Manager, Privacy & Compliance

Job Title: Manager, Privacy & Compliance

Reports To: Head of Compliance and Enterprise Risk

Location: Preference will be given to Calgary based applicants; but open to remote workers, based in Canada.

atVenu's Compliance & Risk team is seeking an experienced privacy professional to lead and mature our privacy function. As a live event commerce platform handling transaction data for venues, promoters, artists, and fans across North America and expanding in Europe, we operate at the intersection of B2B SaaS and payments. Privacy isn't an afterthought; its core to how we build and operate.

This is a high-impact individual contributor role with real ownership. You'll be atVenu's only dedicated privacy resource, working across Legal, Engineering, Product, and Operations to ensure we're meeting our obligations under GDPR, CCPA/CPRA, PIPEDA, and other applicable frameworks.

This is a hands-on role. You'll be expected to draft policies, oversee cookie consent configurations, review contracts, engage with product teams during development, and manage DSARs (low volume), while also thinking strategically about where the program needs to go. It requires someone with the technical depth to understand what privacy compliance really means in a SaaS/payments context, and the experience to execute in collaboration with the business.

• Lead the day-to-day operation and continued development of atVenu’s privacy compliance program, including maintaining privacy policies, and internal standards.
• Champion privacy requirements across new business initiatives from concept through to operation, managing cross-functional stakeholder engagement to ensure privacy considerations are identified early and carried through to implementation.
• Conduct and manage Data Protection Impact Assessments (DPIAs) for new products, features, integrations, and third-party service providers.
• Serve as the company’s subject matter expert on GDPR, CCPA/CPRA, PIPEDA, and emerging privacy regulations, providing practical, risk-based guidance to business and technical teams.
• Partner with Legal to review and negotiate data processing agreements (DPAs), vendor contracts, and other agreements with privacy implications.
• Manage and maintain atVenu’s One Trust Cookie Consent implementation, ensuring it reflects current data flows and regulatory requirements.
• Review customer agreements and data-related contractual obligations to identify permitted and restricted uses of customer data, and work with Legal and Operations to ensure those obligations are understood and operationalized across the business.
• Monitor ongoing data practices to ensure customer data is being used in a manner consistent with contractual commitments, flagging and remediating gaps where they arise.
• Work with Engineering and Product teams to embed privacy-by-design principles into the development lifecycle.
• Manage and respond to data subject access requests (DSARs) and privacy inquiries in a timely and compliant manner.
• Lead the privacy workstream during incidents including conducting privacy impact assessments, managing regulatory notifications, and coordinating communication with affected individuals where required.
• Assess the privacy implications of AI and machine learning systems at every stage, from evaluating third‑party tools before adoption, to reviewing internally developed models from design through deployment, ensuring data use is lawful, transparent, and aligned with regulatory and contractual expectations.
• Monitor the evolving regulatory landscape and assess the impact of new or amended privacy laws on atVenu’s operations.
• Cultivate a lasting privacy‑aware culture by designing and delivering training, creating practical guidance, and serving as a trusted resource for teams navigating privacy questions in their work.

• 8+ years of hands‑on privacy compliance experience, ideally in a B2B SaaS, fintech, or a payments environment.
• Deep, practical knowledge of GDPR, CCPA/CPRA, and PIPEDA, including how these frameworks apply to transaction data and third‑party data sharing.
• Proven experience conducting DPIAs and translating their findings into…