Privacy policy
Privacy policy
Version 1.2 · last updated November 14, 2026 · Niagara Falls Tour
- We collect what we need to take and run your booking: your name, email, phone, tour choices and pickup details. Your full card number goes straight to Stripe and never reaches us.
- We share it only with the companies that help us run your booking (card processing, email, hosting and our booking system provider), and with the operating partner that runs your tour.
- Some of these companies operate outside Canada, so your information may be stored or processed in other countries.
- The "Analytics" (Google Analytics) and "Marketing" (Google Ads and Meta) cookies load only if you agree, and never on the checkout or payment pages. Our own visit counter is always on. You can change your choice at any time with "Cookie settings" at the bottom of every page.
- You can ask to see or correct your information, or to withdraw a consent, by writing to info@niagarafallstour.com. You can also complain to the Privacy Commissioner of Canada.
1. Who is responsible and who to contact
Niagara Falls Tour (also operating as ToNiagara), 107 Sugarhill Dr, Brampton, ON L7A 3X3, Canada, is responsible for the personal information described here and follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Our privacy contact is the person we have made responsible for privacy:
Privacy contact, Niagara Falls Tour
107 Sugarhill Dr, Brampton, ON L7A 3X3, Canada
Email: info@niagarafallstour.com
Telephone: +1 800 653 2242
This policy covers this booking website (book.niagarafallstour.com). Our main website, niagarafallstour.com, is separate and may collect information in other ways. The booking system is provided by a third-party technology provider, which handles your information for us only as this policy describes.
2. What we collect and where it comes from
| Information | Where it comes from | Why we need it |
|---|---|---|
| Name, email address, mobile phone number (and whether it is on WhatsApp) | You, when you book | To identify your booking, send your confirmation and notices, and reach you on the day |
| Tour, date, add-ons, pickup point, pickup notes, special requests, number of guests in each age group | You, when you book | To run the tour, price it and look after your needs. Your special requests are shared with the driver and the operating partner. We do not collect the names or birth dates of other guests or children, only how many there are in each age group |
| Card details we keep: the card brand, last four digits, expiry month and year, and references at Stripe. Amounts, tax and refunds | You and Stripe, when you pay | To take payment, give refunds, keep tax records and deal with disputes. We never see or store your full card number or security code |
| Your agreement: the version of the Terms of booking, Privacy policy and Cancellation and refund policy you agreed to, the time you agreed, and your IP address (also kept in scrambled, hashed form). When a card is used, also the version of the card wording you saw | Our system, when you tick the box and send your request | To prove what you agreed to and when, in particular the card authorization |
| Technical details: IP address, approximate location, device, browser, language, time zone, pages visited and the site or advertisement you came from (see section 7) | Your browser and our hosting provider | To prevent fraud, handle your request and see which pages and links lead to bookings |
| A started booking, only if you tick the reminder box in the checkout: your email address, first name and your choices | You, as you fill in the checkout | To save your place and email you a link to finish. If you do not tick the box, nothing about a started booking is saved for reminders |
| A booking record (ours) and a customer record at Stripe (your name, email and phone only), made when you press the final button on a card checkout | You, at the card checkout | So the card step can be attached to your booking. If you do not finish it, the record is closed as an unfinished card step |
| A log of the emails we send you: the type, subject, address, time and whether it was delivered (not the full text) | Our system and our email providers | To show that we sent your confirmation and notices, and when |
| Messages, calls and WhatsApp conversations with us | You | To answer you and keep a record of changes and cancellations |
Please do not put sensitive details, such as health information or details about a child, in the special requests box unless you want us to act on them: what you write there goes to the driver and the operating partner. For a medical need, call +1 800 653 2242 instead.
3. Why we use your information
- to take, confirm, run, change and cancel your booking, and to take payments and give refunds;
- to send you your confirmation, receipts, payment notices and other messages about your booking;
- to answer your questions, handle complaints and deal with disputes and card chargebacks;
- to prevent fraud and misuse of our systems, and keep them secure;
- to keep tax and accounting records as the law requires;
- only if you tick the reminder box, to email you a link to finish a booking you started; and once after your tour, to ask how it went (see section 13);
- only if you agree, to measure our website and our advertising (see section 6).
We do not sell your information, and we do not use the details you give for a booking to send you marketing unless you separately ask us to.
4. Consent and how to withdraw it
We collect and use your information for a booking because you ask us to make one. Where we need your consent for something optional, such as the "Analytics" and "Marketing" cookies, we ask separately and you can say no without affecting your booking. You can withdraw a consent at any time:
- Cookies and tags: use "Cookie settings" at the bottom of every page. It does not switch off our own visit counter (see section 6); to object to that, write to us.
- Reminder emails: we send them only if you ticked the box beside them. Use the unsubscribe link in any of them: one click stops the emails.
- Anything else: write to info@niagarafallstour.com. If you withdraw consent for something we need to run a booking you have made, we may not be able to carry out the booking.
5. Who we share it with
We share information only as needed for the purposes above. We use companies as service providers and require them to protect it. We describe each role rather than naming every provider:
| Who | What they receive | Why |
|---|---|---|
| The operating partner that runs your tour, and its driver | What is needed to carry out the tour: lead guest name, phone number, number of guests, pickup address and time, add-ons, special requests and pickup notes, whether you use WhatsApp, and the booking reference | So they can pick you up and look after you. We may send the list by email, as a file, or as a WhatsApp message or link, in which case it passes through WhatsApp (Meta) |
| Our booking system provider: a third-party technology provider | The booking information you give us, as needed to run the booking system for us | To provide and support the booking system. It may use the information only for that purpose |
| Card processor: Stripe | Your name, email, phone, the booking reference, the tour date, amounts, and your card details (typed directly into Stripe's secure form). Stripe also collects device and browser data to prevent fraud | To save your card, hold or take payment, give refunds and prevent fraud. Stripe's privacy policy is at stripe.com/privacy |
| Email providers, including Google | The content of each email we send you (for example your name, booking details and the last four digits of your card), your address and the delivery result | To deliver our emails. A second sending service, run through Google, is a backup |
| Hosting and database provider: Cloudflare | Everything you send to this website, including your IP address, and it stores our booking database | To run this website and keep your booking |
| Our own team | Booking details, the technical details described in section 7, and our staff activity log. Access is limited by role | To run and support bookings |
| Professional advisers, authorities, card issuers and card networks | What the law requires, or our records of your booking and agreement if a charge is disputed | To meet legal duties, answer a dispute and defend claims |
Google (for Google Analytics and Google Ads) and Meta (for the Meta Pixel) receive information only if you agree to the matching cookies: "Analytics" for Google Analytics, "Marketing" for Google Ads and Meta. They never load on the checkout, payment or unsubscribe pages. They receive the page you view, your IP address, your device and browser details and the advertisement or link you came from. After you send a booking request they also receive a conversion event with our booking reference, the tour and the value and currency of the request. We do not send them your name, email address or phone number. If you choose to use the WhatsApp link, a Google Calendar link or, in our email after your tour, a Google review link, your information goes to that service when you click it. If our business were sold or reorganized, your information could pass to the new owner for the same purposes, under the same protections.
6. Cookies and similar technology
When you first visit, a banner tells you what we use and offers Accept all, Decline and Manage. "Analytics" (Google Analytics) and "Marketing" (Google Ads and Meta) stay off until you accept them, and closing the banner without choosing leaves them off. "Decline" switches off only those two. If your browser sends the Global Privacy Control signal, the first button becomes "Accept analytics" and "Marketing" stays off. Our own visit counter, described below, stays on whatever you choose. You can change your choice at any time with "Cookie settings" at the bottom of every page.
| What | What it does | How long | Needs your consent? |
|---|---|---|---|
| Cookie choice | Remembers your choice in the cookie banner. Set only after you choose. | Up to 365 days | No: it records your choice |
| Visit counter (browser storage) | Counts your visits and remembers a random visitor number, the dates of your first and last visit, the last 10 pages you viewed, your landing page, the site you came from and any campaign tags in the link. If your browser blocks that storage, a cookie of the same kind is used. We store this only with a booking, a started booking or an enquiry (see section 7). | Up to 395 days | We do not ask. It is on whatever you choose in the banner, to prevent fraud, run your booking and see which pages and links lead to bookings. If you object, tell us. |
| Booking form memory (session storage) | Keeps what you have typed in this browser tab so you do not lose it if the page reloads. Deleted when the booking is sent or the tab is closed. | While the tab is open | No: needed for the booking form |
| Confirmation and link helpers (session storage) | Show your confirmation page once, and carry the secure link from a payment or unsubscribe email. | Minutes, or while the tab is open | No: needed for the page to work |
| Campaign source (session storage; also a cookie if you accept "Marketing") | Remembers which link or advertisement brought you here, so a booking can be matched to it. | This tab; the cookie 90 days | The cookie: yes |
| Stripe's payment form | On the payment step Stripe's script runs to take your card securely and detect fraud, and it may store information in your browser. It loads only on the payment step. | Set by Stripe | No: needed for payment and fraud prevention |
| Google Analytics, Google Ads and Meta Pixel ("Analytics" and "Marketing") | Google Analytics counts visits and pages (cookies named _ga and _ga_ followed by an identifier). Google Ads and the Meta Pixel measure whether our advertising led to a booking request (cookies such as _gcl_au, _gcl_aw, _fbp and _fbc). They load only after you accept the matching choice, never on the checkout, payment or unsubscribe pages, and their cookies are removed if you withdraw. | Analytics cookies: up to 2 years. Marketing cookies: up to 90 days. | Yes |
7. Technical details we record with your request
When you send a booking request, start a booking or send an enquiry, we record technical details with it: your IP address; your approximate location (country, region, city and postal area, time zone and network, worked out from your IP address by our hosting provider); your device, browser and language; what your browser reports about itself (screen size, time zone, connection type, whether cookies or storage are blocked); and the information from the visit counter described above. If the link you came from carries an advertising click identifier, it is sent with the request even if you declined "Marketing".
We do this to prevent fraud, handle your request, and see which pages and links lead to bookings. Only our team sees these details, and the most restricted roles do not. They are not put in the emails we send you, and we do not use them to build advertising profiles.
After 395 days (about 13 months) we remove the IP address, the location, exact device details, the site you came from and the pages. We keep only coarse statistics: the device type, the operating system and browser family, the visit and page counts, whether you had agreed to cookies, and the campaign source, medium and name. The IP address recorded with your agreement is kept with the booking record as described in section 9.
8. Where your information is processed
Stripe, our email providers (including Google), Cloudflare, our booking system provider and, if you accept the matching cookies, Google and Meta operate in Canada, the United States and other countries. Your information may be transferred to, stored in and processed in countries outside Canada, including the United States. While it is in another country it is subject to the laws of that country, and courts, law enforcement and national security authorities there may be able to access it. We do not promise that your information is stored in Canada. We choose providers who commit to protecting it, and we remain responsible for it while it is with them.
9. How long we keep it
| Information | How long |
|---|---|
| A started booking that you did not send (only if you ticked the reminder box) | Removed 30 days after your last activity. When you send the booking, the started booking it came from is cleared at once |
| Technical details (IP address, location, exact device details, pages) | Removed after 395 days (about 13 months). Coarse statistics stay, as described in section 7 |
| Your phone number, pickup address and notes, special requests, internal notes and the IP address recorded with your agreement; your surname is cut to an initial. This also applies to a request or card step you did not complete | Removed 24 months after your tour date |
| An enquiry you send us (name, email, phone, message, technical details) | Removed 24 months after you send it |
| Our log of emails sent to you | About 13 months |
| Our staff activity log, with a scrambled form of the IP address | About 24 months |
| Sales and payment records: the booking, your first name and email address on it, the version of the legal pages you agreed to with the time, amounts, tax, refunds, and the card brand, last four digits and expiry date | 6 years, because tax law requires us to keep sales records. Requests that were declined, withdrawn or never paid are kept for the same time, so we can deal with a complaint or a dispute. After that we delete the records or remove your name and email address |
| Record that you unsubscribed (a scrambled form of your email address, not the address itself) | Kept so we do not email you again |
| Your saved card and your customer record at Stripe (name, email, phone) | The saved card is removed from Stripe if we cancel or decline your booking before it is paid, or if you withdraw it. After a paid booking it stays on file at Stripe, and we use it for nothing else, until we remove it at our yearly review of records or when you ask. Ask us and we will delete the card and the record |
We may keep information longer if the law requires it or if we need it for a complaint, a dispute or a legal claim, including a card chargeback. Stripe and our other providers keep information under their own policies and legal duties.
10. How we protect it
We protect your information with measures that fit how sensitive it is. Your card number goes straight to Stripe, and we never see or store it. This website uses an encrypted connection. Access for our team is limited by role and requires a sign-in link that expires. The links in our emails that let us confirm or decline a request are signed and can be used once. We try to collect only what we need and remove it when we no longer need it. No system is perfectly secure, and we cannot promise that information will never be lost or misused.
11. Your rights: access, correction and complaints
You can ask us what personal information we hold about you and how we have used it, to correct information that is wrong or incomplete, to delete or anonymize information we no longer need, and to stop optional uses by withdrawing your consent.
Write to info@niagarafallstour.com. We may ask you to prove who you are, so we do not give your information to someone else. We reply within 30 days, free of charge. If we need more time or have to refuse, we tell you why in writing. We cannot delete records that the law requires us to keep, such as sales records, or that we need to deal with a dispute, but we will tell you what we are keeping and why.
If you are not satisfied with our answer, you can complain to us, and you can complain to the Office of the Privacy Commissioner of Canada: 30 Victoria Street, Gatineau, Quebec K1A 1H3, www.priv.gc.ca.
12. Children
Bookings are made by adults aged 18 or older, and this website is not directed at children. We collect only the number of children and infants in your party, in age groups, and not their names or birth dates. We do not use information about children for advertising.
13. Email and Canada's anti-spam law
- Booking emails. We send confirmations, receipts, payment notices and links, cancellations and refund notices because they are part of your booking. They contain no promotions, and you receive them while a booking is open even if you have unsubscribed from reminders.
- Reminder emails. The checkout has a box that is not ticked for you: "Email me a reminder link if I do not finish". We send reminders only if you tick it, up to 4 emails over about 7 days. After your tour, we send one email asking how it went; it may have a Google review button. Each of these carries our name, our address and an unsubscribe link, and one click on it stops the emails straight away.
- No newsletter. We do not send newsletters or promotions. If we ever do, we will ask for your separate permission first, with a box that is not ticked for you.
14. If something goes wrong with your information
If a security incident puts your information at real risk of significant harm, we will tell you and the Privacy Commissioner of Canada as the law requires. We keep a record of security incidents.
15. Changes to this policy
We may change this policy, for example when we add a new service provider or turn on analytics or advertising tags. The version and date are at the top. If a change is material, we will say so on this page, and where the law requires your consent for a new use, we will ask for it.
16. Contact
Privacy contact, Niagara Falls Tour
107 Sugarhill Dr, Brampton, ON L7A 3X3, Canada
Telephone: +1 800 653 2242
Email: info@niagarafallstour.com
See also the terms of booking and the cancellation and refund policy.