Your privacy rights in Canada.

Accountability

UpTrip Inc. is accountable for personal information under its control, including information processed by service providers. The designated accountable person is the UpTrip Privacy Lead. Contact them through the tracked privacy channel or privacy@uptrip.com.

Purposes, collection and consent

UpTrip identifies purposes at or before collection, limits collection to what those purposes reasonably need, and distinguishes required from optional fields in the global notice. Optional provider connection requires express action and can be withdrawn. UpTrip will seek new consent before a materially different use unless law permits or requires it.

Use, disclosure and retention

Information is used and disclosed only for identified purposes, compatible purposes, or as law permits. UpTrip does not sell user data or use it for behavioural advertising. Published retention periods are enforced by a scheduled deletion job once production storage is activated.

Accuracy, safeguards and openness

Account holders can correct profile inputs and request correction of other records. UpTrip uses safeguards appropriate to the sensitivity of travel, loyalty and support information and publishes its service-provider register, matching logic, retention periods and complaint path.

Access and correction

Use Your Privacy Choices to access personal information, learn how it was used or disclosed, challenge accuracy, or request correction. Signed-in users may also use Data controls to download an automated export. UpTrip will explain any lawful refusal and available recourse.

Challenges and complaints

Select “Data-protection complaint” to challenge UpTrip’s compliance. The Privacy Lead records, investigates and communicates the outcome. You may contact the Office of the Privacy Commissioner of Canada or an applicable provincial commissioner.

Breaches

The UpTrip incident process requires every suspected safeguards breach to be assessed and recorded. When PIPEDA applies, the responsible operator must report and notify as soon as feasible if a breach creates a real risk of significant harm, and must retain every breach record for at least 24 months.