Privacy Policy

WanderLux ("WanderLux", "we", "us") is a travel concierge business operating under TICO registration 4372512, held by our host agency, Plus Travel Group — a standard arrangement for independent travel advisors in Ontario, who sell under a host's TICO registration rather than obtaining their own. This policy explains what personal information we collect through wander-lux.ca and our client/supplier portal, why we collect it, and how it is protected. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

What we collect

If you sign up as a client: your first and last name, email address, job title, and industry, plus a password (see "How your password is protected" below).

If you sign up as a supplier: your business name, email address, and password, plus any privilege content (titles, descriptions, images) you submit for review.

If you contact us directly (email, phone, consultation): whatever information you choose to share about your travel plans and preferences, so that we can plan and coordinate your trip.

We do not currently process payments or bookings through this website. No payment card or banking information is collected by wander-lux.ca today. If that changes, this policy will be updated before it does, and any payment data will be handled by a PCI-compliant payment processor rather than stored by us directly.

To support your account, we also keep a record of how the portal is used: when you sign in, which device (for example, "Safari on iPhone") and which city and country the sign-in came from, which privileges you view, when you update your profile, and when your password is set or reset. We do not store your IP address in this record, and we record only which profile fields changed, never their contents. Only WanderLux administrators can see this record.

Why we collect it

• To create and secure your account, and to show you the right portal (supplier, client, or admin) once you are approved
• To let suppliers submit offers and clients view offers WanderLux has approved
• To plan, coordinate, and communicate with you about your travel arrangements
• To help you if something goes wrong with your account, such as a sign-in problem or a missed request, using the activity record described above
• To meet our obligations as a TICO-registered travel business

Who sees it

Client and supplier profile information is used internally by WanderLux to operate the portal and is not sold to third parties. To arrange an actual trip, relevant details are necessarily shared with the specific hotels, airlines, tour operators, or other suppliers involved in that trip — only what each supplier needs to fulfill their part of the booking.

This site loads fonts from Google Fonts and, on the marketing pages, some images hosted by Unsplash. Loading these involves your browser making a request to those services, in the same way any embedded third-party content does; we do not use them to track visitors.

How your password is protected

We never store your password itself. It is passed through PBKDF2-SHA256, a one-way hashing algorithm, 100,000 times with a random value unique to your account, and only the resulting hash is stored — the same design used by major identity providers. Login attempts are rate-limited, and a session is immediately revoked the moment an account's status changes.

How long we keep it

We keep account and booking-related information for as long as your account is active and as long afterward as needed to meet legal, accounting, or TICO record-keeping obligations, then delete or anonymize it. The sign-in and browsing activity record is kept for 180 days and then deleted automatically.

Your rights

Under PIPEDA, you can ask to see the personal information we hold about you, ask us to correct it, or withdraw consent for us to use it (which may limit what we can do for you, such as completing a booking already in progress). To do any of these, email info@wander-lux.ca.

Questions or concerns

Our Privacy Officer can be reached at info@wander-lux.ca. If you believe we have not resolved a privacy concern appropriately, you may contact the Office of the Privacy Commissioner of Canada.