PRIVACY POLICY
Effective date: August 21, 2026
Last updated: August 24, 2026
Your privacy is important to me, as is being clear about how your personal information is collected, used and disclosed, and the choices available to you.
This Privacy Policy explains how Zoë Alexandria Galanis (“Zoë Alexandria,” “I,” “me” or “my”) collects, uses, discloses, retains and safeguards personal information in connection with zoealexandriatravel.com (the “Website”), related forms and communications, and the travel-advisory services I provide.
This Policy describes the personal information I collect, why I use it, when it may be disclosed, how long it may be retained and the rights and choices available to you.
CONTENTS
1. ABOUT THIS PRIVACY POLICY
This Policy applies to personal information under my control that is collected through:
Some of these interactions take place through third-party platforms rather than directly through the Website. Where a third-party provider collects or processes personal information on my behalf or makes that information available to me, both this Policy and the provider’s own privacy policy may apply to the respective ways in which the information is handled.
I operate as an independent travel advisor affiliated with Fora Travel, Inc. (“Fora”), which serves as my host agency. My host agency may be involved in bookings, supplier relationships, payment authorizations, commissions and other aspects of the travel services I arrange. Depending on the circumstances, my host agency and other third parties may process personal information under their own privacy policies and legal obligations.
This Policy applies only to personal information under my control. It does not replace the privacy policies of my host agency, travel suppliers or other independent third parties.
2. SCOPE AND THIRD-PARTY SERVICES
The Website may contain links to or incorporate forms, portals, scheduling tools, payment services, newsletter forms, social-media features or other services operated by third parties.
When you follow a link to or interact with a third-party service, that provider may collect information directly from you. The information may also be made available to me where necessary to respond to your inquiry or provide the requested service.
Third-party services operate under their own privacy policies and terms. I encourage you to review the privacy information presented by the relevant provider before submitting personal or sensitive information.
A link to or integration with a third-party service does not mean that I control every aspect of that provider’s information-handling practices.
3. PERSONAL INFORMATION I COLLECT
“Personal information” generally means information about an identifiable individual. Some personal information, such as passport, payment, health and accessibility information is particularly sensitive and requires a higher level of protection.
The categories and examples below are intended to explain the types of personal information I may collect and are not exhaustive. Depending on how you interact with me and the services you request, I may also collect other reasonably necessary personal information to assess, arrange, manage or support your travel. Where required, I will identify the purpose and obtain appropriate consent before collecting or using that information.
3.1 Contact and general inquiry information
This may include:
3.2 Travel inquiry and preference information
This may include your proposed destinations and dates; the number and ages of travellers; anticipated trip investment; accommodation, cruise and transportation preferences; interests and preferred experiences; dining or special-occasion details; previous travel; loyalty-program preferences; and other information relevant to understanding how you want to travel and the support you require.
3.3 Traveller identity and booking information
When you proceed with travel planning or booking, I may collect:
3.4 Sensitive travel information
Travel planning may require information concerning:
3.5 Payment and transaction information
Payment-card and authorization information is collected through a secure form or approved payment system. Please do not send payment-card information through the Website’s general contact form, social media or ordinary email.
Depending on the transaction, I may receive or maintain billing information, payment authorizations, invoices, payment status, booking values, deposits, balances, refunds, cancellations, transaction identifiers, supplier payment records and payment information made available through the secure provider as necessary to arrange or administer your travel.
The secure-form provider, payment provider, host agency or relevant travel supplier may process payment information under its own privacy policy, security standards and legal obligations.
3.6 Group and companion information
If you arrange travel for another person, your family or a private group, I may collect personal information about those travellers from you, a designated group organizer, an executive assistant, a parent, a guardian or another authorized representative.
The person providing the information must have the authority to do so and should direct the affected travellers to this Policy where appropriate.
3.7 Newsletter and marketing information
If you subscribe to my newsletter, I may collect your name and email address; the date, source and wording associated with your consent; your subscription and unsubscribe status; and engagement information made available by the email provider, such as message delivery, opens, clicks or device information.
3.8 Information collected automatically
When you visit the Website, the Website platform and enabled service providers may automatically collect:
4. HOW I COLLECT PERSONAL INFORMATION
I may collect personal information:
I may combine information obtained from different sources where reasonably necessary for the purposes described in this Policy.
5. HOW I USE PERSONAL INFORMATION
I may use personal information to:
I do not use passport, health, accessibility, payment or other sensitive travel information for advertising or unrelated marketing.
6. CONSENT
I obtain consent for the collection, use and disclosure of personal information where required by applicable law. At or before the time information is collected, I will identify the relevant purposes and intended disclosures in a manner that can reasonably be understood.
The appropriate form of consent depends on the sensitivity of the information, the circumstances and what is permitted by law. Consent may be express or implied and may be provided through a form, agreement, written or verbal communication, or another affirmative action. Where permitted, consent may also be inferred when you voluntarily provide information for an identified or reasonably apparent purpose.
You may withdraw your consent to future collection, use or disclosure by contacting me. Withdrawal is subject to reasonable notice and any legal or contractual restrictions and will not affect actions already lawfully taken.
Withdrawing consent may prevent me from providing or continuing a service where the relevant information is reasonably necessary to arrange or manage your travel.
I may collect, use, retain or disclose personal information without consent where permitted or required by law.
7. NEWSLETTERS AND EMAIL MARKETING
If you subscribe to receive travel notes, destination inspiration, news or marketing emails, I will use the contact information you provide to send those communications through an email-marketing provider.
Newsletter subscription is voluntary and separate from submitting a general contact or travel inquiry. Marketing emails will identify the sender, include the required contact information and provide a working unsubscribe mechanism. You may unsubscribe at any time by using the link in the message or contacting me.
Unsubscribe requests will be processed within the period required by applicable law. I may retain limited suppression information to ensure that your request continues to be honoured.
Unsubscribing from marketing does not prevent service, booking, security, legal or transactional messages required for an existing inquiry, booking or client relationship.
8. COOKIES, ANALYTICS AND EMBEDDED SERVICES
The Website and embedded services may use cookies, pixels, tags, scripts, local storage and similar technologies. These technologies may be set by the Website or by third parties whose services are integrated with it.
Depending on the Website’s final configuration, these technologies may include:
Where required, non-essential technologies will not be activated until you make a choice through the available cookie banner or preference controls.
You may also adjust your browser settings to refuse or delete cookies. Blocking certain technologies may affect Website functionality.
The privacy policy, cookie notice and preference controls should be read together and will be updated to reflect the technologies actually used on the Website.
I do not use sensitive travel information for analytics, behavioural advertising or campaign measurement.
9. WHEN I DISCLOSE PERSONAL INFORMATION
I disclose personal information only where reasonably necessary for an identified purpose, with consent, or as permitted or required by law.
Recipients may include:
I do not sell personal information.
10. THIRD-PARTY SERVICES AND TRAVEL SUPPLIERS
Travel services necessarily involve independent third parties.
When I provide information to a travel supplier or service provider to obtain a quote, make a reservation, process a payment or authorization, communicate a preference, secure an amenity or support your trip, that recipient may process the information for its own operational, security, legal and service-related purposes.
Travel suppliers and other independent parties operate under their own privacy policies and terms. Their information-handling practices may differ from mine, and I do not control their independent use of personal information.
A supplier may communicate directly with you in connection with your inquiry, reservation or service. Any separate marketing by that supplier is governed by its own privacy practices and applicable law.
When reasonably practical, I limit disclosure to the information necessary for the relevant request, reservation or service.
11. INTERNATIONAL PROCESSING
Travel is international by nature. I and my service providers may process personal information in Canada, the United States and other countries. Travel suppliers may also process information in the countries where the requested services are located.
Personal information processed outside your province or country may be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement bodies or government authorities in accordance with local law.
Where personal information under my control is transferred to a service provider for processing, I remain accountable as required by applicable Canadian privacy law and use contractual or other measures appropriate to the information and circumstances.
International visitors
Individuals outside Canada may have additional privacy rights under the laws of their jurisdiction. Where an applicable law grants you rights beyond those described in this Policy, I will respect those rights to the extent required.
Depending on the applicable law, those rights may include access, correction, deletion, restriction, objection, portability, withdrawal of consent and the ability to complain to a privacy or data-protection authority.
The availability of the Website in another country does not, by itself, mean that every foreign privacy law applies to my activities or that I am established in that jurisdiction.
12. HOW I SAFEGUARD PERSONAL INFORMATION
I use administrative, technical and physical safeguards intended to protect personal information against loss, theft, unauthorized access, disclosure, copying, use or modification.
Depending on the sensitivity, amount, format and location of the information, safeguards may include secure third-party platforms and payment forms, access controls, password and authentication practices, multi-factor authentication where available, encryption in transit, device security, vendor oversight, secure disposal and procedures for responding to privacy and security incidents.
Sensitive travel and payment information should be submitted only through the secure method I designate. It should not be sent through the general contact form, newsletter form, social-media messages or ordinary email.
No Internet transmission or storage system is completely secure. Although I take reasonable steps to safeguard personal information, I cannot guarantee absolute security.
13. DATA RETENTION
I retain personal information only for as long as reasonably necessary to fulfil the purposes described in this Policy, maintain an ongoing client relationship and satisfy legal, regulatory, tax, accounting, insurance, supplier, contractual and dispute-resolution requirements.
The applicable retention period depends on the nature and sensitivity of the information, the purpose for which it was collected, whether the client relationship remains active and whether the information is reasonably required for future travel. I may also consider applicable legal, tax, accounting, insurance, supplier and host-agency requirements; any complaint, dispute, chargeback or legal claim; and the deletion capabilities and backup cycles of relevant service providers.
General inquiries that do not result in a client relationship may be retained for a reasonable period to respond, maintain business records and manage future correspondence.
Client, booking, agreement, invoice and service records may be retained after travel for legal, accounting, insurance, supplier, relationship-management and recordkeeping purposes.
Traveller profiles may be retained while a client relationship remains active and for a reasonable period afterward to support future travel. Passport, identification, health, accessibility and similar sensitive information will be retained only while reasonably necessary for travel-related purposes, with appropriate consent where required, and will be reviewed periodically.
Newsletter information may be retained while you remain subscribed. Limited consent and suppression records may be kept after you unsubscribe to demonstrate compliance and ensure that further marketing is not sent.
When personal information is no longer reasonably required, I will take reasonable steps to delete, destroy or de-identify it. Residual copies may remain temporarily in backups or provider systems until overwritten or deleted through their normal cycles.
14. CHILDREN AND MINORS
The Website and my services are not directed to children under 18. A minor should not submit a Website inquiry or subscribe to marketing communications without the involvement of a parent or legal guardian.
Travel planning for families and groups may require information about minors, including names, dates of birth, passport details, rooming arrangements, dietary needs and accessibility information.
Information about a minor must be provided by - or with the authority of - a parent, guardian or another person legally authorized to act for the minor. It will be used only for appropriate travel-related purposes.
15. YOUR PRIVACY RIGHTS
Depending on the law that applies and subject to lawful exceptions, you may have the right to:
To make a request, contact me using the information below. I may need to verify your identity and clarify the scope of the request before responding.
I will respond within the period required by applicable law. Under PIPEDA, access requests are generally answered within 30 calendar days, subject to permitted extensions.
Certain legal exceptions may limit the information I can provide. For example, access may be restricted where disclosure would reveal another person’s information, violate legal privilege or law, compromise an investigation or create a safety risk. If I refuse all or part of a request, I will explain the reason where required.
16. SECURITY INCIDENTS AND DATA BREACHES
If I become aware of a suspected loss of, unauthorized access to or unauthorized disclosure of personal information under my control, I will take reasonable steps to contain and investigate the incident, identify the information and individuals affected, assess the risk of harm, address identified vulnerabilities and work with relevant service providers, professional advisers, my host agency and travel partners where appropriate. I will maintain records and notify affected individuals and the appropriate authorities where required by applicable law.
Where PIPEDA applies, I will report a breach to the Office of the Privacy Commissioner of Canada and notify affected individuals where the breach creates a real risk of significant harm.
17. CHANGES TO THIS POLICY
I may update this Policy to reflect changes in the Website, services, providers, technology, legal requirements or business practices.
The “Last updated” date at the beginning of the Policy will identify the current version. Material changes will be highlighted or communicated in another appropriate manner where required.
Where required by law, I will obtain additional consent before using or disclosing personal information for a materially new purpose.
18. CONTACT AND PRIVACY COMPLAINTS
I am responsible for personal information under my control and for overseeing compliance with this Policy.
Questions, access or correction requests, consent withdrawals and privacy complaints may be directed to:
Please include “Privacy Request” in the subject line and describe your request clearly. I may ask for information reasonably necessary to verify your identity.
If you are not satisfied with my response, you may contact the Office of the Privacy Commissioner of Canada or another privacy authority with jurisdiction over the matter.
Effective date: August 21, 2026
Last updated: August 24, 2026
Your privacy is important to me, as is being clear about how your personal information is collected, used and disclosed, and the choices available to you.
This Privacy Policy explains how Zoë Alexandria Galanis (“Zoë Alexandria,” “I,” “me” or “my”) collects, uses, discloses, retains and safeguards personal information in connection with zoealexandriatravel.com (the “Website”), related forms and communications, and the travel-advisory services I provide.
This Policy describes the personal information I collect, why I use it, when it may be disclosed, how long it may be retained and the rights and choices available to you.
CONTENTS
- About This Privacy Policy
- Scope and Third-Party Services
- Personal Information I Collect
- How I Collect Personal Information
- How I Use Personal Information
- Consent
- Newsletters and Email Marketing
- Cookies, Analytics and Embedded Services
- When I Disclose Personal Information
- Third-Party Services and Travel Suppliers
- International Processing
- How I Safeguard Personal Information
- Data Retention
- Children and Minors
- Your Privacy Rights
- Security Incidents and Data Breaches
- Changes to This Policy
- Contact and Privacy Complaints
This Policy applies to personal information under my control that is collected through:
- The Website;
- Website contact forms;
- Travel inquiry forms;
- Newsletter subscription forms;
- Email and other direct communications;
- Discovery calls and client conversations;
- Client profiles, planning agreements and booking processes;
- Secure payment and authorization forms;
- Travel-planning, itinerary and client-management platforms; and
- Other services or interactions that refer to this Policy.
I operate as an independent travel advisor affiliated with Fora Travel, Inc. (“Fora”), which serves as my host agency. My host agency may be involved in bookings, supplier relationships, payment authorizations, commissions and other aspects of the travel services I arrange. Depending on the circumstances, my host agency and other third parties may process personal information under their own privacy policies and legal obligations.
This Policy applies only to personal information under my control. It does not replace the privacy policies of my host agency, travel suppliers or other independent third parties.
2. SCOPE AND THIRD-PARTY SERVICES
The Website may contain links to or incorporate forms, portals, scheduling tools, payment services, newsletter forms, social-media features or other services operated by third parties.
When you follow a link to or interact with a third-party service, that provider may collect information directly from you. The information may also be made available to me where necessary to respond to your inquiry or provide the requested service.
Third-party services operate under their own privacy policies and terms. I encourage you to review the privacy information presented by the relevant provider before submitting personal or sensitive information.
A link to or integration with a third-party service does not mean that I control every aspect of that provider’s information-handling practices.
3. PERSONAL INFORMATION I COLLECT
“Personal information” generally means information about an identifiable individual. Some personal information, such as passport, payment, health and accessibility information is particularly sensitive and requires a higher level of protection.
The categories and examples below are intended to explain the types of personal information I may collect and are not exhaustive. Depending on how you interact with me and the services you request, I may also collect other reasonably necessary personal information to assess, arrange, manage or support your travel. Where required, I will identify the purpose and obtain appropriate consent before collecting or using that information.
3.1 Contact and general inquiry information
This may include:
- Your name;
- Email address;
- Telephone number;
- Mailing address, where required;
- The subject and contents of your message;
- Your preferred method of communication; and
- Information you voluntarily provide in a question, feedback response, testimonial request or other communication.
3.2 Travel inquiry and preference information
This may include your proposed destinations and dates; the number and ages of travellers; anticipated trip investment; accommodation, cruise and transportation preferences; interests and preferred experiences; dining or special-occasion details; previous travel; loyalty-program preferences; and other information relevant to understanding how you want to travel and the support you require.
3.3 Traveller identity and booking information
When you proceed with travel planning or booking, I may collect:
- Identity and contact information, including your full legal name, date of birth, age, telephone number, email address, residential or mailing address, citizenship, country of residence and gender marker where required by a supplier;
- Travel-document and entry information, including passport or other government-issued travel-document details, issuing country, expiry date, visa information and relevant entry requirements;
- Traveller identification and membership information, including Known Traveller Numbers, redress numbers and airline, hotel, cruise or other loyalty-program numbers; and
- Booking and service records, including emergency contacts, confirmations, approvals, authorizations, itinerary information and related communications.
Travel planning may require information concerning:
- Health or medical considerations, allergies or pregnancy-related travel restrictions;
- Dietary or religious requirements;
- Mobility, accessibility or assistance needs;
- Service animals; and
- Other accommodations or special requests necessary to arrange or support your travel.
3.5 Payment and transaction information
Payment-card and authorization information is collected through a secure form or approved payment system. Please do not send payment-card information through the Website’s general contact form, social media or ordinary email.
Depending on the transaction, I may receive or maintain billing information, payment authorizations, invoices, payment status, booking values, deposits, balances, refunds, cancellations, transaction identifiers, supplier payment records and payment information made available through the secure provider as necessary to arrange or administer your travel.
The secure-form provider, payment provider, host agency or relevant travel supplier may process payment information under its own privacy policy, security standards and legal obligations.
3.6 Group and companion information
If you arrange travel for another person, your family or a private group, I may collect personal information about those travellers from you, a designated group organizer, an executive assistant, a parent, a guardian or another authorized representative.
The person providing the information must have the authority to do so and should direct the affected travellers to this Policy where appropriate.
3.7 Newsletter and marketing information
If you subscribe to my newsletter, I may collect your name and email address; the date, source and wording associated with your consent; your subscription and unsubscribe status; and engagement information made available by the email provider, such as message delivery, opens, clicks or device information.
3.8 Information collected automatically
When you visit the Website, the Website platform and enabled service providers may automatically collect:
- Device and network information, including your Internet Protocol address, browser, device type, operating system, language and approximate location derived from your IP address;
- Website usage information, including pages viewed, referring and exit pages, links clicked, visit dates and times, session duration and interactions with Website features; and
- Cookie, security and diagnostic information, including cookie or similar identifiers, consent preferences, security logs, error reports and diagnostic data.
I may collect personal information:
- Directly from you, including through forms, calls, emails, agreements, secure payment processes and other communications;
- Through third-party platforms, such as linked inquiry, client-management, itinerary, scheduling, newsletter, invoice and payment services;
- From authorized representatives, such as a spouse or partner, executive assistant, parent, guardian, group organizer or lead traveller;
- From travel companions, where information is required for a shared booking or itinerary;
- From travel suppliers, including booking confirmations, changes, cancellations, refunds, service information and other records associated with your trip; and
- Automatically, through the Website platform, server logs, cookies, analytics tools and similar technologies.
5. HOW I USE PERSONAL INFORMATION
I may use personal information to:
- Operate the Website and respond to inquiries, including maintaining and securing the Website, responding to messages and travel inquiries, assessing whether my services are suitable for a proposed trip and conducting discovery calls;
- Plan and arrange travel, including understanding your preferences and priorities; researching, designing, quoting and coordinating travel; recommending accommodations, cruises, transportation, experiences and other services; and obtaining preferred amenities or benefits where available;
- Book and manage travel services, including making reservations, communicating proposals and confirmations, maintaining itinerary information, managing changes and reminders, and communicating traveller preferences, accessibility needs and special requests to relevant parties;
- Administer my services and client relationships, including managing planning agreements, service fees, payment records, refunds, accounting, client communications and traveller profiles for future service;
- Protect my business and comply with my obligations, including providing customer service, responding to concerns, preventing fraud or misuse, managing security incidents, satisfying legal, regulatory, tax, accounting, insurance and contractual requirements, and establishing, exercising or defending legal claims;
- Send and improve communications, including sending newsletters or marketing communications where I have consent or another lawful basis, understanding Website and newsletter performance, measuring engagement and improving my services and communications; and
- Fulfil another purpose identified at or before collection, or a purpose for which additional consent is obtained where required.
6. CONSENT
I obtain consent for the collection, use and disclosure of personal information where required by applicable law. At or before the time information is collected, I will identify the relevant purposes and intended disclosures in a manner that can reasonably be understood.
The appropriate form of consent depends on the sensitivity of the information, the circumstances and what is permitted by law. Consent may be express or implied and may be provided through a form, agreement, written or verbal communication, or another affirmative action. Where permitted, consent may also be inferred when you voluntarily provide information for an identified or reasonably apparent purpose.
You may withdraw your consent to future collection, use or disclosure by contacting me. Withdrawal is subject to reasonable notice and any legal or contractual restrictions and will not affect actions already lawfully taken.
Withdrawing consent may prevent me from providing or continuing a service where the relevant information is reasonably necessary to arrange or manage your travel.
I may collect, use, retain or disclose personal information without consent where permitted or required by law.
7. NEWSLETTERS AND EMAIL MARKETING
If you subscribe to receive travel notes, destination inspiration, news or marketing emails, I will use the contact information you provide to send those communications through an email-marketing provider.
Newsletter subscription is voluntary and separate from submitting a general contact or travel inquiry. Marketing emails will identify the sender, include the required contact information and provide a working unsubscribe mechanism. You may unsubscribe at any time by using the link in the message or contacting me.
Unsubscribe requests will be processed within the period required by applicable law. I may retain limited suppression information to ensure that your request continues to be honoured.
Unsubscribing from marketing does not prevent service, booking, security, legal or transactional messages required for an existing inquiry, booking or client relationship.
8. COOKIES, ANALYTICS AND EMBEDDED SERVICES
The Website and embedded services may use cookies, pixels, tags, scripts, local storage and similar technologies. These technologies may be set by the Website or by third parties whose services are integrated with it.
Depending on the Website’s final configuration, these technologies may include:
- Strictly necessary technologies, which support security, form delivery, network management, consent preferences and essential Website functions;
- Functional technologies, which remember choices or provide enhanced features;
- Analytics technologies, which help measure visits, traffic sources and Website interactions; and
- Advertising or social-media technologies, if enabled, which may measure campaigns, support embedded social features or assist with interest-based advertising.
You may also adjust your browser settings to refuse or delete cookies. Blocking certain technologies may affect Website functionality.
The privacy policy, cookie notice and preference controls should be read together and will be updated to reflect the technologies actually used on the Website.
I do not use sensitive travel information for analytics, behavioural advertising or campaign measurement.
9. WHEN I DISCLOSE PERSONAL INFORMATION
I disclose personal information only where reasonably necessary for an identified purpose, with consent, or as permitted or required by law.
Recipients may include:
- My host agency, including Fora Travel Inc., where necessary to administer bookings, supplier relationships, payment authorizations, commissions, support or related travel functions;
- Travel suppliers and destination partners, including hotels, resorts, cruise lines, airlines, rail operators, tour operators, destination management companies, transfer providers, car-rental companies, restaurants and insurance providers;
- Technology and business-service providers, including providers supporting forms, client management, itineraries, website hosting, email, cloud storage, scheduling, accounting, invoicing, payment processing, analytics, cybersecurity and business administration;
- People involved in your trip, including an authorized assistant, lead traveller, parent, guardian, emergency contact or designated group organizer;
- Professional advisers, including legal counsel, accountants, auditors, insurers and other professional service providers;
- Courts, regulators, law-enforcement bodies and government authorities, where disclosure is required or permitted by law; and
- Parties involved in a business transaction, such as a prospective purchaser, successor or adviser involved in a restructuring, financing, sale or transfer of all or part of the business, subject to appropriate legal and confidentiality safeguards.
10. THIRD-PARTY SERVICES AND TRAVEL SUPPLIERS
Travel services necessarily involve independent third parties.
When I provide information to a travel supplier or service provider to obtain a quote, make a reservation, process a payment or authorization, communicate a preference, secure an amenity or support your trip, that recipient may process the information for its own operational, security, legal and service-related purposes.
Travel suppliers and other independent parties operate under their own privacy policies and terms. Their information-handling practices may differ from mine, and I do not control their independent use of personal information.
A supplier may communicate directly with you in connection with your inquiry, reservation or service. Any separate marketing by that supplier is governed by its own privacy practices and applicable law.
When reasonably practical, I limit disclosure to the information necessary for the relevant request, reservation or service.
11. INTERNATIONAL PROCESSING
Travel is international by nature. I and my service providers may process personal information in Canada, the United States and other countries. Travel suppliers may also process information in the countries where the requested services are located.
Personal information processed outside your province or country may be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement bodies or government authorities in accordance with local law.
Where personal information under my control is transferred to a service provider for processing, I remain accountable as required by applicable Canadian privacy law and use contractual or other measures appropriate to the information and circumstances.
International visitors
Individuals outside Canada may have additional privacy rights under the laws of their jurisdiction. Where an applicable law grants you rights beyond those described in this Policy, I will respect those rights to the extent required.
Depending on the applicable law, those rights may include access, correction, deletion, restriction, objection, portability, withdrawal of consent and the ability to complain to a privacy or data-protection authority.
The availability of the Website in another country does not, by itself, mean that every foreign privacy law applies to my activities or that I am established in that jurisdiction.
12. HOW I SAFEGUARD PERSONAL INFORMATION
I use administrative, technical and physical safeguards intended to protect personal information against loss, theft, unauthorized access, disclosure, copying, use or modification.
Depending on the sensitivity, amount, format and location of the information, safeguards may include secure third-party platforms and payment forms, access controls, password and authentication practices, multi-factor authentication where available, encryption in transit, device security, vendor oversight, secure disposal and procedures for responding to privacy and security incidents.
Sensitive travel and payment information should be submitted only through the secure method I designate. It should not be sent through the general contact form, newsletter form, social-media messages or ordinary email.
No Internet transmission or storage system is completely secure. Although I take reasonable steps to safeguard personal information, I cannot guarantee absolute security.
13. DATA RETENTION
I retain personal information only for as long as reasonably necessary to fulfil the purposes described in this Policy, maintain an ongoing client relationship and satisfy legal, regulatory, tax, accounting, insurance, supplier, contractual and dispute-resolution requirements.
The applicable retention period depends on the nature and sensitivity of the information, the purpose for which it was collected, whether the client relationship remains active and whether the information is reasonably required for future travel. I may also consider applicable legal, tax, accounting, insurance, supplier and host-agency requirements; any complaint, dispute, chargeback or legal claim; and the deletion capabilities and backup cycles of relevant service providers.
General inquiries that do not result in a client relationship may be retained for a reasonable period to respond, maintain business records and manage future correspondence.
Client, booking, agreement, invoice and service records may be retained after travel for legal, accounting, insurance, supplier, relationship-management and recordkeeping purposes.
Traveller profiles may be retained while a client relationship remains active and for a reasonable period afterward to support future travel. Passport, identification, health, accessibility and similar sensitive information will be retained only while reasonably necessary for travel-related purposes, with appropriate consent where required, and will be reviewed periodically.
Newsletter information may be retained while you remain subscribed. Limited consent and suppression records may be kept after you unsubscribe to demonstrate compliance and ensure that further marketing is not sent.
When personal information is no longer reasonably required, I will take reasonable steps to delete, destroy or de-identify it. Residual copies may remain temporarily in backups or provider systems until overwritten or deleted through their normal cycles.
14. CHILDREN AND MINORS
The Website and my services are not directed to children under 18. A minor should not submit a Website inquiry or subscribe to marketing communications without the involvement of a parent or legal guardian.
Travel planning for families and groups may require information about minors, including names, dates of birth, passport details, rooming arrangements, dietary needs and accessibility information.
Information about a minor must be provided by - or with the authority of - a parent, guardian or another person legally authorized to act for the minor. It will be used only for appropriate travel-related purposes.
15. YOUR PRIVACY RIGHTS
Depending on the law that applies and subject to lawful exceptions, you may have the right to:
- Request confirmation of whether I hold personal information about you;
- Request access to your personal information;
- Request correction of inaccurate or incomplete information;
- Withdraw consent to future collection, use or disclosure;
- Request deletion or de-identification where applicable;
- Ask how your personal information has been used and to whom it has been disclosed;
- Change your cookie preferences through available Website controls;
- Unsubscribe from marketing communications; and
- Raise a concern or challenge my compliance with this Policy.
I will respond within the period required by applicable law. Under PIPEDA, access requests are generally answered within 30 calendar days, subject to permitted extensions.
Certain legal exceptions may limit the information I can provide. For example, access may be restricted where disclosure would reveal another person’s information, violate legal privilege or law, compromise an investigation or create a safety risk. If I refuse all or part of a request, I will explain the reason where required.
16. SECURITY INCIDENTS AND DATA BREACHES
If I become aware of a suspected loss of, unauthorized access to or unauthorized disclosure of personal information under my control, I will take reasonable steps to contain and investigate the incident, identify the information and individuals affected, assess the risk of harm, address identified vulnerabilities and work with relevant service providers, professional advisers, my host agency and travel partners where appropriate. I will maintain records and notify affected individuals and the appropriate authorities where required by applicable law.
Where PIPEDA applies, I will report a breach to the Office of the Privacy Commissioner of Canada and notify affected individuals where the breach creates a real risk of significant harm.
17. CHANGES TO THIS POLICY
I may update this Policy to reflect changes in the Website, services, providers, technology, legal requirements or business practices.
The “Last updated” date at the beginning of the Policy will identify the current version. Material changes will be highlighted or communicated in another appropriate manner where required.
Where required by law, I will obtain additional consent before using or disclosing personal information for a materially new purpose.
18. CONTACT AND PRIVACY COMPLAINTS
I am responsible for personal information under my control and for overseeing compliance with this Policy.
Questions, access or correction requests, consent withdrawals and privacy complaints may be directed to:
- Privacy contact: Zoë Alexandria Galanis
- Email: [email protected]
- Website: zoealexandriatravel.com
Please include “Privacy Request” in the subject line and describe your request clearly. I may ask for information reasonably necessary to verify your identity.
If you are not satisfied with my response, you may contact the Office of the Privacy Commissioner of Canada or another privacy authority with jurisdiction over the matter.
