Privacy policy
Last updated: October 20, 2026
This privacy policy explains how On Point Training collects, uses, stores and shares personal information when you use https://www.onpointtraining.ca (the “Website”), book or attend a course, create an account, or contact us. On Point Training is a partnership registered in British Columbia, Canada. In this policy, “we”, “us” and “our” mean On Point Training.
We have written this policy in plain language. If anything is unclear, contact our Privacy Officer using the details at the end.
Summary
What we collect. Your name and contact details, the details needed to register you for a course, booking and payment information, and technical information about how you use the Website.
Why we collect it. To deliver courses, process payments, meet RCMP and BCWF requirements, communicate with you, keep the Website secure, and — only with your consent — send marketing email.
Who we share it with. Our payment processor (Square), our hosting and email providers, Google for the optional address lookup, Cloudflare for security, and the RCMP or BCWF where the law requires it. We do not sell personal information.
Your choices. You can ask for access to your information, ask us to correct or delete it, withdraw consent, or unsubscribe from marketing at any time.
Students under 18. Some courses accept students under 18 with the consent of a parent or guardian. We do not market to minors.
Cookies. We use necessary cookies to run the site and, with your consent, optional analytics and marketing cookies. See our Cookie Policy.
Who this policy applies to
This policy applies to the Website, our booking and ticketing system, student accounts, and our course and administrative communications. It covers in-person courses and, when they become available, online courses.
It does not apply to websites or services we link to, including Square’s payment pages, Google, Cloudflare, the RCMP and the BC Wildlife Federation (BCWF). Those organisations have their own privacy policies.
Information we collect
Information you give us
What we collect depends on how you interact with us. It may include:
Identity and contact details — salutation, first and last name, email address, phone number and phone type, mailing address, and date of birth.
Parent or guardian details — if a student is under 18, the name and contact details of the parent or guardian responsible for the booking.
Booking details — the course, date and location, the seats you book, the students assigned to each seat, prerequisites, and age confirmation.
Payment information — payments are processed by Square. We receive confirmation that a payment was made, the amount, the transaction reference and limited card details such as the last four digits. Payment card details are entered into Square’s secure payment form, and we do not store your full card number.
Communications — emails, contact-form messages, notes from phone calls, and feedback you give us.
Account information — the email address and password for your account. Passwords are stored in hashed form by WordPress.
Marketing preferences — your email address and subscription choices if you sign up for news or course-date emails. Marketing is separate from booking and is never required to buy a course.
We do not collect your gender. We do not use your booking information for marketing.
Information collected automatically
When you visit the Website, our servers and security providers may record technical information such as your IP address, browser and device type, operating system, the pages you view, the date and time, the page that referred you, and approximate location derived from your IP address. We use this information to operate and secure the Website, diagnose problems and understand overall usage. It is not used to identify you personally.
We also use cookies and similar technologies. See our Cookie Policy for details and choices.
Information from third parties
We receive a limited amount of information from third parties:
Google — when you use the optional address lookup in a booking form, Google returns address suggestions. See “Address lookup” below.
Square — payment status, transaction references and fraud-prevention signals.
Cloudflare Turnstile — a security signal that helps us distinguish real visitors from automated abuse.
We do not buy personal information and we do not receive it from data brokers.
How we use your information
We use personal information for the following purposes:
Delivering courses — confirming bookings, assigning seats to students, preparing class rosters, providing course materials, and issuing certificates or records of completion.
Student accounts — creating and managing the account each student needs to access course information and materials.
Payments and refunds — processing payments through Square, issuing refunds, and maintaining financial records.
Legal and regulatory requirements — submitting the information required by the RCMP for the Canadian Firearms Safety Course (CFSC) and Canadian Restricted Firearms Safety Course (CRFSC), and by the BCWF for the CORE examination; maintaining tax and accounting records; responding to lawful requests.
Communication — sending booking confirmations, reminders, course changes, receipts and support replies.
Safety and eligibility — confirming that a student meets the minimum age and other requirements for a course, and managing conduct and safety.
Security and fraud prevention — protecting the Website, our accounts and our systems, and preventing spam, abuse and unauthorised access.
Improvement — understanding how the Website is used, fixing problems and improving our courses and services. Where possible we use aggregated or de-identified information for this.
Marketing — sending news and course-date emails only if you have opted in. You can unsubscribe at any time.
We do not sell, rent or trade personal information. We do not use student or booking information for advertising, and we do not use it to build advertising profiles.
Legal bases for processing
In Canada, we rely on your consent (express or implied where the law permits), on the performance of our agreement with you, and on legal requirements. Where information is sensitive — for example your date of birth and address — we rely on your express consent. You may withdraw consent at any time, subject to legal and contractual restrictions.
If you are in the European Economic Area or the United Kingdom, we rely on: performance of a contract (delivering the course you booked), compliance with a legal obligation (tax, firearms and CORE reporting), our legitimate interests (security, fraud prevention and improving our services), and your consent (marketing and optional cookies).
If you are in Quebec, the requirements of Quebec’s privacy law apply in addition to the federal law. You can exercise the same rights described below.
When we share information
We share personal information only as needed for the purposes in this policy, with:
Payment processor — Square, to process payments and refunds.
Hosting and infrastructure providers — to host the Website, store data and run backups.
Email providers — to deliver transactional email and, with consent, marketing email.
Google — for the optional address lookup.
Cloudflare — for Turnstile security checks and network protection.
RCMP and BCWF — where required for firearms course and CORE examination records.
Professional advisers and authorities — our lawyers, accountants and insurers where necessary; law enforcement or a regulator where the law requires or permits it; and anyone we reasonably believe needs the information to prevent serious harm.
A buyer or successor — if the business is sold, merged or reorganised, subject to this policy.
Our service providers may only use personal information for the services they provide to us, and they are required to protect it. Our booking, ticketing and customer-record systems are operated by us or on our behalf; we remain responsible for the information in them.
Address lookup
When you type four or more characters into the street address field of a booking form, the text you typed is sent through our server to Google Places Autocomplete to suggest addresses. If you select a suggestion, one more request (Place Details) is sent. Google receives the text you typed, a random session token, and our server’s credentials and IP address. It does not receive your IP address, browser details or the page you are viewing. Nothing is sent until you type in the street address field, and the lookup is optional — you can type your address without selecting a suggestion. We do not log the text you type; we keep only short-lived hashed-IP rate-limit counters and a daily request count. Google’s handling of that data is governed by Google’s privacy policy at https://policies.google.com/privacy.
Cookies and tracking
We use necessary cookies to run the shopping cart, checkout, login and security features. With your consent, we may also use analytics and marketing tools, including email tracking provided by our email provider, Brevo. Optional tools do not load until you consent.
You can accept, reject or change your cookie choices at any time using the Cookie settings link on our Policies page. Our Cookie Policy explains the categories, the tools we use and how to control cookies in your browser.
We do not use advertising or retargeting cookies.
How long we keep information
Student and course records — for at least six years after the course, because the RCMP requires us to retain student information from federal firearms courses for no less than six years.
Order, payment and tax records — for at least six years, as required for tax and accounting purposes.
Accounts — while your account is open, and for a reasonable period afterwards in case of disputes or legal requirements.
Marketing contacts — until you unsubscribe or ask us to delete your details. We may keep a minimal suppression record so that we do not contact you again.
Support and general correspondence — for as long as needed to deal with the matter and for our ordinary business records.
Technical and security logs — for a short period needed for security and troubleshooting, then deleted or aggregated.
When information is no longer needed, we delete or anonymise it. If deletion is not immediately possible — for example because it is held in a backup — we isolate it and stop using it until it can be deleted.
How we protect information
We use reasonable technical and organisational safeguards, including encrypted connections (HTTPS), access controls, hashed passwords, restricted administrative access, regular updates and backups. No system can be guaranteed to be completely secure, so please use a strong, unique password and tell us promptly if you suspect unauthorised access to your account.
If we become aware of a breach of security safeguards involving personal information under our control that creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, and keep the records the law requires. Where appropriate, we will also notify the Office of the Information and Privacy Commissioner for British Columbia.
Students under 18
Some of our courses are open to students under 18: the CFSC from age 12 and the CORE course from age 10. The CRFSC is for students aged 18 and over.
Where a student is under 18, a parent or guardian must make the booking, consent to the student’s participation and act as the main contact. We collect only the information needed to register and teach the student. We do not knowingly market to minors: our marketing lists are intended for people who have reached the age of majority in their jurisdiction. If we learn that a minor has subscribed, we will remove them. A parent or guardian can contact us to access, correct or delete a minor’s information.
Your privacy rights
Depending on where you live, you may have the right to:
ask whether we hold personal information about you and obtain a copy of it;
ask us to correct information that is inaccurate or incomplete;
withdraw your consent, subject to legal and contractual restrictions;
ask us to delete your information, where we are not required to keep it;
object to or restrict certain processing; and
ask for your information in a portable format, where that right applies.
To make a request, contact our Privacy Officer. We will respond within 30 days unless the law permits an extension, in which case we will explain why.
Marketing. Every marketing email includes an unsubscribe link. You can also ask us to stop marketing at any time. We act on unsubscribe requests within 10 business days. Unsubscribing from marketing does not stop transactional messages about a course you have booked.
Accounts. You can review or change your account information by logging in, or by contacting us. If you ask us to close your account, we will deactivate or delete it, but we may keep information we need for legal, tax, firearms-record or fraud-prevention purposes.
EU and UK visitors. You also have the right to lodge a complaint with your local data protection authority.
Canada. If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca, or the Office of the Privacy Commissioner of Canada at priv.gc.ca.
International transfers
Some of our service providers process information outside Canada, including in the United States and the European Union. Where information is transferred outside Canada, we require our providers to protect it through contractual and other safeguards, and we remain responsible for personal information under our control. Contact us if you would like more information about these safeguards.
Do not track and do not sell
We do not sell personal information. We do not currently respond to browser “Do Not Track” signals because there is no consistent industry standard for them. We do honour the cookie choices you make through our consent tool. If a standard is adopted that we are required to follow, we will update this policy.
Changes to this policy
We may update this policy from time to time. The updated version will show a new “Last updated” date and will apply when it is posted. If we make a material change, we will post a notice on the Website or contact you directly where appropriate.
Contact us
Privacy Officer, On Point Training
Email: [email protected]
If you have a question about this policy, want to access, correct or delete your information, or want to withdraw consent, contact the Privacy Officer using the details above.