Empiria
Sign In

Policy

Privacy policy

This policy explains what personal information Empiria collects when you use the Empiria Tours website, why we collect it, who we share it with, how long we keep it, and the choices you have. It is written to match what the Site actually does.

1. Who is responsible

Empiria World Inc., a Canadian corporation based in Ontario ("Empiria", "we", "us"), operates Empiria Tours and is responsible for your personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law. Questions about this policy, and requests about your information, go to the email address on the contact page.

2. What we collect, and why

When you browse. Our servers record the network address, browser type and pages requested, as every website's do, to serve the Site and keep it secure. No analytics run unless you accept them in the consent banner (section 6).

When you book. The lead traveller's name, email address, phone number and, optionally, postal address. For each traveller: their full name as it appears on their identity document, their date of birth, and — if you give them — dietary needs, accessibility needs and an emergency contact. Any answers to questions a particular tour asks. The party size, room type, extras and any promotion code. And the exact wording you agreed to before reserving, with the date and time, your network address and your browser identifier, kept as the record of what was agreed. We use all of this to take and manage your booking, to run the tour, to contact you about it, and to keep the records the law requires of us as the seller.

When you pay. Stripe collects your card details on its own secure page. We never receive your card number. From Stripe we receive confirmation that a payment succeeded, the amount, the processing fee and a reference, and we keep those with the booking. Stripe's own privacy policy governs what Stripe does with your details.

When you create an account. Your email address and a password, stored only in hashed form by our authentication provider — or, if you sign in with Google, the name and email address Google gives us. Your name, phone number, postal address and marketing preference, if you fill them in. Saved travellers you add to your account (their names, dates of birth, dietary and accessibility notes), which you are responsible for having their permission to save.

When you contact us. Your name (optional), email address and message. The contact form does not store your message in the Site's systems: it is emailed straight to us, and our server log records only the time and the network address it came from, to prevent abuse.

When you apply to run tours with us. The company and contact details you provide, and the network address the application came from.

The emails we send you. We keep a record of the booking confirmations, receipts, balance reminders and departure information we sent you, and when, so that we can resend them and so that support can see what you received.

3. How we use it

  • To take, confirm and manage your bookings and to run your tours.
  • To send you the messages a booking needs: confirmation, receipt, reminders when a balance is due, and information before departure.
  • To answer your questions and resolve problems.
  • To tell you about new tours and offers — only if you have opted in, and you can opt out at any time on your account page or through the link in any marketing email.
  • To run, secure and improve the Site, including preventing fraud and abuse.
  • To meet our legal obligations, including tax and travel industry record keeping, and to establish or defend legal claims.

We do not sell personal information, and we do not make decisions about you by automated means that have legal or similarly significant effects.

4. Who we share it with

The operators and suppliers who run your tour. They receive what they need to run it: traveller names, dates of birth where a ferry, hotel or authority requires them, dietary and accessibility needs, emergency contacts, and the lead traveller's contact details for the duration of the trip. They may use it only to run your tour.

Service providers acting for us, under contract and only on our instructions: Stripe (payments); Supabase (our database and sign-in, hosted in Canada); the providers that deliver our email (Resend and Amazon Web Services); Cloudflare (bot protection on our forms, where enabled); and our hosting providers. Stripe, the email delivery providers and Cloudflare may process information in the United States or elsewhere, where it is subject to those countries' laws.

Google, if you choose to sign in with Google, or if you accept analytics in the consent banner.

Empiria Events. Empiria Tours and Empiria Events are properties of the same company, but your accounts on them are separate and we do not merge them.

When the law requires it, for example in response to a subpoena or a lawful request from a public authority, to protect our rights or someone's safety, or as part of a sale or reorganisation of our business, in which case the successor is bound by this policy.

5. Where it is kept and how it is protected

Our database and sign-in service are hosted by Supabase in Canada (Amazon Web Services' Canada Central region). The Site is served over HTTPS. Card data never touches our systems. Access to bookings is limited to Empiria staff whose role needs it, and every change staff make to a booking is recorded with who made it and when. No method of storage or transmission is perfectly secure; if a breach of our security affects your information and creates a real risk of significant harm, we will notify you and the Privacy Commissioner of Canada as PIPEDA requires.

6. Cookies, local storage and analytics

The Site sets a small number of cookies, each with a job:

  • A sign-in cookie, set by our authentication provider when you sign in and removed when you sign out.
  • A booking session cookie: a random identifier that ties the seats you are holding to your browser for up to 24 hours. It identifies no one and is how we know the held seats are yours.
  • Cloudflare's cookie on forms protected by its bot check, where that is enabled.

Your choice in the consent banner is saved in your browser's local storage, not in a cookie, and is never sent to us. Analytics (Google Analytics or Google Tag Manager) run only if you accept. If you decline, no analytics script loads on this or any later visit. To change your choice, clear this site's data in your browser and the banner will ask again.

7. How long we keep it

  • Bookings, payments, traveller details and the record of what you agreed to: for as long as tax and travel industry legislation requires us to keep records of a sale.
  • Your account profile: until you close your account. Closing it erases your name, email address, phone number and address from the profile and deletes your saved travellers; your bookings are kept as above but are no longer linked to a profile anyone can sign in to.
  • Seat holds: minutes. They expire and are released.
  • Contact form messages: not stored by the Site; kept in our mailbox as any email is.
  • Records of emails we sent you: with the booking they relate to.
  • Server logs: for a limited period, for security.

8. Your rights and choices

  • See and correct your information. Your account page shows and lets you edit your profile and saved travellers. For anything else, ask us through the contact page; we respond within 30 days, as PIPEDA provides.
  • Delete your account. Use "Close this account" on your account page. Section 7 explains what is erased and what is kept.
  • Marketing. Opt in or out on your account page, or use the unsubscribe link in any marketing email. Transactional messages about a booking you have made are sent regardless, because the booking needs them.
  • Analytics. Decline or accept in the consent banner, and change your mind as section 6 describes.
  • Withdraw consent. You may withdraw consent for uses that rely on it at any time by contacting us, subject to legal or contractual restrictions — we still need enough information to carry out a booking you have made.
  • Complain. Contact us first, and we will try to resolve it. If we cannot, you may complain to the Office of the Privacy Commissioner of Canada.

9. Children

The Site is for adults. Only a person aged 18 or over can make a booking or hold an account. Details of children on a booking are provided by the responsible adult and used only to run the tour. We do not otherwise knowingly collect information from children; if you believe a child has given us information, tell us and we will delete it.

10. Visitors from outside Canada

Your information is stored in Canada and handled under Canadian law, with the exceptions in section 4. If you are in the European Union or the United Kingdom and the GDPR or UK GDPR applies to you, our legal bases are: performing your booking contract; our legal obligations to keep records; your consent, for marketing and analytics; and our legitimate interests in running and securing the Site. You may complain to your local supervisory authority as well as to us.

11. Changes to this policy

We may update this policy as the Site or the law changes. The date at the foot of this page shows when it was last changed, and we will tell you by email or by a notice on the Site if a change is significant.

12. Contact

Requests and questions about your personal information go to the email address on the contact page, or by post to the address shown there.

Last updated: 14 September 2026.