1. Introduction

Welcome to CityCanvas Travel's Privacy Policy. This document outlines how we collect, use, and protect your personal information when you use our services. At CityCanvas Travel, we are committed to maintaining the privacy and security of your data while providing you with exceptional travel experiences. This policy explains your rights regarding your personal information and how we safeguard it in compliance with applicable privacy laws including the Australian Privacy Act 1988 and the EU General Data Protection Regulation (GDPR).

2. Information We Collect

To provide our travel services, we collect various types of information from you. This helps us understand your travel preferences and create personalized experiences.

2.1 Personal Information

We collect the following categories of personal information:

• Contact information (name, email address, postal address, phone number)
• Identification details (passport information, date of birth, nationality)
• Payment information (credit card details, billing address)
• Travel preferences (accommodation choices, dietary requirements, special assistance needs)
• Travel history and itineraries
• Loyalty program memberships

2.2 Automatically Collected Information

When you visit our website, certain information is automatically collected, including:

• IP address and device information
• Browser type and version
• Pages visited and interactions with our site
• Referral source and time spent on our website
• Location data (if enabled on your device)

3. How We Use Your Information

Your information allows us to provide and improve our services. We use your data for the following purposes:

3.1 Service Provision

• Processing travel bookings and arrangements
• Communicating with third-party providers (airlines, hotels, tour operators)
• Providing customer support and travel assistance
• Managing loyalty programs and benefits

3.2 Business Operations

• Processing payments and preventing fraud
• Analyzing travel trends and preferences
• Improving our website and services
• Training our staff to better serve you

3.3 Marketing and Communications

• Sending relevant travel offers and updates (with your consent)
• Inviting you to events and travel workshops
• Conducting customer satisfaction surveys
• Providing personalized content based on your preferences

4. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Contract fulfillment: Processing necessary to provide our travel services
• Legitimate interests: Improving our services, preventing fraud, and ensuring business continuity
• Legal obligations: Compliance with applicable laws and regulations
• Consent: Marketing communications and certain data collection activities

5. Data Sharing and Disclosure

To fulfill your travel needs, we share your information with specific third parties:

5.1 Travel Partners

We share relevant data with airlines, hotels, car rental companies, tour operators, and other service providers involved in your travel arrangements.

5.2 Service Providers

We work with payment processors, IT service providers, customer support services, and marketing platforms that require access to certain data to perform their functions.

5.3 Legal Requirements

We may disclose your information when required by law, court order, or government regulation, or to protect our rights or the safety of others.

5.4 Business Transfers

In case of merger, acquisition, or asset sale, your information may be transferred as part of the business assets, subject to the promises made in this Privacy Policy.

6. International Data Transfers

As a global travel agency, we may transfer your data across international borders to fulfill your travel arrangements. When transferring data outside Australia or the European Economic Area, we implement appropriate safeguards to ensure your data remains protected, including Standard Contractual Clauses approved by regulatory authorities and verifying that recipients maintain adequate data protection standards.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law. Typically, we keep your data for the following periods:

• Account information: As long as your account is active, plus 7 years
• Booking information: 7 years after completion of travel (for legal and tax purposes)
• Payment information: 7 years (for accounting purposes)
• Marketing preferences: Until you withdraw consent

8. Your Privacy Rights

Depending on your location, you may have various rights regarding your personal information:

• Access: Request copies of your personal data
• Rectification: Correct inaccurate or incomplete information
• Erasure: Request deletion of your data under certain circumstances
• Restriction: Limit how we use your data while its accuracy is verified
• Portability: Obtain and reuse your data across different services
• Objection: Contest our use of your data for legitimate interests
• Withdraw consent: Revoke permission previously given

To exercise these rights, please contact us at [email protected]. We will respond to your request within 30 days.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies to enhance your browsing experience. Cookies are small text files stored on your device that help us recognize you, remember your preferences, and improve our services.

9.1 Types of Cookies We Use

• Essential cookies: Required for website functionality
• Preference cookies: Remember your settings and preferences
• Analytics cookies: Help us understand how you use our website
• Marketing cookies: Track your online activity to deliver targeted advertising

9.2 Cookie Management

You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, this may impact your experience on our website, as some features may not function properly without cookies.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of sensitive data
• Secure Socket Layer (SSL) technology for data transmission
• Regular security assessments and penetration testing
• Access controls and authentication procedures
• Staff training on data protection and security practices

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We encourage you to take precautions when sharing personal information online.

11. Children's Privacy

Our services are not directed to individuals under 16 years of age, and we do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we will promptly delete it from our systems. If you believe that we might have collected information from a child, please contact us immediately.

12. Third-Party Links

Our website may contain links to third-party websites, products, or services. These third parties have separate and independent privacy policies. We have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated policy on our website with a revised "Last Updated" date. For significant changes, we will provide a more prominent notice, such as an email notification. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

14. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

CityCanvas Travel
410 Collins Street
Melbourne, VIC 3000
Australia

Email: [email protected]
Phone: +61 3 9001 5566

For data protection matters, you can contact our Data Protection Officer at [email protected].

15. Complaints

If you are concerned about a possible breach of privacy law or any other regulation, please contact us first so we can investigate and attempt to resolve your complaint. If you are not satisfied with our response, you have the right to complain to your local data protection authority.