Privacy Policy
Effective date: October 1, 2026
Who we are
Victoria Coastal Tours is operated by 1543692 B.C. Ltd. in British Columbia, Canada. We provide guided tours and transportation and are responsible for the personal information we collect and use in operating our business.
This policy covers toursvictoria.com, portal.toursvictoria.com, the Victoria Coastal Tours mobile app, and our related booking, communication and operational services. Staff and authorized booking partners use authenticated portal and app accounts. Guests may use public booking, quotation, invoice or payment pages without an account.
The staff and partner app is not directed at children. We may receive information about children travelling with a guest, such as passenger age categories, where needed to arrange an appropriate service. A parent, guardian or authorized person should provide that information.
We follow British Columbia’s Personal Information Protection Act (PIPA) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies.
Information we collect
We collect information reasonably needed to arrange and deliver services, manage our operations, and meet legal requirements. The information depends on your relationship with us and the services you use.
| Category | Examples |
|---|---|
| Guest and booking information | Name, email address, phone number, preferred contact method, experiences booked, travel dates and times, pickup and drop-off addresses, flight or ferry details, passenger counts and age categories, luggage, selected vehicles, extras and special requests. |
| Accessibility and assistance requests | Information you choose to provide about mobility, accessibility or other assistance needs. This may include sensitive information. Please provide only what is needed for the service. |
| Billing and transaction information | Billing contact or company, invoices, discounts, payment method and status, transaction references, refunds and related records. |
| Communications and documents | Emails, messages, call recordings and transcripts where recording is enabled, work orders, referral details, attachments, feedback and correspondence about bookings or complaints. |
| Staff and partner account information | Name, contact details, account identifiers, authentication information, role, access permissions and records of account activity or booking changes. |
| Employment and driver records | Information needed for employment, insurance, scheduling and vehicle operations, such as date of birth, licence and qualification records, required checks, availability, days off, trip assignments, inspection reports, photographs and completion records. |
| Location information | Guest pickup and drop-off locations, inspection location when device permission is given, and vehicle location or trip history where vehicle tracking is enabled. |
| Technical and interaction information | IP address or a derived identifier, browser or device information, access and security logs, notification tokens, message sending and delivery information where available, and interactions such as review-link clicks. |
Information comes from you, people authorized to act for you, staff, booking partners, platforms such as Viator and GetYourGuide, and the systems used to deliver our services. If you provide information about another person, ensure you are authorized to do so and make this policy available to them.
Card payments are handled through payment providers such as Stripe and Square. We receive transaction details needed to administer payments rather than storing full payment-card numbers in our booking portal. Please do not send full card numbers or security codes by email, text message or work order.
How we use information
We use personal information to:
- Prepare quotes, create and manage bookings, arrange services and process payments or refunds.
- Contact guests about confirmations, pickup instructions, reminders, changes and service issues.
- Coordinate drivers, guides, vehicles and booking partners, including referral work orders and third-party billing.
- Maintain inspections, safety and maintenance records, and identify missing inspection reports.
- Manage staff and partner accounts, schedules, permissions and system security.
- Process receipts, maintain accounting records and meet legal obligations.
- Handle questions, feedback, complaints and claims.
- Request feedback or reviews and understand whether related links were used.
- Use analytics and reporting to understand service performance and improve our operations.
- Use AI-assisted tools as described below.
We do not sell personal information. We do not use staff or partner app information for cross-app advertising. Website advertising and vendor data uses are described separately below.
We obtain consent where required. If we propose a materially different use, we will explain it and obtain any consent required by law. Some employment, legal and operational activities may be permitted without consent under applicable law.
Booking messages, review requests and link tracking
We may communicate through email, text message, phone, WhatsApp or another available channel, depending on your preferences and the service. Operational messages may include booking confirmations, reminders and changes.
We may also send feedback or review requests, subject to applicable consent and messaging requirements. You can ask us to stop optional messages. Withdrawing consent to optional messages does not prevent necessary service communications where permitted by law.
Our systems may record when a message is sent, whether a provider reports a delivery failure, and when a tracked link is clicked. Review-link records may include the associated booking, destination, time, browser information and a derived IP identifier. A click is not proof that a review was submitted. External review websites process information under their own privacy policies.
Location information
Inspection location. Where enabled, the app requests device-location permission to record where an inspection took place. You can manage permission in your device settings. If location access is unavailable, contact us about the information needed to complete the inspection record.
Vehicle tracking. Where installed and enabled, vehicle GPS may record vehicle location and trip history for dispatch, safety, incident investigation and vehicle management. Drivers are informed about tracking and its purposes. Vehicle movement may also reveal a guest’s journey when associated with a booking.
Guest travel locations. We use pickup, drop-off and itinerary locations to arrange transportation and provide the booked service. We do not require a guest to enable continuous personal-device tracking to make a booking.
We do not sell this location information or use operational location records for advertising. Access and retention depend on the operational, safety and legal purposes described in this policy.
Push notifications
Where supported and with your permission, the app uses a device token to send work notifications such as booking updates, schedule changes and assignments through Apple Push Notification service or Google Firebase Cloud Messaging.
You can turn off notifications in your device settings. Disabling notifications does not necessarily delete your account or historical notification records. Contact us to close an account or request deletion of associated information.
Phone calls
Our business phone service uses Quo. Calls may be recorded and transcribed to confirm booking details, resolve questions or complaints, and support staff training. When a call is recorded, we provide notice of recording and its purposes and obtain consent where required.
If you do not wish to be recorded, tell us so we can discuss another way to assist you, such as email. Recordings and transcripts are subject to the retention principles below, including longer retention where needed for a complaint, incident or legal obligation.
AI-assisted processing
We use AI-assisted tools, including OpenAI’s API, to help interpret booking requests and work orders, organize booking information, draft communications and quotations, and extract information from documents or receipts.
Depending on the task, these tools may process information such as names, contact details, travel requirements, messages and uploaded documents. We aim to limit the information provided to what is reasonably needed. Please avoid including unrelated sensitive information in attachments or requests.
AI output can contain errors. Important booking details, prices and proposed actions should be checked before confirmation. Contact us if information is incorrect or you want a staff member to review an AI-assisted interaction.
OpenAI states that API data is not used to train its models by default unless the organization using the API opts in. Processing and retention depend on the API feature, account settings and applicable provider terms; using AI does not mean information is immediately deleted after a response. Information may be processed outside Canada.
Our website, cookies and advertising
Our website uses Shopify. Essential cookies and similar technologies help operate the site, maintain sessions and support checkout. Shopify processes information submitted through the website, including contact and purchase information.
We also use Google analytics and advertising tools to understand website use and measure advertising performance. Depending on the tools and choices in effect, these services may receive device information, pages visited, interactions and purchase events.
Where Shopify Network Intelligence is enabled, Shopify may combine information from our store with other Shopify data to provide enhanced services, including personalization and advertising, under Shopify’s applicable terms and privacy policy. Those activities are distinct from a provider processing information solely on our behalf.
We obtain consent for non-essential tracking where required by law. Use the privacy or cookie controls made available on the website to manage available choices. Browser controls can also block or delete cookies, although some functions may be affected. Google ad-personalization choices are available at Google My Ad Center. These choices do not necessarily stop all measurement or data processing.
Who we share information with
We disclose information reasonably needed for the relevant purpose, including to:
- Drivers, guides and service partners: to coordinate and deliver the booked service.
- Booking and referral partners: to administer bookings they arrange, coordinate work orders and manage agreed billing. Access is intended to be limited to information relevant to their role.
- Service providers: for hosting, network security, communications, payments, website operations, analytics, push notifications and AI processing. These include Cloudflare, Microsoft 365 through GoDaddy, Quo, Stripe, Square, Shopify, Google, Apple and OpenAI, as applicable to the service used.
- Professional advisers, insurers and authorities: where reasonably necessary for advice, claims, safety or legal obligations, and as permitted or required by law.
Some providers, including payment providers and website advertising services, may also process information for their own legal, security or other disclosed purposes under their terms and privacy policies. We consider provider terms and safeguards when selecting and using these services.
If a proposed or completed sale, merger or reorganization involves personal information, we will handle disclosure and transfer in accordance with applicable law, including applicable safeguards and notice requirements.
Where information is stored
Our primary portal records are stored on our server at our office in Langford, British Columbia. This does not mean all copies or processing remain in Canada.
Communications, payments, website activity, AI processing, network delivery and other services involve external providers. Information may be stored or processed outside Canada, including in the United States, and may be accessible to authorities under the laws of those jurisdictions. Provider processing locations can vary by service and configuration.
How long we keep information
We retain information for as long as reasonably needed for the purposes described in this policy, including service delivery, recordkeeping, safety, disputes and legal obligations. The appropriate period depends on the record rather than only the date an account is closed.
| Record type | Retention approach |
|---|---|
| Booking and guest records | Retained for service administration, follow-up and legitimate recordkeeping needs. Information supporting accounting, disputes or claims may need to be retained longer than other booking details. |
| Invoices and tax-supporting records | Generally retained for at least six years after the end of the last tax year to which they relate, or longer where required by law or a legal hold. |
| Vehicle GPS, inspections and driver records | Retained according to operational and safety needs and the requirements applicable to the particular record, including transportation, insurance and employment requirements. |
| Calls, transcripts, messages and attachments | Retained according to the communication’s purpose and any related booking, complaint, incident or legal requirement. |
| Staff and partner accounts | Access is disabled when no longer authorized. Associated employment, booking, financial and audit records may remain where needed or legally required. |
| Technical logs, interaction records and notification tokens | Retained according to security, troubleshooting, communication and reporting needs and the applicable provider’s retention arrangements. |
Where BC PIPA requires us to retain information used to make a decision directly affecting an individual, we retain it for at least the required one-year period.
When information is no longer needed, we take reasonable steps to delete it, anonymize it or otherwise dispose of it securely. Backup copies may remain until they are replaced or expire through the backup cycle. Legal holds and provider requirements may affect deletion timing.
Account closure and deletion requests
Staff and partner accounts are administered by Victoria Coastal Tours. To request account closure or deletion, email admin@toursvictoria.com. You may also use an account-deletion control where available in the app.
Closing an account removes the need for ongoing access but does not automatically erase records we need to retain. We will explain material retention exceptions when responding to your request. Guests can request deletion without having an account.
How we protect information
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information. These include HTTPS for portal communications, account permissions and records of important booking activity. We limit access to people who need information for their work and expect authorized users to protect their credentials.
No system or transmission method is completely secure. If a privacy incident occurs, we assess it, take appropriate steps to contain and address it, and notify affected individuals and regulators as required by applicable law. We may also provide notice where appropriate to help people protect themselves.
Your rights and choices
Subject to applicable law and its exceptions, you can request access to your personal information, correction of inaccurate information, deletion of information no longer needed, or withdrawal of consent. Deletion is not an absolute right: some records must or may lawfully be retained.
We may need to verify your identity or authority before fulfilling a request. If withdrawing consent affects our ability to provide a service, we will explain the consequences. Device permissions and optional message preferences can also be managed through the available controls or by contacting us.
Send requests or privacy complaints to admin@toursvictoria.com. We respond within the period required by applicable law, generally within 30 days for access requests, subject to permitted extensions. We will explain any applicable extension or reason we cannot fully fulfil a request.
If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner for British Columbia or, where applicable, the Office of the Privacy Commissioner of Canada.
Contact and policy changes
Privacy contact: Privacy Administration
Business: Victoria Coastal Tours — 1543692 B.C. Ltd.
Address: 570 Treanor Ave, Langford, BC V9B 3H5, Canada
Email: admin@toursvictoria.com
Phone: 778-401-1000
We will post updates with a revised effective date. For material changes, we will provide additional notice and obtain consent where required by law.