Privacy Policy

Last updated: October 1, 2026

This policy explains how [Company legal name] Inc. ("we", "us" or "our"), the operator of the TourOrganization.com website and mobile app (together, the "Platform"), collects, uses, shares and protects your personal information. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If you are in the European Economic Area (EEA) or the United Kingdom, we are the controller of your personal data and you also have the rights described in section 12.

1. Information we collect

Account information: your name or company name, email address, phone number, city or region, profile photo, "about" text, and your role (attendee, organizer or supplier). If you sign up or sign in with Google, we receive your name, email address and Google account identifier from Google.
Listings and activity: the listings, photos and prices you publish; the bookings, quote requests, group requests, quotes, messages and reviews you create.
Quick quotes without an account: your name, phone number, email address and the text of your request, and the private link that lets you return to your request.
Technical information: IP address, browser and device information, cookies (see section 8), pages visited and timestamps; in the mobile app, a device identifier and a push notification token.

2. How we use your information

To create and manage your account, keep you signed in and verify your identity.
To publish listings, forward requests to the relevant organizers and suppliers, and run the booking and quote processes.
To send you notifications about bookings, quotes, approvals and messages by email, on-site notification and push notification.
To detect fake accounts, spam requests and inappropriate content, and to investigate security incidents.
To produce aggregate, anonymous usage statistics so we can improve the Platform.
To comply with our legal obligations and to protect our rights in disputes.

We do not use your personal information for other purposes without telling you and, where required, asking for your consent.

3. Your consent

By creating an account or sending a request, you consent to us collecting, using and sharing your personal information as described in this policy. You can withdraw your consent at any time, subject to legal or contractual restrictions, by contacting us at info@tourorganization.com. If you withdraw consent, we may no longer be able to provide some or all of the Platform's services to you.

4. Commercial emails

Most emails we send are about your account and your activity on the Platform, such as booking, quote and message notifications. We will send you commercial electronic messages (for example, promotions or newsletters) only with your consent, as required by Canada's Anti-Spam Legislation (CASL), and each such message will identify us and include a way to unsubscribe. You can also manage your notification preferences in your account and in the app settings.

5. Legal bases for EEA and UK users

If you are in the EEA or the UK, we rely on the following legal bases under the GDPR and UK GDPR:

Performance of a contract: to provide your account, publish listings, and handle bookings, quotes, requests and messages.
Legitimate interests: to keep the Platform secure, prevent fraud and abuse, and improve the service, where those interests are not overridden by your rights.
Legal obligation: where we must process data to comply with the law.
Consent: for optional processing such as optional notifications or commercial emails. You can withdraw consent at any time.

6. Who we share information with

Other users: organizer and supplier profiles and listings are public. When you book a listing or send a quote request or group request, your name and contact details are shown only to the approved organizers and suppliers who can respond to it. Quick quote requests are visible to approved organizers and suppliers in the relevant category. Organizers and suppliers are independent and handle the information they receive under their own responsibility.
Service providers: companies that process information on our behalf and only as needed to provide their service, such as website hosting, email delivery, Google sign-in, push notifications (Google Firebase Cloud Messaging) and bot protection on our forms (Cloudflare Turnstile, where enabled).
Legal requirements: public authorities, where we are required or permitted by law to disclose information, for example in response to a lawful request.

We do not sell or rent your personal information to third parties for advertising.

7. International transfers

We and our service providers may store and process your personal information in Canada and in other countries. Those countries may have different data protection laws, and your information may be accessible to their courts and authorities. Where we transfer personal data from the EEA or the UK to a country that does not have an adequacy decision, we use safeguards recognized by applicable law, such as standard contractual clauses.

8. Cookies and similar technologies

We use a strictly necessary session cookie to keep you signed in and to perform security checks; you cannot sign in without it. We also store some of your preferences, such as your language choice, in cookies or your browser's local storage. We do not use tracking or advertising cookies. If we add analytics tools in the future, we will update this page and ask for your consent where required.

9. How long we keep information

Account information is kept while your account is open. When your account is closed, it is deleted or anonymized within a reasonable period, except where we must keep it longer by law.
Booking, quote and message records are kept for the applicable limitation periods, because they may be needed as evidence in disputes between the parties.
Quick quote requests are kept for a limited period after they are closed, for statistics and abuse analysis.
Server access logs are kept for security purposes for no more than 12 months.

10. How we protect information

Passwords are stored in irreversible form (bcrypt). Connections are encrypted with HTTPS. Access to the administration area is restricted by roles and permission levels, and sign-in attempts are rate-limited. No system is completely secure, so we recommend using a strong, unique password for your account.

11. Children

The Platform is not intended for people under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

12. Your rights

All users. You can ask for access to the personal information we hold about you, ask us to correct it if it is inaccurate or incomplete, and withdraw your consent as described in section 3. Many details can be updated directly on the My Profile page of your account.

Users in the EEA or the UK. You also have the right to:

access your personal data and receive a copy of it;
have inaccurate data rectified;
have your data erased;
restrict our processing of your data;
receive your data in a portable format (data portability);
object to processing based on our legitimate interests;
withdraw consent at any time, without affecting processing carried out before you withdrew it;
lodge a complaint with the data protection authority where you live or work, or where you believe an infringement occurred.

To make a request, write to us at info@tourorganization.com. We may need to verify your identity before responding. We respond within 30 days, or within any other time limit required by applicable law.

13. Contact us and complaints

Our privacy officer can be reached at info@tourorganization.com or by mail at [Company legal name] Inc., [Registered address].

If you are not satisfied with how we handled your personal information or your request, you can complain to the Office of the Privacy Commissioner of Canada. Users in the EEA or the UK can also complain to their local data protection authority.

14. Changes to this policy

We update this policy when necessary. The current version is always available on this page, and the "Last updated" date shows when it was last changed.