Privacy Policy

1. Introduction

Welcome to CanaryVIP.com. The protection of your personal data and your privacy are fundamental priorities for us. This Privacy Policy describes the categories of personal information we collect, the purposes for which we use it, how we share and store it, and the security measures we apply to keep it safe. All processing activities are carried out in accordance with applicable data protection legislation, including the General Data Protection Regulation (GDPR).

2. Data Controller

Under the GDPR, the entity responsible for processing your personal data is CanaryVIP.

3. Legal Basis for Processing

In accordance with Article 6 of the GDPR, CanaryVIP relies on the following legal grounds to process personal data:

3.1 Performance of a Contract (Art. 6.1.b)

We process personal data when it is necessary to fulfil a contract with you or to take steps at your request before entering into a contract. This covers:

Processing bookings and managing reservations.
Providing customer support in connection with booked services.
Handling cancellations, refunds, and itinerary changes.

Where required by law, we obtain your explicit consent before processing personal data. This applies in particular to:

Sending promotional emails, newsletters, or other marketing communications.
Collecting additional information through optional forms on our website.

You may withdraw your consent at any time without affecting the lawfulness of any processing carried out before the withdrawal.

3.3 Legal Obligation (Art. 6.1.c)

We may process personal data to comply with legal obligations binding on CanaryVIP, including:

Tax and financial regulations related to invoicing and transactions.
Consumer protection legislation.
Responding to lawful requests from public authorities or law enforcement bodies.

3.4 Legitimate Interest (Art. 6.1.f)

We may process data on the basis of our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include:

Improving our services through analytics and customer feedback.
Fraud prevention and cybersecurity.
Responding to general inquiries and customer service requests.

You have the right to object to processing based on legitimate interest at any time. To exercise this right, contact us at info@canaryvip.com.

4. Information We Collect and How We Use It

4.1 Categories of Personal Data

We may collect and process the following types of personal data:

Identity Data: Name, surname, date of birth.
Contact Data: Email address, phone number.
Booking Data: Excursion details, reservation information, and associated payments.
Communication Data: Emails, messages, and records of customer service interactions.
Contact Form Data: The name, email address, optional subject and message you send through our contact form.
Review Data: The name, optional email address, rating, written review and any photos you submit when you review an activity.
Transaction Data: Payment information processed securely through third-party payment providers.
Usage Data: With your consent, statistics about how you use the website, collected through analytics cookies (see our Cookie Policy).

4.2 Purposes of Processing

We use the personal data we collect for the following purposes:

Processing and managing bookings and reservations.
Providing customer support before, during, and after excursions.
Sending service-related communications (confirmations, reminders, updates).
Handling enquiries sent through the contact form, and publishing approved reviews.
Meeting legal and regulatory obligations.

4.3 Contact Form, Reviews and Hosting

When you use our contact form, the name, email, optional subject and message are stored in our database (Cloudflare D1) and emailed to our team (through SendGrid, a Twilio service) so that we can reply. We keep these messages only for as long as needed to handle your enquiry.

When you submit a review of an activity, your name, optional email, rating, review text and any photos are stored (in Cloudflare D1 and Cloudflare R2) and shown publicly only after our team has approved them. You can ask us to remove your review at any time.

Both forms are protected against spam by Cloudflare Turnstile, which may process technical data such as your IP address for that purpose. Our website is hosted on Vercel, while our database, file storage and anti-spam service run on Cloudflare (D1, R2 and Turnstile). The booking and payment process runs on our separate booking platform (booking.canaryvip.com) using Stripe and PayPal.

We share personal data only when strictly necessary and always in compliance with GDPR. Recipients may include:

Payment Processors: To process transactions securely (e.g., Stripe, PayPal).
Website Hosting: Vercel, which serves our website.
Database, Storage and Anti-spam: Cloudflare, which provides our database (D1), file storage (R2) and the Turnstile anti-spam service.
Email Delivery: SendGrid (a Twilio service), to deliver contact form messages to our team.
Analytics: Google, for Google Analytics. It loads under Google Consent Mode with all storage set to "denied" by default, so it stores no analytics or advertising cookies on your device until you accept analytics cookies. The Meta Pixel is not loaded at all until you accept.
Regulatory Authorities: When disclosure is required by law.
Service Providers: For fraud prevention, security, and operational support.

For information about data shared through cookies and tracking technologies, please refer to our Cookie Policy.

5.2 International Data Transfers

In order to deliver our services, CanaryVIP may share personal data with third-party providers located outside the European Economic Area (EEA). When this occurs, we ensure compliance with Articles 44 to 50 of the GDPR through appropriate legal safeguards:

For providers not covered by the DPF, such as Stripe and PayPal, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to guarantee an adequate level of data protection.

If you have questions about international data transfers, please contact us at info@canaryvip.com.

5.3 How Long We Keep Your Data

Personal data is retained only for as long as necessary to fulfil the purposes described in this policy.
Booking records are kept for a minimum of 5 years to comply with legal and tax obligations.
You may request deletion of your data at any time, subject to any legal retention requirements that may apply.

6. Data Security

We apply technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure. These measures include:

SSL/TLS encryption: All data transmitted through our website is encrypted in transit.
Cloudflare protection: We use Cloudflare's security services, including DDoS mitigation, Web Application Firewall, and bot filtering.
Access controls: Only authorized personnel with a legitimate need can access sensitive data.
Data minimization: We collect and store only the personal data that is strictly necessary.

The General Data Protection Regulation grants you the following rights over your personal data:

Right of access: You may request confirmation of whether we process your data and obtain a copy of it.
Right to rectification: You may request correction of any inaccurate or incomplete data we hold about you.
Right to erasure: You may ask us to delete your personal data, subject to applicable legal retention obligations.
Right to restriction: You may request that we limit how we process your data in certain circumstances.
Right to object: You may object to processing carried out on the basis of legitimate interest.
Right to data portability: You may request a copy of your data in a structured, commonly used, and machine-readable format.

To exercise any of these rights, contact us at info@canaryvip.com.

8. Changes to This Policy

By using our services, you consent to the collection and use of your personal data as described in this policy.

CanaryVIP reserves the right to update this Privacy Policy at any time. Any changes will be published on this page. We encourage you to review this policy periodically to stay informed.

This Privacy Policy does not cover the use of cookies or tracking technologies. Please refer to our Cookie Policy for details on those topics.

9. Contact

If you have any questions about this Privacy Policy or about how we handle your personal data, you can reach us at:

Email: info@canaryvip.com

Website: www.canaryvip.com