Effective date: 9/16/2026

Last updated: 9/16/2026

1. Who we are and what this policy covers

Harrison Eco Tours ("Harrison Eco Tours", "we", "us" or "our") is a guided kayaking, boat tour and kayak rental operator based in Harrison Hot Springs, British Columbia, Canada. Harrison Eco Tours is operated by [LEGAL ENTITY NAME], a company incorporated in British Columbia [BC INCORPORATION NUMBER].

We respect your privacy and are committed to protecting the personal information you entrust to us. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, how we protect it, and the choices and rights you have.

This policy applies to:

• our website at www.harrisonecotours.com and any subdomains;
• our online booking pages, wherever they are hosted;
• bookings, enquiries and communications made by telephone, email, in person at our office or dock, or through a travel agent, hotel partner or online travel agency;
• our social media pages and accounts; and
• participation in our tours, rentals and activities.

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA). Where the EU or UK General Data Protection Regulation applies to our handling of your information, or where US state privacy laws such as the California Consumer Privacy Act apply, the additional sections at the end of this policy also apply to you.

Accountability

We have designated an individual who is accountable for our compliance with this policy and with applicable privacy law:

Privacy Officer: [PRIVACY OFFICER NAME]

Harrison Eco Tours

100 Esplanade Avenue, Harrison Hot Springs, British Columbia V0M 1K0, Canada

Email: info@harrisonecotours.com

Telephone: 604-316-4460

2. Consent

In most cases we will collect, use and disclose your personal information only with your knowledge and consent.

Express consent. We ask for your express consent where the information is sensitive, where we want to send you marketing messages, or where the law otherwise requires it. You give express consent when, for example, you tick a box to subscribe to our mailing list or sign a waiver that discloses a medical condition.

Implied consent. Where the purpose is obvious and you voluntarily provide the information, we may rely on your implied consent. For example, if you give us your email address in order to receive a booking confirmation, we imply your consent to use it for that purpose.

Without consent. We may collect, use or disclose personal information without consent only where permitted or required by law — for example, in an emergency that threatens someone's life, health or security; to investigate a breach of an agreement or a contravention of law; to collect a debt owed to us; or in response to a lawful order, subpoena or court process.

Withdrawing consent. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Contact our Privacy Officer using the details above. Please understand that withdrawing consent may mean we can no longer provide you with a booking or a service — for example, we cannot take you on the water without an emergency contact and a signed waiver.

Consent on behalf of others. If you make a booking for other people, you confirm that you have their authority (or, for a child, the authority of their parent or guardian) to provide their personal information to us and to consent on their behalf to the uses described in this policy.

3. The personal information we collect

3.1 Information you give us directly

When you make a booking or enquiry:

• full name;
• email address;
• telephone number;
• billing address and country of residence;
• the tour, rental or package selected, date, time and number of participants;
• the names, ages and number of people in your party, including whether any participants are children;
• hotel or accommodation details where you have booked a resort package;
• any special requests, accessibility requirements or notes you choose to give us;
• your preferred language and how you heard about us; and
• the content of your messages to us, including contact-form submissions, emails, text messages and voicemails.

When you participate in a tour or rental:

• the information on your signed waiver and release of liability, including your signature and date of birth or age;
• the name and signature of a parent or guardian where a participant is under 16;
• emergency contact name and telephone number;
• participant weight where it is relevant to safe equipment allocation (for example, kayak weight limits) — we record only what is necessary and do not retain it beyond the trip unless required for an incident record;
• relevant medical conditions, allergies, mobility limitations or other health information you choose to disclose so we can plan for your safety. This is sensitive information. We collect it only with your express consent, use it only to keep you safe and to respond to an emergency, restrict access to guides and managers who need it, and delete it in accordance with our retention schedule;
• swimming ability and paddling or boating experience, where relevant to the activity; and
• incident, accident and first-aid records where an incident occurs.

When you pay us: we collect the amount, currency, date, and the last four digits and card type of the payment method, together with the transaction reference. We do not collect or store full payment card numbers, expiry dates or security codes. Card details are captured and processed directly by our payment processor within its own secure environment.

When you contact us or engage with us: the content of enquiries, complaints, reviews, testimonials, survey responses and correspondence, and any photographs or videos you send us.

When you apply for a job with us: your resume, cover letter, work history, certifications and qualifications, references and any other information you provide. This is used only to assess your application.

When you subscribe to our mailing list: your name, email address and subscription preferences.

3.2 Information collected automatically when you use our website

Our website is built on the Duda website platform. When you visit, we and our service providers may automatically collect:

• your IP address and approximate location derived from it (typically city or region level);
• browser type and version, operating system, device type and screen resolution;
• the pages you view, the time and duration of your visit, and the links you click;
• the website or advertisement that referred you to us;
• search terms used to find us; and
• cookie identifiers and similar device identifiers (see section 6).

3.3 Photographs and video

We and our guides sometimes take photographs and video during tours for the enjoyment of guests and for our marketing, including on our website, social media and in promotional material. Tell your guide before or during the tour if you do not wish to appear, and we will not photograph you or will not use images in which you appear. If an image of you has already been published and you want it removed, contact us and we will remove it from the channels we control as soon as reasonably practicable.

3.4 Information we receive from others

• Online travel agencies and resellers — where you book through a partner such as [OTA / RESELLER PARTNERS], that partner passes us the booking details, your name and contact details.
• Accommodation and resort partners — where you book a package that includes a hotel stay, the accommodation provider may share your reservation details with us and we may share yours with them, so that the package can be coordinated.
• Travel agents, tour operators and group organisers — who book on your behalf.
• Our payment processor — confirmation of payment, chargeback and dispute information.
• Social media platforms — if you interact with our pages, subject to that platform's own privacy settings.
• Review platforms — such as TripAdvisor and Google, where you leave a public review.

3.5 Children's information

Our website is not directed at children and we do not knowingly collect personal information directly from children online. Children do take part in our tours, and where they do we collect only the information necessary for their safety and supervision, and only from a parent or guardian, who must sign the waiver on the child's behalf. If you believe a child has provided us with personal information without parental consent, contact our Privacy Officer and we will delete it.

4. Why we collect and use your personal information

We identify the purposes for which we collect personal information at or before the time of collection. We use personal information to:

1. Provide the service you booked — take and confirm your booking, allocate guides, boats and equipment, schedule your tour, and deliver the tour, rental or package.
2. Communicate with you about your booking — send confirmations, reminders, meeting-point instructions, what-to-bring information, weather and safety updates, and changes or cancellations.
3. Take payment — process payments, deposits and refunds, issue receipts and invoices, and manage chargebacks and disputes.
4. Keep you and others safe — plan for medical, mobility and accessibility needs, allocate appropriate equipment, confirm participants can safely take part, brief guides, and respond to emergencies.
5. Meet our legal and regulatory obligations — including record-keeping under Transport Canada and workplace safety requirements, tax and accounting law, and responding to lawful requests.
6. Manage risk and protect our legal interests — maintain waivers and incident records, respond to claims, report to and cooperate with our insurers, and establish, exercise or defend legal claims.
7. Answer your enquiries and handle complaints.
8. Improve our business — analyse how our website and booking system are used, understand which tours are popular, monitor service quality, and train our staff.
9. Market our tours to you — send newsletters, seasonal offers and news, where you have consented or where the law otherwise allows. Every commercial electronic message we send includes an unsubscribe link, as required by Canada's Anti-Spam Legislation (CASL).
10. Display testimonials and reviews — with your consent, or where you have posted them publicly.
11. Recruit and manage staff and contractors.
12. Protect the security of our website, systems and property — including detecting and preventing fraud and misuse.

If we want to use your personal information for a purpose that is materially different from those listed here, we will tell you and, where required, obtain your consent first.

Legal bases (for visitors covered by the EU or UK GDPR)

Where the GDPR applies, our legal bases are:

• Performance of a contract — to take your booking and deliver the tour or rental you purchased (purposes 1, 2, 3).
• Legal obligation — record-keeping, safety, tax and regulatory compliance (purposes 5, and parts of 4 and 6).
• Vital interests — responding to a medical emergency on the water (purpose 4).
• Legitimate interests — running, securing and improving our business, handling complaints, and defending legal claims, where these are not overridden by your rights (purposes 6, 7, 8, 11, 12).
• Consent — health information, marketing, non-essential cookies, and publishing testimonials or photographs (purposes 4 in part, 9, 10). You may withdraw consent at any time.

Where we process health information, we rely on your explicit consent, or on the necessity of the processing to protect your vital interests or those of another person.

5. How we share your personal information

We do not sell your personal information, and we do not rent or trade it. We share it only as described below.

5.1 Our service providers

We use third-party service providers to operate our business. They may access personal information only to perform services on our behalf, under contract, and are not permitted to use it for their own purposes. They include:

• Website platform — Duda, which hosts and serves our website.
• Booking and reservation system — Checkfront, which manages bookings, availability, customer records and booking communications.
• Payment processing — Square, and any other payment processor we use, which processes card payments and refunds. Card data is handled within the processor's PCI DSS compliant environment; we never see your full card number.
• Email and communications — our email provider, and [EMAIL MARKETING PLATFORM] for newsletters.
• Analytics and advertising — [ANALYTICS / ADVERTISING TOOLS], which help us understand website traffic and measure advertising.
• Accounting, bookkeeping and tax advisers.
• IT support, backup and security providers.

5.2 Our tour partners

• Guides and contractors — the guides leading your tour receive the participant list, emergency contacts and any safety-relevant information you have given us.
• Accommodation and resort partners — where you book a package including a hotel stay, we share what is necessary to coordinate it.
• Online travel agencies, travel agents and resellers — where your booking came through them, we may share booking status and changes.
• Other tour or transport operators — where part of your itinerary is delivered by another operator.

5.3 Others

• Emergency services and medical personnel — where necessary to respond to a medical emergency, accident or search-and-rescue situation.
• Insurers, brokers, lawyers and claims adjusters — where an incident occurs or a claim is made.
• Government authorities and regulators — including Transport Canada, WorkSafeBC and law enforcement, where required by law or in response to a lawful request.
• Purchasers of our business — if we sell or reorganise all or part of our business, personal information may be transferred as part of that transaction, subject to the purchaser agreeing to protect it on terms consistent with this policy. We will notify you if this materially affects how your information is handled.

6. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. We use them to make our site work, to remember your preferences, to understand how the site is used, and — where you allow it — to measure and target advertising.

The categories we use:

• Strictly necessary cookies — required for the website and booking system to function, for security, and to remember items in your booking. These cannot be switched off.
• Preference cookies — remember choices such as language or region.
• Analytics and performance cookies — tell us which pages are visited and how visitors move through the site, in aggregate, so we can improve it.
• Marketing and advertising cookies — set by advertising platforms to measure campaign performance and show you relevant advertising on other sites. We use these only with your consent.

Your choices. Where required by law, we display a cookie banner on your first visit that lets you accept or reject non-essential cookies, and you can change your choice at any time through the cookie settings link on our website. You can also block or delete cookies through your browser settings — though blocking strictly necessary cookies may stop the booking system from working. Most browsers explain how to do this in their help documentation.

Do Not Track. There is currently no consistent industry standard for responding to browser "Do Not Track" signals, and our website does not respond to them. Where we are legally required to honour an opt-out preference signal such as Global Privacy Control, we do so.

7. Storage, and transfers outside Canada

Please read this section carefully. Several of our service providers — including our website platform, booking system and payment processor — are located in, or store and process data in, the United States and other countries outside Canada. This means your personal information may be stored on, or accessible from, servers outside Canada and outside British Columbia.

While your personal information is in another country, it is subject to the laws of that country, and may be accessible to the courts, law enforcement and national security authorities of that country under those laws — including, in the United States, under lawful access legislation. We cannot prevent lawful access of this kind.

We take reasonable steps to ensure that any service provider we use provides a comparable level of protection to that required in Canada, including through contractual commitments. Where we transfer personal information from the European Economic Area or the United Kingdom, we rely on the European Commission's adequacy decision for Canada (for commercial organisations subject to PIPEDA) or on Standard Contractual Clauses, as appropriate.

If you have questions about how your information is handled outside Canada, contact our Privacy Officer.

8. How long we keep your personal information

We keep personal information only as long as necessary to fulfil the purposes for which it was collected, or as required by law. In general:

• Booking and customer records — for up to seven (7) years from the date of the booking, to meet tax and accounting requirements.
• Financial and transaction records — for seven (7) years, as required by the Income Tax Act and the Excise Tax Act.
• Signed waivers and releases — for at least the applicable limitation period under BC law, and longer where a participant was a minor at the time (because limitation periods do not begin to run against a minor until they reach the age of majority). We typically retain waivers for participants who were adults for [SUGGESTED: 7 years], and waivers signed for minors until [SUGGESTED: the participant's 21st birthday, or longer on our insurer's advice].
• Incident, accident and first-aid records — for the period required by our insurer and by applicable safety legislation, and in any event until any related claim is fully resolved.
• Health information disclosed for a tour — deleted shortly after the tour, unless it relates to an incident.
• Marketing list data — until you unsubscribe, and then only the minimum record needed to honour your opt-out.
• Enquiries that do not result in a booking — normally no more than two (2) years.
• Job applications — normally one (1) year for unsuccessful applicants, unless you agree we may keep them longer.
• Website analytics data — as set by the retention settings of the analytics tool, typically 14 to 26 months.

When personal information is no longer needed, we securely destroy, erase or anonymise it.

9. How we protect your personal information

We protect personal information using safeguards appropriate to its sensitivity, including:

• encryption of our website and booking pages in transit (HTTPS/TLS);
• storing booking and payment data in reputable systems that maintain their own recognised security certifications, including PCI DSS for card data;
• access controls, so that staff and contractors can access only the information they need to do their job;
• unique accounts and passwords, and multi-factor authentication where available;
• confidentiality obligations in our contracts with staff, guides and service providers;
• secure storage of paper records such as waivers, and secure destruction when they are no longer needed; and
• training our team on their privacy and confidentiality obligations.

No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security. If a breach of security safeguards occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by law, and will keep a record of the breach.

10. Accuracy

We make reasonable efforts to keep personal information accurate, complete and up to date where it is used to make a decision about you. Please tell us promptly if your contact details or other information change, particularly before a scheduled tour.

11. Your privacy rights in Canada

Under PIPEDA and BC PIPA you have the right to:

• Access — ask whether we hold personal information about you, what we hold, how we have used it, and to whom we have disclosed it.
• Correction — ask us to correct information that is inaccurate or incomplete. If we do not make the correction, we will annotate the record to show that a correction was requested and refused.
• Withdraw consent — subject to legal or contractual restrictions and reasonable notice.
• Unsubscribe — opt out of marketing communications at any time.
• Complain — see section 14.

How to make a request. Write to our Privacy Officer at info@harrisonecotours.com or the postal address above. We may ask you for information to verify your identity, so that we do not disclose your information to the wrong person. We will respond within 30 days, and will tell you if we need an extension as permitted by law. Access is normally free; if a fee would be payable for a request that requires substantial effort, we will give you a written estimate first and you may withdraw or narrow the request.

Limits on access. We may be unable to provide access where doing so would reveal personal information about another person, where the information is subject to solicitor-client privilege, where it was generated in the course of a formal dispute resolution process, or where disclosure would breach law. If we refuse, we will tell you why and how to complain.

12. Additional rights under the EU and UK GDPR

If you are in the European Economic Area or the United Kingdom, you also have the right to: request erasure of your personal information; request restriction of processing; object to processing carried out on the basis of legitimate interests, and to object to direct marketing at any time; receive the personal information you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller (data portability); and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects — we do not carry out such automated decision-making.

These rights are subject to the exceptions in the GDPR — for example, we may need to retain waivers and incident records to establish or defend legal claims even after an erasure request. Exercising any of these rights is free of charge unless your request is manifestly unfounded or excessive.

You may complain to your local supervisory authority. In the UK, this is the Information Commissioner's Office (ico.org.uk).

13. Additional rights for United States residents

If you are a resident of California, or of another US state with a comprehensive consumer privacy law (including Colorado, Connecticut, Virginia, Utah, Texas and others), you may have the right to know what personal information we have collected about you and how we have used and disclosed it; to request deletion of your personal information; to request correction of inaccurate personal information; to opt out of the "sale" or "sharing" of personal information and of targeted advertising; and to be free from discrimination for exercising these rights.

We do not sell personal information, and we do not knowingly sell or share the personal information of anyone under 16. Some analytics and advertising cookies may constitute "sharing" for cross-context behavioural advertising under California law; you can opt out through our cookie settings or by using a Global Privacy Control signal.

To exercise these rights, contact us using the details in section 14. We will verify your request and respond within the time allowed by the applicable law. You may use an authorised agent, in which case we will require proof of their authority.

14. Questions and complaints

Please raise any question or concern with us first:

Privacy Officer, Harrison Eco Tours

100 Esplanade Avenue, Harrison Hot Springs, British Columbia V0M 1K0, Canada

Email: info@harrisonecotours.com

Telephone: 604-316-4460

We will acknowledge your complaint, investigate it, and tell you the outcome in writing.

If you are not satisfied with our response, you may complain to:

• Office of the Privacy Commissioner of Canada — priv.gc.ca, 1-800-282-1376.
• Office of the Information and Privacy Commissioner for British Columbia — oipc.bc.ca, 250-387-5629.
• Your local data protection supervisory authority, if you are in the EEA or UK.

15. Third-party websites

Our website and communications contain links to third-party sites, including our booking system, payment pages, social media profiles, review platforms and accommodation partners. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing them with personal information.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or to the law. The current version is always posted on our website with the "Last updated" date shown at the top. Where a change is significant, we will take reasonable steps to notify you — for example, by a notice on our website or by email. Your continued use of our website or services after a change takes effect means you accept the updated policy.