Privacy Policy

At YOHO Experiences ("we", "us", or "our"), we are deeply committed to respecting your privacy and safeguarding your personal information. This Privacy Policy explains how we collect, use, and protect your personal information when you use our service (the "Service"). By accessing or using the Service, you acknowledge and consent to the practices described in this policy regarding the handling of your personal information.

This Privacy Policy has been created in accordance with and in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA sets out the rules for how businesses must handle personal information in the course of commercial activities. We are committed to upholding these principles, ensuring that your personal information is collected, used, and disclosed in a manner that respects your privacy rights and complies with applicable laws.

PLEASE READ THIS PRIVACY POLICY CAREFULLY AS IT BECOMES LEGALLY BINDING ON YOU WHEN YOU USE OUR SERVICE. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, YOU SHOULD IMMEDIATELY STOP USING OUR SERVICE. FURTHERMORE, PLEASE REVISIT US REGULARLY TO KEEP TRACK OF ANY PRIVACY POLICY UPDATES.

Information We Collect

We collect information to effectively and securely provide, enhance, and improve our Service. The information we gather falls into two primary categories: 1) personal information that you voluntarily provide to us and 2) information that we collect automatically through your use of the Service.

Use of Information

We use the information we collect to:

• Provide, maintain and personalize our Service
• Enhance your user experience
• Respond to your inquiries and support requests
• Conduct research and development to improve the Service and add new features
• Comply with legal and regulatory obligations
• Communicate with you about administrative information and updates about the Service

We will never sell your personal information to any third party for any reason, including marketing, advertising, and any other for-profit purposes.

How We Share Personal Information

When providing our Service, we may share your personal information with third parties to facilitate our operations. We take measures to ensure your information is handled securely, akin to our own standards. Except as described in this Privacy Policy, we will not, without your permission, sell, publish or share information you entrust to us that identifies you or any person.

We may share your personal information with:

• Service Providers. Companies and individuals that provide services on our behalf or help us operate our Service (e.g., a hosting provider and payment processor). Please note that these service providers are bound by our instructions not to use your personal information for any purposes other than those explicitly directed by us.
• Business Partners: We work with trusted professional service providers who offer their services through our Service. These partners are selected for their expertise and commitment to quality, enabling us to enhance our Service. While they operate independently, they adhere to our privacy and data protection standards to ensure your information is handled securely.
• Business transfers: Should we undergo a business transaction like a merger, acquisition, or asset sale, your personal information may be transferred. The new owners will continue to handle your data in accordance with this Privacy Policy.
• Law Enforcement, Compliance and Defending Rights: Under certain circumstances, we might be required to disclose your information to comply with legal processes or governmental requests. We may also disclose your information if we believe that such action is necessary to comply with applicable laws, regulations, or legal processes, and to protect our rights, property, or safety, or the rights, property, or safety of others.
• Staff: Some personal information may be shared with our employees, contractors or professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us, who are instructed to handle your data in line with this privacy policy and applicable laws.
• Google Analytics: We use Google Analytics on the Service which is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualise and personalise the ads of its advertising network. For more information on the privacy practices of Google, please visit the Google Privacy Terms web page: https://policies.google.com/privacy?hl=en. We also encourage you to review Google's policy for safeguarding your data: https://support.google.com/analytics/answer/6004245.

Consent

We require your consent to collect, use, or disclose your personal information, unless specific circumstances allow us to do so without it. You have the option to withhold or withdraw your consent at any time, although this may impact our ability to provide you with our Service or certain features thereof.

Security of Your Information

We implement a range of reasonable administrative, physical, and electronic safeguards aimed at protecting the information we collect from or about you, including your personal information, against unauthorized access, use, or disclosure. These measures include but are not limited to, encryption of sensitive data using SSL (Secure Sockets Layer) or comparable technologies when such data is submitted through our forms, limiting employee access to personal information to only those who need to know, requiring service providers to adopt comparable security measures through contractual agreements. Additionally, our systems are regularly reviewed and updated to ensure they meet industry standards for information security.

Provider application data is stored on secure servers in the European Union. All data processing is conducted in accordance with Canadian privacy legislation (PIPEDA). EU storage provides additional security protections.

However, it is important to understand that no method of transmitting data over the Internet or storing it electronically is entirely secure. While we strive to use the most advanced and effective security measures, we cannot guarantee the absolute security of any information transmitted to or from our Service. By using our Service, you acknowledge and accept these inherent risks.

Your Privacy Rights

Under PIPEDA, you have the following rights regarding the personal information we hold about you:

• Right to information. You have the right to know the purposes for which your personal information is collected.
• Right of access. You have the right to obtain access to your personal information we retain about you.
• Right to rectification. You have the right to obtain rectification of your personal information without undue delay.
• Right to erasure. The right to obtain the erasure of your personal information without undue delay in certain circumstances.
• Right to withdraw consent. You have the right to withdraw consent at any time.
• Right to challenge compliance. You have the right to challenge our compliance with this Privacy Policy.

Data Privacy Officer (DPO)

If you have concerns about how we handle your personal information or if you have any other inquiries, you are encouraged to contact our DPO. Upon receiving your inquiry and verifying your identity, our DPO will conduct a thorough investigation and provide you with a detailed report of the findings or answers.

Below are the details about our DPO:

How to Exercise Your Rights

To exercise your rights regarding your personal information, please reach out to our DPO. We strive to respond within one (1) month from the date of receiving a well-defined request. If your request is complex or involves multiple queries, the process may take longer, but we will keep you informed throughout. In cases where we cannot fulfill your request, either fully or partially, we will provide you with a written explanation detailing the reasons for our decision and the options available for you to challenge it.

Data Retention Period

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by the applicable law. If you wish to have your personal information suspended or removed, please contact our DPO at any time.

Notwithstanding the foregoing, certain data may be retained for a designated period post-account deletion to facilitate investigations. This retention is mandated to ensure the preservation of critical information for legal and security purposes, notwithstanding your request for account deletion.

Cookies & Similar Technologies

Our Service uses cookies and similar technologies (collectively referred to as "cookies") to distinguish you from other users of our Service. This helps us to provide you with good service. This helps us enhance and personalize your user experience, monitor and improve our Service, and for other internal purposes.

We use the following types of cookies:

• Essential cookies. These cookies are necessary for the essential operation of our Service. They include session cookies (for admin access only), shopping cart cookies to remember items in your cart, security cookies for protecting against malicious attacks (e.g., CSRF attacks), and language preference cookies to ensure compliance with regional requirements (e.g., Quebec).
• Analytical/performance cookies. These cookies help us analyze how users interact with our Service. They include Google Analytics cookies, conversion tracking cookies to measure the effectiveness of campaigns, and A/B testing cookies to optimize user experience.
• Functionality cookies. These cookies enable us to personalize your experience by remembering your preferences. They include regional settings cookies to localize your experience, user interface preference cookies, and favorites list cookies to store your preferred items.
• Marketing/Retargeting cookies. These cookies help us deliver relevant advertising and analyze its effectiveness. They include retargeting cookies, social media pixels (e.g., Facebook and Instagram), and advertising effectiveness analysis cookies to assess the impact of our marketing efforts.

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies will likely be analytical/performance cookies or marketing/targeting cookies.

You block cookies by activating the settings on your browser that allow you to refuse the settings for all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our Service.

Third-Party Links

Our Service includes links to third-party websites to enhance user experience. These sites are not operated or controlled by us, and we assume no responsibility for their content, privacy policies, or practices. These third-party sites have their own policies, and we urge users to review them before using their sites and services.

Minors' Personal Data

Our Service is not designed for, targeted at, or intentionally marketed to children under the age of 13. We do not knowingly collect, use, or disclose personal data from children under 13 years of age. We explicitly prohibit individuals under the age of 13 from using our Service. If we learn that we have inadvertently collected personal data from a child under 13 without the required parental consent, we will take immediate steps to delete such information and terminate the child's account. If you are a parent or legal guardian and you believe that your child under the age of 13 has submitted personal information to us, you can contact our DPO. We will promptly investigate the concern and, if necessary, remove the child's personal data from our records and deactivate any associated accounts.

International Transfer of Data

Regardless of your country of residence or the origin of the information you provide, you consent to our use of your personal information in Canada or any other country where we conduct business. Your personal information may be gathered, transferred, and stored by us or our third-party service providers in the United States or various other countries.

Changes to Privacy Policy

This Privacy Policy may be amended by us from time to time. This may be done out of necessity (e.g., in order to reflect changes in the applicable laws) or if we change our business in a way that affects personal data protection.

Any changes will immediately be posted on our Service, and you will be deemed to have accepted the terms of the updated Privacy Policy on your first use of our Service following the amendments. Therefore, we strongly recommend you revisit this page and check our Privacy Policy regularly in order to keep up to date.

CASL Statement

Canada's Anti-Spam Legislation (CASL) is a federal law that regulates the sending of commercial electronic messages (CEMs), the installation of computer programs, and other digital communications to protect consumers from spam and online threats.

Prohibited Activities: CASL strictly prohibits: (i) misleading or false representations in online promotions of products and services; (ii) collecting or using personal information without the individual's consent; (iii) the distribution of spyware, malware, or other unauthorized technological intrusions.

Regulated Activities Requiring Prior Consent: Under CASL, the following activities require the prior express or implied consent of the recipient: (i) sending commercial electronic messages (CEMs); (ii) altering transmission data in electronic messages; (iii) installing software or programs on another person's device, including smartphones and computers.

At YOHO Experiences, we are committed to full compliance with CASL, including the rules governing the sending of CEMs through email, text messages, instant messages, and social media.

We communicate electronically with customers, business partners, and other third parties regarding our services, updates, promotions, and industry insights. These communications are sent only with express or implied consent as defined under CASL.

All electronic messages from YOHO Experiences will clearly identify the sender and purpose of the message, include an option to unsubscribe from future communications, and comply with CASL's requirements for commercial messaging.

Recipients may withdraw their consent at any time by clicking the unsubscribe link in an email or by contacting us at [email protected] with "Unsubscribe" in the subject line. Once an unsubscribe request is received, we will remove the recipient from our electronic communication lists within 10 days.

Quebec Privacy Notice

We issue this Quebec Privacy Notice to inform residents of Quebec about how we collect, use, disclose, and otherwise process their personal information, as well as the rights they may have under Quebec privacy laws ("Quebec Privacy Law").