DRAFT — pending Capt. Cory Burry’s sign-off. This is the proposed version 2 of the CAC privacy policy, prepared by Legal & Counsel for the move to Cloudflare. Bracketed notes are open items. It is not yet in effect.

Privacy Policy

Canadian Adventure Charters Inc.
Effective date: October 9, 2026
Last updated: [LAST UPDATED DATE]

DRAFT v2 (update to the policy published October 9, 2026, for the move off WordPress to Cloudflare and for planned bookings of expeditions, survival training courses and wellness sessions). Not published. Items marked [COUNSEL REVIEW], [DEPLOY DEPENDENCY], [CONFIRM …], [Risk & Safety to review] or [Marketing to review] must be resolved, and the bracketed notes removed, before this goes live. Cory signs off.

1. Who we are

This policy explains how Canadian Adventure Charters Inc. ("CAC", "we", "us") collects, uses, shares and protects personal information through cacsd.ca and in our dealings with customers, people interested in our planned expeditions, survival training courses and natural healing and wellness sessions, job applicants and others.

  • Canadian Adventure Charters Inc., a Newfoundland and Labrador corporation (registry no. 93097, BN 791316755)
  • 4 Northwest Rd / PO Box 2002, Marystown, NL A0E 2M0, Canada
  • Phone: 709-743-0602 | Email: info@cacsd.ca

CAC is the organization responsible for your personal information (the "controller" under European and UK law).

We follow Canada's federal privacy law for the private sector, the Personal Information Protection and Electronic Documents Act (PIPEDA), and Canada's Anti-Spam Legislation (CASL). Section 13 explains additional rights for visitors from the European Union, the United Kingdom and the United States. [COUNSEL REVIEW: confirm PIPEDA is the governing Canadian statute for all CAC activities and that no provincial law applies in addition.]

Our services are planned, not yet running. Expeditions, tours, charters, dives, survival training courses and natural healing and wellness sessions described on our site are planned. We are not currently taking bookings. Where this policy mentions bookings, payments or waivers, it describes how we will handle that information once bookings open.

Adults only. Our services are for adults 19 and over. We do not knowingly collect personal information from anyone under 19. If we learn that we have, we will delete it.

2. Our privacy officer (accountability)

Cory Burry, President & CEO, is responsible for our compliance with this policy.

Privacy Officer: Cory Burry, President & CEO, Canadian Adventure Charters Inc., PO Box 2002, Marystown, NL A0E 2M0 | info@cacsd.ca | 709-743-0602

We are responsible for personal information in our control, including information we pass to service providers to process for us. We use contracts and other means to require those providers to protect it.

3. What we collect and why (identifying purposes, limiting collection)

We collect only what we need for the purposes below, and we tell you the purpose at or before the time we collect it.

Information Why we collect it
Contact and inquiry forms: name, email, phone, your message To answer your question.
Booking-interest form (planned 2027 season): name, email, phone, location, the tour or activity you are interested in, preferred dates, group size [Marketing to review] To answer your interest, plan capacity and, only if you tick the optional box, follow up by email about your inquiry or the planned 2027 season.
Bookings (when they open) for expeditions, survival training courses and wellness sessions: name, contact details, participants, dates, emergency contact, and any information needed for safety To deliver the service you booked and keep participants safe.
Wellness and natural healing session intake forms (when bookings open): health information you choose to give us, such as relevant conditions, injuries, allergies, medications, pregnancy and other information needed to decide whether and how a session can be delivered safely [Risk & Safety to review] Only to deliver your session safely and record what was done. Seen only by CAC's executive leadership and your practitioner. See section 5.
Waivers and safety information [Risk & Safety to review] To record your acknowledgement of risks and to meet our safety and legal obligations. See section 5.
Job applications (pilots, crew, staff): CV (stored in private, access-controlled cloud storage), contact details, licences, certifications, references, and where needed for the role, passport or ID copies and medical certificates [Risk & Safety to review] To assess your application and verify that you meet legal, licensing and safety requirements for the role. Kept no longer than 12 months after our decision (see section 5).
Payment information (when bookings open for expeditions, courses and wellness sessions): name, email, amount, currency, payment status, transaction ID and limited card details (such as card brand and last four digits) from our payment processor To take and refund booking payments and keep financial records. Card details are handled by our payment processor. We do not see or store full card numbers.
Email correspondence To communicate with you and keep a record of our dealings.
Website and device data: IP address, browser and device type, pages visited, approximate location, security signals from our bot check (Cloudflare Turnstile), cookies [Marketing to review] To keep the site secure and working and block spam and bots, and, only if you accept analytics cookies, to understand how the site is used. See section 7.

4. Consent

We ask for your consent before collecting, using or sharing your personal information, except where the law allows or requires otherwise (for example, to comply with a legal obligation or to protect someone's safety in an emergency).

  • Express consent is used for sensitive information (passports, medical information, and health information on wellness session intake forms), for follow-up emails you opt in to, and for analytics cookies.
  • Implied consent may apply where the purpose is obvious and the information is not sensitive, for example using your email address to reply to a message you sent us.

You may withdraw consent at any time, subject to legal or contractual limits, by contacting info@cacsd.ca. We will tell you what withdrawing consent means for you (for example, we may be unable to process a job application without required documents). [COUNSEL REVIEW]

5. Sensitive information: passports, medical and health information, and waivers

[Risk & Safety to review]

Passport or ID copies and medical information are sensitive. We collect them only when they are needed for a specific role or activity (for example, aviation medical certificates for pilots, or health information needed to take part safely in an activity). We:

  • ask for them only at the stage they are actually needed, not with a first application where possible;
  • allow access only to CAC's executive leadership (see section 9);
  • store them in access-controlled, encrypted storage, not in shared folders or general email where avoidable;
  • do not use them for any other purpose.

Retention:

  • Job applications: applications and all attached documents, including passport and medical documents and CVs submitted through our website, are kept for no more than 12 months after the hiring decision and then securely deleted. [DEPLOY DEPENDENCY: automatic deletion of website CV files and form entries]
  • Hired staff and crew: once someone is hired, their application documents become part of their employment records. [COUNSEL REVIEW: employment records are governed by separate legal retention rules (employment standards, tax, and Transport Canada aviation and marine record-keeping); set those periods in an internal retention schedule and confirm the 12-month applicant limit does not conflict with them.] [Risk & Safety to review]
  • Waivers and incident records: kept for 7 years after the activity date, or longer if our insurer or an actual or potential legal claim requires it, and then securely deleted. [COUNSEL REVIEW: confirm 7 years against the NL Limitations Act and insurer requirements.]
  • Medical information given for a booked activity: deleted after the activity unless it forms part of an incident record. [Risk & Safety to review]
  • Wellness and natural healing session intake forms and session notes: kept for [RETENTION PERIOD] after your last session, then securely deleted. [COUNSEL REVIEW: retention period, and whether any practitioner's professional or regulatory rules set a minimum] [Risk & Safety to review]

Wellness and natural healing sessions. [Risk & Safety to review] Health information collected for a wellness or natural healing session (intake forms and session notes) is sensitive. We collect it only with your express consent, use it only to deliver your session safely, and limit access to CAC's executive leadership and the practitioner delivering your session. We do not use it for marketing, we do not share it with our related brands, and we do not share it with anyone else unless you ask us to or the law requires it (for example, in an emergency). You may decline to answer any question, but we may then be unable to offer a session safely.

6. How we use and share information (use, disclosure, retention)

We use personal information only for the purposes we identified, or for a new purpose you consent to. We do not sell or rent personal information, and we do not share it for cross-context behavioural (targeted) advertising.

Service providers. We use trusted providers to run our business. They may process personal information only on our behalf and under our instructions:

Provider What they do Where data may be processed
Cloudflare, Inc. (Workers, D1 database, R2 storage, Access, Turnstile, Email Routing) Hosts our website; stores website form entries (D1) and CVs from job applications (R2); protects our admin tools (Access); bot and spam checks (Turnstile); security and content delivery; forwards website notifications to our business email [DEPLOY DEPENDENCY: confirm D1 and R2 are still used for site forms at publication] Database and file storage: North America, which may include the United States [CONFIRM D1 LOCATION] [CONFIRM R2 LOCATION]. Security and delivery: Canada, the United States and other countries
Zoho Business email Canada or the United States [CONFIRM ZOHO REGION]
Google LLC (Google Analytics 4) Website usage statistics, only if you accept analytics cookies United States and other countries
Stripe (Stripe, Inc. and its affiliates), when bookings open Takes payments for bookings of expeditions, survival training courses and wellness sessions; processes refunds and disputes. Stripe also uses payment data as an independent controller for its own purposes, such as fraud prevention and legal compliance, under its own privacy policy (stripe.com/privacy) United States, Canada and other countries [DEPLOY DEPENDENCY: keep this row only if Stripe is live for bookings at publication; otherwise revert to "Payment processor (when bookings open)"]
PayPal (only if we use it as a backup for bookings) Alternative payment processor for bookings United States, Canada and other countries [DEPLOY DEPENDENCY: remove this row if PayPal is not enabled]

Related brands. CAC is associated with related brands and ventures: RedHawk Survival, Continental Climate Construction and TerraMaris Club. We do not currently share customer personal information with any of them, and we do not receive customer personal information from them. If that changes, we will update this policy first and obtain your consent where the law requires it. [COUNSEL REVIEW: confirm this matches actual practice, including shared inboxes, devices and backups.]

Other disclosures. We may disclose personal information where required or permitted by law, for example to comply with a court order, to cooperate with authorities investigating an incident, to Transport Canada or other regulators where the law requires, to our insurers and professional advisers, to emergency services when someone's health or safety is at risk, or as part of a sale or reorganization of the business under appropriate confidentiality protections. [COUNSEL REVIEW]

Retention. We keep personal information only as long as needed for the purpose it was collected for, or as the law requires, and then securely delete or anonymize it. In general:

  • inquiry emails and contact-form entries: about 2 years after our last contact;
  • booking-interest form entries: until the end of the planned 2027 season or until you ask us to remove them, whichever is first;
  • payment and refund records (bookings): as required by tax law (generally 6 years after the end of the tax year);
  • others as stated in section 5.

[COUNSEL REVIEW: the general retention periods; the 6-year tax period] [DEPLOY DEPENDENCY: automated deletion jobs in D1 and R2]

7. Cookies and analytics

[Marketing to review] [DEPLOY DEPENDENCY: the WordPress cookie banner (Complianz) and Google Analytics do not carry over to the new Cloudflare site. The migrated preview has no cookie banner and no Google tags. Pick Option A or Option B below before launch and delete the other.]

Our website uses cookies and similar technologies:

  • Essential cookies and security checks make the site work and keep it secure. These do not need your consent. They include:
  • Cloudflare security cookies;
  • Cloudflare Turnstile, our spam and bot check on forms. It processes your IP address, browser (TLS) fingerprint, user agent and the site key to tell people from bots. It does not read what you type into our forms. Cloudflare acts as our service provider for this, and also as a controller of these signals for improving its bot detection (see Cloudflare's Turnstile Privacy Addendum). Turnstile normally issues a one-time token rather than a cookie, but in some configurations it may set a short-lived Cloudflare security cookie [CONFIRM AFTER DEPLOY CHECK: pre-clearance off; list any cookie actually set];
  • Cloudflare Access sign-in cookies (such as CF_Authorization), set only for CAC staff signing in to our admin tools.

Option A: if Google Analytics 4 is re-installed with a consent banner on the new site

  • Analytics cookies (Google Analytics 4): set only if you accept them in our cookie banner. [DEPLOY DEPENDENCY: consent-first banner re-implemented on the Cloudflare site, with GA4 blocked until opt-in (Google Consent Mode v2, basic mode).] Google Analytics 4, provided by Google LLC (United States), tells us in aggregate how visitors use the site: for example, pages viewed, time on page, how you reached the site, browser and device type, and approximate location (city or region) derived from your IP address. Its cookies (such as _ga) can last up to 2 years. We use this information to improve the site, not to identify you personally.
  • Google Analytics 4 is the only analytics tool on our site. We do not use advertising, retargeting or social-media tracking pixels, and we do not use analytics data for advertising.
  • Your choices:
  • Accept or reject analytics cookies in our cookie banner, and change your choice at any time using the Cookie settings link at the bottom of every page.
  • Block or delete cookies in your browser settings. Blocking essential cookies may affect how the site works.
  • Opt out of Google Analytics across websites with Google's browser add-on (tools.google.com/dlpage/gaoptout).

Option B: if the new site launches without analytics

  • We do not currently use analytics, advertising, retargeting or social-media tracking cookies or pixels. If we add analytics later, we will ask for your consent first and update this policy.
  • Your choices: you can block or delete cookies in your browser settings. Blocking essential cookies may affect how the site works.

8. Follow-up emails (CASL)

[Marketing to review]

We send follow-up emails about your inquiry or our planned 2027 season only if you give us express consent by ticking the optional, unticked box on our forms, or where CASL otherwise allows. [COUNSEL REVIEW: confirm when a direct reply to an inquiry falls outside CASL consent rules.] Every such email will:

  • identify Canadian Adventure Charters Inc. as the sender, with our mailing address and contact details; and
  • tell you how to unsubscribe.

You can unsubscribe at any time by emailing info@cacsd.ca or using the unsubscribe method in the email. We will process your request within 10 business days. Unsubscribing does not stop messages needed for a service you booked (for example, booking confirmations or safety information).

9. How we protect information (safeguards)

We protect personal information with safeguards suited to its sensitivity, including:

  • restricted access: only CAC's executive leadership can access customer, applicant, waiver and medical files; wellness intake forms and session notes are also available to the practitioner delivering your session; general employees cannot;
  • password-protected accounts with two-factor authentication where available;
  • encrypted connections (HTTPS) on our website;
  • our admin tools are behind Cloudflare Access, which allows sign-in only for approved staff email addresses;
  • CVs are kept in private cloud storage that is not publicly reachable;
  • stronger controls for passports and medical information, including encrypted storage (see section 5);
  • confidentiality obligations for anyone with access, including contractors; and
  • secure deletion when information is no longer needed.

No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and report it to the Office of the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires, and we keep a record of every breach for at least 24 months. Where European or UK law applies, we will also notify the relevant supervisory authority as that law requires. [COUNSEL REVIEW]

10. Accuracy

We try to keep personal information accurate and up to date for its purpose. Please tell us if your details change.

11. Your rights: access and correction

You can ask to see the personal information we hold about you, how we have used it and who we have shared it with, and ask us to correct anything inaccurate. Send your request to our Privacy Officer at info@cacsd.ca. We may need to verify your identity.

We will respond within 30 days. If we need more time, as PIPEDA allows in limited cases, we will tell you why. Access is normally free; if there is a cost, we will tell you first. If we refuse a request in whole or part, we will explain why, as the law allows in certain cases (for example, where information about another person would be revealed, or where it is legally privileged).

12. Questions and complaints (challenging compliance)

If you have a question or concern about how we handle your information, contact our Privacy Officer at info@cacsd.ca first. We will investigate and respond, and if your complaint is justified we will fix the problem.

You also have the right to complain to the Office of the Privacy Commissioner of Canada: www.priv.gc.ca | 1-800-282-1376 | 30 Victoria Street, Gatineau, QC K1A 1H3.

13. Visitors from outside Canada

We plan to welcome visitors from around the world.

International transfers

We are based in Canada. Our website, database and file storage run on Cloudflare's network, and our records are held by us and our providers in Canada and the United States (see section 6). Information processed in another country may be accessible to its courts, law enforcement and national security authorities under that country's laws.

  • EU/UK to Canada: the European Commission and the UK recognize Canada as providing adequate protection for organizations subject to PIPEDA.
  • To the United States: where a provider is certified under the EU-US Data Privacy Framework (and its UK Extension), we rely on that certification; otherwise we use the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data) or another lawful transfer mechanism. [COUNSEL REVIEW: confirm each provider's DPF status (Cloudflare, Stripe, Zoho, and Google if Option A) and that their data processing terms are accepted.]

EU and UK visitors (GDPR and UK GDPR)

Controller: Canadian Adventure Charters Inc. (contact details in section 1). Privacy questions: info@cacsd.ca.

EU/UK representative: [COUNSEL REVIEW: decide whether CAC must appoint a representative under Article 27 of the GDPR / UK GDPR; if so, insert their name and contact details here.]

Legal bases. We process your personal information on these bases:

Purpose Legal basis
Answering your inquiry or booking-interest form Our legitimate interests in responding to you, or steps you ask us to take before a contract
Follow-up emails about your inquiry or the planned 2027 season Consent
Analytics cookies (Google Analytics 4, only if Option A in section 7 applies) Consent
Essential and security cookies, site security and fraud prevention Legitimate interests in running a safe, working website
Bookings, payments and delivering services (when bookings open) Contract
Booking payments, refunds and payment records (when bookings open) Contract; legal obligation (tax and accounting records)
Wellness and natural healing session intake forms and notes Your explicit consent, and contract (delivering the session you booked) [COUNSEL REVIEW: Article 9 condition for health data]
Spam and bot checks (Cloudflare Turnstile) Legitimate interests in protecting our website and forms
Waivers, incident records, tax and regulatory records Legal obligation, and legitimate interests in establishing or defending legal claims
Job applications Steps you ask us to take before an employment contract, and legitimate interests in hiring
Health and identity information needed for safety or a role Your explicit consent, or where needed for employment and legal obligations [COUNSEL REVIEW: Article 9 condition for health data]

Your rights. Subject to legal limits, you have the right to:

  • access your personal information;
  • have it corrected (rectification);
  • have it erased;
  • restrict how we use it;
  • receive it in a portable format (portability);
  • object to processing based on our legitimate interests; and
  • withdraw consent at any time, without affecting processing already done.

To exercise these rights, email info@cacsd.ca. We will respond within one month, or tell you if we need more time as the law allows. You also have the right to complain to the data protection supervisory authority in your EU country, or to the UK Information Commissioner's Office (ico.org.uk).

United States visitors

Depending on your state of residence (for example California, Virginia or Colorado), you may have the right to:

  • know what personal information we collect, use and disclose, and to access it;
  • delete it;
  • correct it; and
  • opt out of the sale of your personal information, or its sharing for cross-context behavioural advertising.

We do not sell your personal information and do not share it for cross-context behavioural advertising. To make a request, email info@cacsd.ca. We will verify your identity and will not treat you differently for using your rights. If we decline your request, you may appeal by replying to our decision. [COUNSEL REVIEW: most US state privacy laws apply only above revenue or data-volume thresholds that CAC may not meet yet; confirm which, if any, apply and adjust this section.]

14. Links to other sites

Our site may link to other websites, including those of our related brands, partners and social media. Their privacy practices are their own; please read their policies.

15. Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date, and where changes are significant we will take reasonable steps to let you know.

16. Contact us

Privacy Officer: Cory Burry, President & CEO
Canadian Adventure Charters Inc.
PO Box 2002, 4 Northwest Rd, Marystown, NL A0E 2M0
info@cacsd.ca | 709-743-0602