Privacy Policy

Data Security

​

The security of your personal information is a top priority for Go Epic Tours. We employ a variety of safeguards to protect your data against unauthorized access, disclosure, alteration, or destruction. We are continuously improving our security measures in line with technological advancements and best practices. Here are key aspects of our data security program:

• Secure Infrastructure: Our website is hosted on a secure platform (Wix), which provides built-in security features such as firewalls, intrusion prevention, and regular monitoring for vulnerabilities. The website operates under the HTTPS protocol, meaning any data you submit through our site (like contact forms or booking information) is encrypted in transit using SSL/TLS encryption. This helps prevent eavesdropping by third parties when you send information over the internet. You can verify this by looking for “https://” and a lock icon in your browser’s address bar when interacting with our site.

• Encryption: We use encryption technologies to protect sensitive data. For example, if we receive payment information, it is transmitted and processed via encrypted channels. Stored payment details (like if we retain the last four digits of your credit card for reference) are kept in an encrypted form. Any personal data stored in our databases is protected by encryption at rest where appropriate, especially for particularly sensitive fields.

• Access Controls: Access to personal information within our organization is strictly limited. Only employees or contractors who need access to your information to perform their job have permission to view it. For instance, our travel consultants will have access to your itinerary details, our finance team will have access to payment records, but a staff member who doesn’t require certain information won’t be able to see it. We use user accounts, strong passwords, and role-based access controls on our systems so that each person only has the minimum access level necessary. We also enforce best practices like two-factor authentication for accessing sensitive systems (adding an extra verification step for authorized users).

• Employee Training and Policies: All members of the Go Epic Tours team are educated on our privacy and security policies. We emphasize the importance of confidentiality and data protection. Employees are required to adhere to our internal privacy guidelines and sign confidentiality agreements as part of their employment terms. We train our staff to recognize social engineering attempts (like phishing emails) that could compromise security, and we maintain protocols for verifying identity before disclosing sensitive info over the phone or email (to ensure we only share data with the rightful person).

• Third-Party Service Provider Security: When we engage third-party vendors to assist in our operations (such as payment processors, IT providers, or marketing platforms), we vet their security practices. We choose established companies known for robust security (e.g., Wix, which powers our site, adheres to high security standards; our payment processors are PCI-compliant). We also have agreements in place that require these providers to protect your information to standards equivalent to our own and to notify us in case of any data breach involving our data. We monitor their compliance and only continue relationships with those who meet our security expectations.

• Physical Security: Although most of our data is digital, any physical documents containing personal information (for example, a printed copy of a reservation or signed forms for a trip) are stored in a secure manner. Our office space is access-controlled (only authorized personnel can enter). Sensitive documents are kept in locked cabinets or rooms when not in use. We minimize printing personal data; we try to handle things electronically whenever possible for better security. When physical documents are no longer needed, we shred or securely dispose of them.

• Data Backups and Recovery: We perform regular backups of critical data to ensure we can recover information in case of accidental deletion, system failure, or other issues. These backups are encrypted and stored securely (often off-site or in the cloud) to provide redundancy. In the event of a hardware issue or disaster, we have a plan in place to restore data from backups and resume operations with minimal disruption.

• Monitoring and Testing: We utilize security software and monitoring tools to keep an eye on our systems. This includes antivirus and anti-malware programs on our workstations, security monitoring on our servers, and alert systems for unusual activity. We also periodically test our systems and website for vulnerabilities (through scans or audits) and promptly address any issues found. Our software and platforms are kept updated with the latest security patches to guard against known threats.

• Payment Security: Any online payments are processed through secure, accredited payment gateways. We do not ask you to send credit card information via insecure channels (like plain email). If you prefer to provide payment over the phone, we handle it discreetly and do not record sensitive card details in call recordings or written notes. Card data is entered directly into the secure processing system. Our compliance with payment security standards ensures that your financial information is handled with the utmost care.

• Incident Response: Despite all precautions, no system can be guaranteed 100% secure. In the unlikely event of a security breach or suspected breach that affects your personal information, we have an incident response plan. This involves immediate steps to contain the breach, assess the scope, and remediate the vulnerability. We would also promptly notify affected individuals and the relevant privacy authorities (such as the Office of the Privacy Commissioner of Canada, and any provincial regulators if applicable) as required by law. We would communicate to you the nature of the breach, the data involved, and the steps we are taking to mitigate any potential harm. Your safety and trust are paramount, so we would be transparent about such incidents and guide you on any precautions you should take.

In summary, we employ a defense-in-depth strategy: multiple layers of security to protect personal data. While we cannot promise that a breach will never occur, we can assure you that we take all reasonable and industry-standard measures to safeguard your information. We also regularly review and update our security practices to adapt to new threats and ensure ongoing protection.

If you have specific questions about our security measures or if you suspect any compromise of your data in relation to Go Epic Tours, please contact us immediately. We will address your concerns and provide all necessary support.

​

Your Rights and Choices under Canadian Law

​

As a customer or user engaging with Go Epic Tours, you have certain rights regarding your personal information under PIPEDA (Canada’s federal privacy law) and similar provincial laws. We believe in transparency and control, and we want to empower you to manage your personal data. Here is an overview of your key rights and how you can exercise them:

• Right to Access Your Information: You have the right to know whether we hold personal information about you and to request a copy of that information. This is sometimes called an “Access Request.” Subject to some limited exceptions (e.g., if providing the data would reveal personal information about another individual, or if it’s protected by legal privilege), we will provide you with the personal information we have on file about you. This typically includes data like your contact details, booking history with us, and any correspondence. We will also give you information about how the data has been used and which third parties (if any) it has been disclosed to. To request access, you can contact us using the details in the Contact section. We may ask for some verification (to ensure we’re giving the data to the right person) and specifics about what information you need (to expedite the process). We will respond to your access request within a reasonable time, generally within 30 days as required by law. If for some reason we need more time or cannot fulfill part of your request, we will inform you and provide the reasons (for instance, if it involves disproportionate effort, we might need an extension, which is also allowed by law in certain cases). We normally provide this information at no cost. However, if you request additional copies or the request is unusually complex, we may charge a minimal fee to cover costs (but we will give you an estimate and the chance to withdraw the request if you don’t want to incur a fee).

• Right to Correct or Update Your Information: We strive to keep your personal data accurate and up-to-date. If you discover that any information we have about you is incorrect, incomplete, or outdated, you have the right to request a correction. For example, if you’ve moved and your mailing address changed, or if we misspelled your name, or your email in our records is wrong, please let us know. We will promptly update the information in our systems. If a correction can’t be made (e.g., because we have a different information source that we believe is correct, or if it’s an opinion that cannot be proven right or wrong), we will explain the situation and, if required, note the requested correction alongside the data in our records. For significant changes (like a name change), we might ask for supporting documentation just to verify authenticity, but typically your word is sufficient for straightforward corrections. Keeping your information accurate helps us serve you better, so we welcome these requests.

• Right to Withdraw Consent: In situations where we are processing your personal information based on your consent, you have the right to withdraw that consent at any time. For example, if you consented to receive marketing emails, you can withdraw that consent by unsubscribing (as detailed earlier). If you consented to a particular use of data and later change your mind, inform us and we will stop that use. Withdrawing consent will not have retroactive effect (it won’t undo any processing we’ve already done) and it might not affect processing that is not based on consent (for instance, if we are required by law to keep some data, we may do so). Also note that if you withdraw consent for something essential (say, you withdraw consent for us to use your personal details while a tour booking is in progress), we will advise you if that withdrawal means we can no longer provide the service and what the consequences might be (such as needing to cancel the booking to comply with your request). But our general approach is: if you don’t want us to use your data in a certain way, we will respect that and find a way to accommodate your wishes if possible.

• Right to Be Forgotten (Data Deletion): PIPEDA doesn’t explicitly call it “right to be forgotten” as in some other jurisdictions, but it does state we should not keep personal information longer than necessary. You have the right to request that we delete personal information we hold about you, especially if it’s no longer required for the purpose we collected it or if there is no legal obligation to retain it. For example, if you have never actually booked and you want us to erase your inquiry details, or if it’s been many years since you traveled with us and you want your old records removed, you can ask us. We will do our best to erase the information from our active systems and backups (to the extent feasible). Keep in mind, there are exceptions: we might need to keep certain info for legal reasons (like financial records) or legitimate business purposes (like proof of consent if there was a dispute). In such cases, we will isolate that data and not use it for any other purpose, and we’ll let you know why we can’t delete certain pieces. We’ll be transparent about what we can and cannot delete.

• Right to Challenge Compliance / Complain: We take your privacy rights seriously, and if you believe we are not handling your personal information in accordance with this Privacy Policy or our legal obligations, you have the right to challenge our practices. We encourage you to contact us first, and we will work to address your concerns in a fair and timely manner. Our Privacy Officer will investigate the matter and respond to you with the findings or resolution steps. If after contacting us, you feel that your concerns have not been adequately addressed, you have the right to escalate the issue to the Office of the Privacy Commissioner of Canada (OPC), which oversees compliance with PIPEDA. The OPC can be reached through their website (priv.gc.ca) or by phone, and they can investigate the issue further. Similarly, if a relevant provincial privacy law applies (for instance, if you are in Alberta or British Columbia which have their own private sector privacy laws), you can contact the provincial Privacy Commissioner’s office. We will provide you with the appropriate contact information for regulators upon request. Retaliation for raising a privacy concern is against our values and the law – you can feel safe in asserting your rights.

• Right to Refuse Marketing: We’ve already covered this in detail in the marketing section, but to reiterate – you have the right to opt out of receiving marketing communications from us. This is an extension of your consent rights. We make it easy to withdraw consent for marketing (via unsubscribe links or contacting us). CASL (Canada’s Anti-Spam Legislation) also gives you rights regarding electronic communications, and we fully comply with those.

• Right to Anonymity (When Browsing): Whenever it’s feasible, you have the right to interact with us anonymously or using a pseudonym. For example, you can browse our website without providing any personal information. You can call us with general questions without immediately giving your name (though for specific booking discussions, personal details become necessary). We respect that you might just want information and not give away who you are – that’s fine. It’s mostly when you decide to book or when requiring detailed assistance that personal data becomes essential.

• Right to Explanation: You are entitled to ask us about our policies and practices regarding personal information management. We should be able to explain how and why we collect certain information, how it’s used, and how decisions affecting you are made. If anything in this Privacy Policy is unclear, please ask us for clarification. If you want to understand our data handling in a particular process (say, “what happens to my information when I fill out the custom trip planning form?”), we will explain it. This goes hand-in-hand with “openness,” one of the PIPEDA principles – we aim to be open and transparent about how we handle your data.

To exercise any of these rights or make a request, please refer to the Contact Us section below for how to reach our Privacy Officer. When you contact us, please clearly state what you need: for example, “I’d like a copy of my personal data,” or “Please correct my phone number,” or “I’d like you to delete the account I created,” etc. We may need to verify your identity especially for sensitive requests (we wouldn’t want to accidentally send your data to someone else claiming to be you). Verification might involve answering a security question, confirming details we have on file, or providing ID in rare cases.

We will do our utmost to honor your requests and will communicate with you openly throughout the process. If for any reason we cannot fulfill a request (either in full or partially), we will give you a detailed explanation. Our goal is to ensure you feel confident and in control of your personal information when dealing with Go Epic Tours.

​

Updates to this Privacy Policy

​

We may update or revise this Privacy Policy from time to time to reflect changes in our practices, to stay compliant with legal requirements, or to improve clarity. When we make changes, we will revise the “Last Updated” date at the bottom of this policy. Any updated Privacy Policy will be effective when posted on our website (unless otherwise specified by us at the time of posting).

If we make material changes – for example, if we change how we use personal data in a significant way, or if we start collecting new types of personal information that we didn’t before – we will take additional steps to notify you. This could include a notice on our website’s homepage, a pop-up notice upon your next visit, or direct communication via email or other contact information you have provided us. We believe it’s important you are aware of any changes so you can understand how your information is handled.

For minor changes that do not substantially affect your rights or the core of the policy (for instance, clarifying language or updating contact information), we may simply post the revised policy with the new effective date. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal information.

If you continue to use our services or website after a Privacy Policy update, we will consider that as acceptance of the changes, to the extent permitted by law. Of course, if any change requires additional consent from you (because we’re doing something new with your data that we didn’t anticipate before), we will obtain that consent as needed.

Should you not agree with the changes in a revised Privacy Policy, you have the right to stop using our services and request us to delete or return your personal information (as applicable and allowed by law). Your comfort and trust are important to us, so we want to ensure our policies align with your expectations.

For historical reference, we can provide past versions of our Privacy Policy upon request so you can see how it has evolved. You can always reach out to us with questions about what has changed.

Last updated: September 10, 2025.