Privacy Policy

1. Introduction

FlexiTours ("we", "our") is committed to protecting the personal information of its customers in accordance with Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). This policy explains what information we collect, why we collect it, and how you can exercise your rights.

2. Information We Collect

We collect the following categories of information when you use our platform:

- Identity information: first name, last name, email address, phone number. - Payment information: credit card details processed securely by Stripe. We do not store any card numbers on our servers. - Booking information: dates, destinations, number of participants, tour preferences. - Browsing data: IP address, browser type, pages visited, session duration (via cookies — see our Cookie Policy).

3. Purposes of Processing

Your information is used for the following purposes:

- Processing and confirming your private tour and shuttle bookings. - Communication related to your booking (confirmations, reminders, changes). - Processing payments via Stripe in accordance with that provider's terms. - Improving our services and personalizing your experience. - Meeting our legal and tax obligations (GST/QST in Quebec). - Sending promotional communications, only with your express consent.

4. Sharing of Information

We do not sell or rent your personal information to third parties. We may share your data with:

- Stripe Inc. for secure payment processing. - Our certified guides, strictly to the extent necessary to fulfill your booking. - Competent authorities when required by law.

All third-party service providers are contractually bound to protect your information and use it only for the purposes for which it was disclosed.

5. Data Retention

Your information is retained for as long as necessary to achieve the purposes described in this policy, or as required by applicable law. Payment data tokenized by Stripe is subject to Stripe's retention policy. You may request deletion of your account and associated information by contacting us.

6. Your Rights (Law 25 / PIPEDA)

In accordance with Law 25 and applicable Canadian laws, you have the following rights:

- Right of access to your personal information. - Right to correct inaccurate information. - Right to data portability. - Right to withdraw consent at any time. - Right to file a complaint with the Commission d'accès à l'information du Québec (CAI).

To exercise these rights, contact us at the address provided in Section 8.

7. Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, loss, or disclosure. Payment transactions are encrypted via TLS and processed exclusively by Stripe, which is PCI DSS certified.

8. Contact Us

For any questions regarding this policy or to exercise your rights, please contact us by email. We are committed to responding to any request within thirty (30) days, in accordance with Law 25.