Privacy Policy

Cargill Gordon Private Travel Atelier is committed to protecting your personal information with the same discretion and care we bring to every journey we curate. This Policy explains what we collect, how we use it, and the rights you hold — clearly and without ambiguity.

I.Information We Collect

We collect only what is necessary to provide you with an exceptional, personalised service. We do not collect data indiscriminately.

Information You Provide Directly

• ·Contact details: full name, email address, telephone number, and city of residence.
• ·Travel Portrait responses: number of travellers, travel dates, travel style preferences, preferred accommodation types, budget range, destination wish-list, and your description of your ideal journey.
• ·Inner Circle membership: first name, email address, and travel interest preferences.
• ·Journal contributions: author name, email address, story content, author biography, and any photographs you choose to submit.
• ·Correspondence: any information you share in emails, consultation calls, or other communications with us.

Information Collected Automatically

• ·Technical data: IP address, browser type and version, operating system, referring URLs, and pages visited.
• ·Usage data: time spent on pages, links clicked, and general interaction patterns.
• ·Cookies: session cookies required for Site functionality, and analytics cookies used to understand visitor engagement. See Section 7 for full details.

II.How We Use Your Information

We use your personal information for the following purposes, each grounded in a lawful basis under PIPEDA:

• ·To respond to your consultation request and prepare a bespoke travel proposal tailored to your preferences.
• ·To deliver The Inner Circle correspondence to members who have explicitly requested it.
• ·To review and, where appropriate, publish contributions to The Journal with your consent.
• ·To communicate with you regarding your journey, itinerary, or any related matter.
• ·To improve and maintain our Site, including diagnosing technical issues and understanding how visitors navigate our content.
• ·To fulfil our legal and regulatory obligations under applicable Canadian law.
• ·To protect the security and integrity of our Site and business operations.

III.Legal Basis for Processing

Our processing of personal information complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Our lawful bases include:

• ·Consent: You have given explicit consent when completing the Travel Portrait form, subscribing to The Inner Circle, or submitting a Journal contribution. You may withdraw consent at any time (see Section 8).
• ·Contractual necessity: Processing is necessary to provide the travel advisory services you have requested.
• ·Legitimate interests: We process limited technical data to operate and improve our Site, provided this does not override your privacy rights.
• ·Legal obligation: We may process data as required to comply with Canadian laws and regulatory requirements.

IV.Disclosure of Your Information

We may share your information only in the following limited circumstances:

• ·Service providers: Trusted third-party providers who operate our Site infrastructure — including Supabase (database), Resend (email delivery), and Calendly (scheduling). These providers act as data processors on our behalf and are contractually prohibited from using your data for any other purpose.
• ·Virtuoso Network: As an accredited Virtuoso member, we may share booking-related information with Virtuoso partner properties solely to fulfil your journey. We share only what is necessary.
• ·Travel suppliers: Airlines, hotels, cruise lines, ground handlers, and other suppliers necessary to confirm and deliver your journey. You will be informed of any such sharing in advance.
• ·Legal compliance: Where required by law, court order, or government authority to protect rights, safety, or property.
• ·Business continuity: In the event of a sale or merger, your information may be transferred to a successor entity with equivalent privacy protections. You will be notified in advance.

V.International Data Transfers

Our Site is hosted using cloud-based infrastructure that may process data in the United States and other jurisdictions outside Canada. Where data is transferred internationally, we ensure adequate safeguards are in place consistent with PIPEDA requirements.

• ·Supabase (database and storage): Infrastructure hosted in the United States. SOC 2 Type II certified with enterprise-grade security.
• ·Resend (email delivery): Transactional email processing under appropriate data processing agreements.
• ·Calendly (scheduling): GDPR-compliant platform with adequate protections for international data transfers.

VI.Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• ·Travel Portrait enquiries: 3 years from date of submission, or the duration of our client relationship — whichever is longer.
• ·Client journey records: 7 years to comply with Canadian financial and regulatory record-keeping requirements.
• ·Inner Circle membership: Until you unsubscribe. Email addresses are removed from active lists within 30 days of unsubscription.
• ·Journal contributions: Published contributions retained indefinitely unless removal is requested. Unpublished submissions deleted after 12 months if not accepted.
• ·Technical and analytics data: 12 months on a rolling basis.
• ·Correspondence: 5 years from the date of last communication.

VII.Cookies & Tracking Technologies

Our Site uses cookies — small text files placed on your device when you visit. We use the following categories:

• ·Essential cookies: Required for the Site to function correctly. These cannot be disabled without impacting Site usability. They do not collect personal information for marketing purposes.
• ·Analytics cookies: Privacy-respecting analytics to understand page visits, dwell time, and navigation patterns. Data is aggregated and does not identify you personally.
• ·Preference cookies: Used to remember your choices, such as whether you have previously dismissed the consent banner.

You may control cookies through your browser settings. A cookie preference banner is displayed on your first visit; your choice is recorded and respected on subsequent visits.

VIII.Your Rights & Choices

Under PIPEDA and applicable Canadian privacy law, you have the following rights:

• ·Right of access: You may request a copy of the personal information we hold about you at any time.
• ·Right to correction: You may request that we correct any inaccurate or incomplete personal information.
• ·Right to withdraw consent: You may withdraw your consent to our processing at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
• ·Right to deletion: You may request that we delete your personal information, subject to our legal obligations to retain certain records.
• ·Right to opt out of The Inner Circle: Every correspondence includes an unsubscribe link. You may also contact us directly.
• ·Right to lodge a complaint: You have the right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, please contact us using the details in Section 11. We will respond within 30 days of receiving your request.

IX.Security of Your Information

We implement industry-standard administrative, technical, and physical safeguards to protect your personal information:

• ·Encrypted data transmission (TLS/HTTPS) for all information submitted through our Site.
• ·Encrypted storage of personal data within our database infrastructure.
• ·Access controls limiting personal data access to authorised personnel only.
• ·Regular security reviews of our third-party service providers.
• ·Secure deletion protocols for data that has reached the end of its retention period.

No method of electronic transmission or storage is 100% secure. In the event of a privacy breach posing a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required by law.

X.Children's Privacy

Our Site and services are not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a person under 18, please contact us immediately and we will delete it promptly.

XI.Contact Information

For all privacy-related enquiries, requests, or concerns, please contact our Privacy Officer:

We endeavour to respond to all privacy enquiries within 30 days. For complex requests, we will acknowledge receipt within 5 business days and advise you of any extension required.

XII.Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will:

• ·Update the "Last Updated" date at the top of this Policy.
• ·Post a prominent notice on our Site for a minimum of 30 days following any material change.
• ·Notify Inner Circle members by correspondence if changes materially affect how we handle their information.

Your continued use of our Site or services after the effective date of any changes constitutes your acceptance of the revised Policy.