Privacy Policy

Effective Date: July 5, 2025

Last Updated: July 10, 2025

1. Introduction and Scope

Who We Are

Echo Voyages Inc. ("we," "our," "us," or "Echo Voyages") is a Canadian corporation providing premium cruise tours and maritime experiences. We are committed to protecting your privacy and handling your personal information responsibly and transparently.

Legal Framework

This Privacy Policy complies with:

• Personal Information Protection and Electronic Documents Act (PIPEDA) - Federal privacy law
• Personal Information Protection Act (PIPA) - British Columbia provincial privacy law
• Canada's Anti-Spam Legislation (CASL) - Electronic communications
• General Data Protection Regulation (GDPR) - For European visitors
• California Consumer Privacy Act (CCPA) - For California residents

Scope of Application

This policy applies to all personal information we collect through:

• Our website (echovoyages.com)
• Mobile applications
• Booking and reservation systems
• Customer service interactions
• Onboard cruise services
• Marketing and promotional activities
• Third-party integrations and partnerships

2. Information We Collect

Personal Information You Provide Directly

Information Collected Automatically

Information from Third Parties

• Travel Agents: Booking information and passenger details
• Payment Processors: Transaction verification and fraud prevention data
• Social Media: Profile information when you interact with our social content
• Data Brokers: Marketing and demographic information (with consent)
• Government Agencies: Security screening and regulatory compliance information

3. How We Use Your Information

Primary Purposes (No Additional Consent Required)

Secondary Purposes (With Your Consent)

4. Legal Basis for Processing (GDPR Compliance)

5. Information Sharing and Disclosure

Service Providers and Business Partners

We share information with trusted third parties who assist in our operations:

Government and Regulatory Authorities

We may disclose information when legally required:

• Transport Canada: Maritime safety and passenger manifests
• Canada Border Services Agency: Immigration and customs clearance
• Revenue agencies: Tax reporting and compliance
• Law enforcement: Criminal investigations and court orders
• Public health authorities: Health emergencies and contact tracing

Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you and ensure continued protection under this privacy policy.

6. Data Security and Protection

Technical Safeguards

Organizational Safeguards

• Staff Training: Regular privacy and security awareness training
• Background Checks: Security screening for employees with data access
• Confidentiality Agreements: Binding privacy commitments for all staff
• Incident Response: Procedures for data breach notification and response
• Privacy by Design: Privacy considerations in all system development

Data Breach Notification

In the event of a data security incident, we will:

1. Assess and contain the breach within 24 hours
2. Notify the Privacy Commissioner within 72 hours (if required)
3. Inform affected individuals without undue delay
4. Provide clear information about the incident and protective measures
5. Offer credit monitoring or identity protection services when appropriate

7. Data Retention and Deletion

Retention Periods

Secure Deletion

When information is no longer needed, we securely delete it using:

• Cryptographic erasure for encrypted data
• Multi-pass overwriting for physical storage devices
• Certificate of destruction for physical documents
• Verified deletion from backup systems

8. Your Privacy Rights

Under Canadian Privacy Law (PIPEDA)

Additional Rights for EU Residents (GDPR)

• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
• Right to Portability: Receive your data in a machine-readable format
• Right to Restrict Processing: Limit how we use your information
• Right to Object: Object to processing based on legitimate interests
• Right to Complain: File complaints with EU data protection authorities

Additional Rights for California Residents (CCPA)

• Right to Know: Detailed information about data collection and use
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt out of the sale of personal information
• Right to Non-Discrimination: Equal service regardless of privacy choices

How to Exercise Your Rights

9. International Data Transfers

Transfer Safeguards

When we transfer personal information outside Canada, we ensure adequate protection through:

• Adequacy Decisions: Transfers to countries deemed adequate by Canadian authorities
• Standard Contractual Clauses: EU-approved data transfer agreements
• Binding Corporate Rules: Internal privacy standards for multinational partners
• Certification Schemes: Privacy Shield successors and similar frameworks

Current Transfer Destinations

10. Google Ads and Digital Marketing Compliance

Google Ads Usage

We use Google Ads services for marketing and advertising, which involves:

• Google Ads Conversion Tracking: Measuring advertising effectiveness
• Google Analytics: Understanding website traffic and user behavior
• Google Tag Manager: Managing tracking codes and pixels
• YouTube advertising: Video marketing campaigns
• Display advertising: Banner ads on Google's network

Data Sharing with Google

Information shared with Google includes:

• Website visitor behavior and conversion events
• Hashed email addresses for customer match advertising