Privacy Policy

3. Information We Collect

To provide you with travel services, we collect only the information necessary for your booking. We collect:

• •Contact Information: Name, email address, phone number, and mailing address.
• •Travel Identification Details: Passport number, date of birth, citizenship, gender, and visa requirements. Note: This is required by airlines, hotels, and government authorities for travel documents.
• •Payment Information: Credit card details or banking information. We do not store payment information long-term. Data is securely passed to our payment processors and immediately destroyed or tokenized after the transaction is complete.
• •Travel Preferences: Special needs (e.g., dietary restrictions, mobility requirements), frequent flyer numbers, and itinerary preferences.
• •Technical Data: IP address, browser type, and website interactions collected via cookies (e.g., Google Analytics) to improve site performance.

4. How We Use Your Information

We use your information for the following purposes:

• •Providing Travel Services: To book flights, accommodations, tours, and related arrangements via our suppliers (e.g., airlines, hotels, global distribution systems like Amadeus or Sabre).
• •Disclosure as Required by TICO: To bring to your attention any conditions related to your purchase (e.g., health or travel warnings) that may affect your decision to travel, as required by Ontario Regulation 26/05.
• •Customer Support: To respond to your questions and requests.
• •Legal Compliance: To maintain records for audit and regulatory purposes, including retaining booking records as required by law.

5. Consent and Marketing Communications

• •Opt-In: You will only receive promotional emails, newsletters, or SMS messages if you have explicitly opted in.
• •Withdrawal: You may withdraw consent at any time:

• • Email: Click the "unsubscribe" link in any email.

  • SMS: Reply "STOP" to any text message.

  • Direct Contact: Email our office at privacy@sunspotsholidays.com with your request.

6. Sharing and Disclosure of Information

We do not sell or rent your personal information to anyone. However, to fulfill your travel arrangements, we must share your information with essential third parties, including:

• •Travel Suppliers: Airlines, hotels, tour operators, car rental agencies, and insurance providers.
• •Booking Platforms: Global distribution systems (e.g., Amadeus, Sabre) used to process your reservations.
• •Government Authorities: When required for visa processing or border entry (e.g., immigration authorities at your destination).
• •Regulatory Bodies: We may disclose information to comply with TICO regulations or a court order.

All partners are contractually obligated to protect your data and may only use it for the purposes of providing your travel services.

7. International Data Transfers

Given the global nature of travel, your information may be transferred to countries outside of Canada (including the United States and the destination country you are visiting). While these countries may have different data protection laws, we use contractual safeguards (such as standard contractual clauses) to ensure your information remains protected.

8. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes for which it was collected.

• •Client Files: Retained for a period of seven years after your last booking to meet legal and tax requirements.
• •Marketing Information: Retained until you withdraw consent.
• •After the retention period, data is securely deleted or anonymized.

9. Security Measures

We implement physical, organizational, and technical security measures to protect your data, including:

• •SSL/TLS encryption for all website traffic.
• •Limited employee access on a need-to-know basis from our office at 150 Ferrand Drive, Suite 511.
• •Secure, encrypted transmission to payment processors.

10. Data Breach Procedures

In the event of a breach of security safeguards involving your personal information that poses a real risk of significant harm, we will notify affected individuals and report the breach to the Office of the Privacy Commissioner of Canada, as required under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). We maintain internal procedures for identifying, documenting, and managing any such incidents.

11. Your Rights

Under PIPEDA, you have the right to:

• •Access your personal information.
• •Correct any inaccuracies in your data.
• •Withdraw your consent for marketing at any time.
• •Request Deletion of your information, subject to legal or contractual restrictions.

12. Cookies and Website Tracking

Our website uses cookies to enhance user experience and analyze traffic. You may disable cookies through your browser settings, though this may affect website functionality.

13. Changes to This Policy

We may update this policy to reflect changes in legal or operational practices. The "Last Updated" date at the top of this page indicates when changes were published.