When you choose to play an embedded video, the YouTube player loads and YouTube may receive information about your visit and use its own cookies or similar technologies. The player does not load until you press Play. Links to external services, such as maps or social media, take you to those services when selected; their own privacy notices then apply.

#Who handles information for us

We use service providers to operate Origin Media. These include Neon for account authentication, application records, scheduled newsletter processing and private profile-photo storage when enabled, Sanity for editorial content, Algolia for site search, Cloudflare for delivery and security, Amazon Simple Email Service (SES) for email delivery, and the company mailbox provider for inquiries and correspondence. Existing newsletter signup records also remain in the older MongoDB database during migration. Protected records from earlier n8n contact tests and SendXpert delivery or opt-out records may remain subject to their retention and disposal processes. The information each provider handles depends on the feature you use. Our team and authorized merchant staff access only the functions assigned to their roles. We may also disclose information when required by law or to protect the service and its users.

Some providers may process information outside British Columbia or Canada. The prepared Passport database and private photo storage are configured in Neon's US East (Ohio) region in the United States. This does not mean every provider copy, log or processing activity is confined to that region. Privacy laws and government access rules in those places may differ. CoreOrbit remains responsible for the personal information under its control. Contact the Privacy Officer if you want more information about a particular service or transfer.

#Your choices and rights

You can decline the newsletter and still use the site. Every Origin Media newsletter includes an unsubscribe option, and you can also email us to stop receiving it. Unsubscribing stops future newsletter sends, while we may keep a limited record of your choice so that we do not send to you again by mistake. Sign-in and other service messages are separate from the newsletter.

You can ask us what personal information we hold about you and request a correction. You can also ask us to delete information or withdraw consent where the law permits. Some information may need to be kept for legal, security, recordkeeping, or editorial reasons. We may need to verify your identity before acting on a request. Email [email protected] and describe what you need.

When Passport is available, active participants can change or clear the optional name and neighbourhood and replace or remove a photo in their profile. Signing out ends your use of that session; it does not close participation or the sign-in account. Passport closure and other privacy requests are handled through the Privacy Officer rather than a self-service account-deletion button. An authorized Origin administrator may carry out the specific action approved by the Privacy Officer after the request and identity have been reviewed.

Closing Passport stops new stamp collection, reward-code issuance and redemption, and profile or photo changes. It preserves access to your existing collection, profile and completed reward history. The application records the closure time, executing administrator and a private case reference. Closing Passport does not delete these records or close the shared sign-in identity, unsubscribe you from the newsletter, or remove separate merchant staff or administrator permissions. Tell the Privacy Officer if your request also concerns those services or retained information. Newsletter unsubscribe remains a separate choice and does not require a Passport account.

Depending on which privacy law applies to your information, you may have additional rights, such as requesting a copy in a portable form, objecting to certain uses, restricting use, or making a complaint to a privacy regulator. We will review requests under the applicable law and explain any limit that applies. You may contact the Office of the Information and Privacy Commissioner for British Columbia about a concern under BC privacy law.

#Retention and protection

We keep personal information for as long as needed for the purposes described here, including providing the service, answering requests, maintaining accurate subscription and opt-out records, protecting the site, and meeting legal obligations. The period depends on the type of information and why it was collected. We then delete or de-identify it when appropriate. Published editorial content may remain public unless we decide it should be changed or removed.

Reward records support fulfilment history, duplicate prevention and review of errors or disputes. Code expiry, the end of an offer or Passport closure does not automatically remove those records. Reviewed receipt annotations also remain with the original history. The Privacy Officer reviews related access, correction, withdrawal and closure requests, including which records must be retained under applicable law and which require a separately authorized correction or disposal process. The current closure and annotation controls do not erase records, and there is no self-service reward-record deletion function.

For an active Passport, the optional profile fields and current photo support the account until you change or remove them or we act on a separate request about those records, subject to applicable retention obligations. Passport participation closure alone retains the profile and current photo for your read-only account view. A request to remove retained information needs a separate Privacy Officer assessment and action. Replacing or removing a photo while participation is active changes the image available through your profile and requests deletion of the previous stored object. Failed or uncertain deletion work may need later cleanup. A successful provider deletion response does not establish immediate physical erasure from every retained or inherited copy. Service-provider records and protected archives may remain subject to their retention and disposal processes; the Privacy Officer can explain the limits relevant to your request.

Our database archives protect profile records and photo references but do not include the image files themselves. An optional photo may need to be uploaded again if its image cannot be recovered. Restoring an archive must take later removal, correction and unsubscribe requests into account before the restored records are used again.

Archives can also contain older reward records. Restore review must account for later corrections, account-closure actions and confirmed redemptions so that an older record is not treated as permission to fulfil the same reward again.

We use access controls and other technical and organizational safeguards appropriate to the information. No internet service can guarantee absolute security. If you believe your account or information has been affected by a security issue, contact us at [email protected].

#Children and young people

For the first British Columbia pilot, Origin Passport, if enabled, is limited to people aged 19 or older. Stories involving young people are subject to a separate editorial and safeguarding review; youth stories are not currently published through the new Stories feature. If you are a parent or guardian with a concern about a young person's information on Origin Media, contact us.

#Changes to this policy

We may update this policy as the service changes. The version published on the site will show its last-updated date. If a change materially affects how we use information, we will provide any additional notice required by applicable law.