Privacy Policy

Last updated: August 31, 2026

This Privacy Policy describes how Ali Travel Inc., operating as Maplelux Holidays ("Maplelux Holidays", "we", "us" or "our"), collects, uses, discloses and protects your personal information. We are a travel wholesaler and retailer registered with the Travel Industry Council of Ontario (TICO Registration #50025124 (Retailer) and #50026847 (Wholesaler)), with our head office at 350 Hwy 7, Unit 304, Richmond Hill, Ontario L4B 3N2, Canada.

We handle personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair-information principles, the record-keeping requirements that apply to Ontario travel registrants under the Travel Industry Act, 2002 and its regulations, Canada's Anti-Spam Legislation (CASL) for commercial electronic messages, and, where they apply to a customer's information, provincial private-sector privacy laws (such as Quebec's privacy legislation for Quebec residents). By using our website, visiting our stores, or booking travel services with us, you consent to the practices described in this Policy.

1. Personal Information We Collect

Arranging travel requires more personal information than most purchases. Depending on the services you book, we may collect:

• Identity information — full legal name (as it appears on travel documents), date of birth, gender, nationality;
• Travel document information — passport number, issuing country and expiry date, visa details, and trusted-traveller numbers where applicable;
• Contact information — mailing address, email address and telephone numbers, and emergency-contact details;
• Booking information — itineraries, travel dates, room and seating preferences, frequent-flyer or loyalty numbers, and the names and details of people travelling with you;
• Payment information — payment card details are collected and processed by our PCI-DSS-compliant payment processor; we do not store full card numbers on our own systems. We retain transaction records (amount, date, authorization reference and last digits of the card);
• Health, dietary and accessibility information — only where you volunteer it so that we can arrange appropriate services (for example special meals, mobility assistance or medical clearances). This is sensitive information and we collect it only with your express consent;
• Account and sign-in information — your customer account details and, where you choose these sign-in methods, passkey (WebAuthn) public-key credentials stored for your device, or the name, email address and account identifier that Google provides when you use Google Sign-In (we never receive or store your Google password);
• Communication records — correspondence with our staff and records of consents you have given;
• Website and technical information — IP address, device and browser information, pages viewed and referring pages, collected through cookies and similar technologies (see Section 7).

If you provide personal information about other travellers (for example family members in your booking), you confirm that you are authorized to do so on their behalf and that they have been made aware of this Policy.

2. How We Collect It

We collect personal information directly from you — in our stores, by phone or email, and through this website and its booking forms — and, where applicable, from your travel agent, from people who book on your behalf, and from our service suppliers in the course of delivering your trip.

3. How We Use Your Information

We use personal information for the following purposes:

• to arrange, book and deliver the travel services you request — including reservations with airlines, hotels, cruise lines, tour operators and other suppliers;
• to process payments, deposits and refunds, and to issue invoices and travel documents;
• to assist with visa applications, travel insurance and other ancillary services you request;
• to communicate with you about your booking — confirmations, schedule changes, travel advisories and other service messages;
• to meet our legal and regulatory obligations, including the customer-transaction record-keeping required of TICO registrants and tax record-keeping required by Canadian law;
• to detect and prevent fraud, payment abuse and misuse of our services;
• with your consent, to send you promotions, newsletters and travel offers (see Section 8);
• with your express consent, to feature your reviews, testimonials or travel photos in our marketing (including this website and social media) — consent you may withdraw at any time, after which we will stop new uses of that content; and
• to understand how our website is used and to improve our services (see Section 7).

We do not sell, rent or trade your personal information.

4. Consent

We collect, use and disclose personal information with your consent, or as permitted or required by law. Consent may be express (for example when you complete a booking form) or implied (for example when the purpose is obvious and you volunteer the information). By making a booking, you consent to the collection, use and disclosure of the information reasonably required to deliver the travel services you have purchased.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice; however, withdrawing consent that is necessary to deliver booked services may mean we are unable to complete or maintain your booking. Bookings for travellers under the age of majority must be made by a parent or guardian, who provides consent on the minor's behalf.

5. When We Share Your Information

We disclose personal information only for the purposes described above, to:

• travel suppliers whose services you book — airlines, hotels, cruise lines, tour and ground operators, transfer companies and activity providers;
• government and border authorities in Canada and in the countries you travel to or through, where disclosure is required for advance passenger information, customs, immigration, visa or security screening purposes;
• insurers and insurance administrators, where you purchase travel insurance or make a claim;
• payment processors and financial institutions, to process your payments;
• service providers who support our business (such as IT hosting, email delivery and analytics providers) under obligations to protect your information and use it only on our instructions;
• regulators and legal authorities — including TICO — where disclosure is required or authorized by law, and where necessary to establish or defend legal claims.

6. Transfers Outside Canada

Because travel is international by nature, your personal information is necessarily transferred to suppliers and authorities in the destinations you visit and in countries your itinerary passes through, and some of our service providers may store or process information outside Canada — for example our email-delivery provider and, where you use it, Google Sign-In (with processing in the United States and the European Union). Payment card processing is performed in Canada by Moneris. Information held outside Canada is subject to the laws of those jurisdictions and may be accessible to their courts, law-enforcement and national-security authorities. Where the transfer is not necessary to deliver your booking, we use contractual and other safeguards designed to provide protection comparable to that required under Canadian law.

7. Cookies & Website Analytics

Our website uses cookies and similar technologies. Essential cookies are required for the site to function (for example keeping your booking session active and remembering your cookie choices). Non-essential categories (preferences, analytics, marketing) load only with your consent, which you give or refuse through the cookie banner on this site and can change at any time; at present we do not run any third-party analytics or advertising trackers on this website, and if we introduce one in the future it will operate only with your consent and be described in our Cookies Policy. Some page resources — such as web fonts and the optional Google Sign-In component — are delivered from third-party servers (including Google), which necessarily receive your IP address and standard browser information when those resources load. You can also manage cookies through your browser settings.

8. Marketing Communications

In compliance with CASL, we send commercial electronic messages (such as promotions and newsletters) only where we have your express or implied consent. Every marketing email we send includes our identification and a working unsubscribe mechanism; unsubscribe requests are honoured promptly. Withdrawing marketing consent does not affect service messages relating to bookings you have made.

9. How We Protect Your Information

We maintain physical, organizational and technological safeguards appropriate to the sensitivity of the information we hold, including encrypted transmission (HTTPS) on our website, access controls that limit personal information to staff who need it for their duties, a PCI-DSS-compliant payment processor, and staff privacy obligations. No method of transmission or storage is completely secure, but we work continuously to protect your information against loss, theft and unauthorized access, use or disclosure.

10. Retention

We keep personal information only as long as necessary for the purposes described in this Policy and to meet our legal obligations. As an Ontario travel registrant we are required to keep customer transaction records for the periods prescribed under the Travel Industry Act, 2002, and Canadian tax law generally requires business records to be kept for at least six years. When personal information is no longer required, we destroy, erase or anonymize it securely.

11. Data Breaches

We maintain records of privacy incidents as required by PIPEDA. If a breach of our security safeguards creates a real risk of significant harm to you, we will notify you and report the breach to the Office of the Privacy Commissioner of Canada as required by law, and take reasonable steps to mitigate the harm.

12. Your Rights

Subject to limited exceptions under PIPEDA, you have the right to:

• access the personal information we hold about you and be told how it has been used and to whom it has been disclosed;
• request correction of information that is inaccurate or incomplete;
• withdraw consent as described in Section 4; and
• challenge our compliance with this Policy by contacting our Privacy Officer (below).

To protect your information, we verify the identity of anyone making an access, correction or deletion request before acting on it, and we respond to written requests within the timelines required by law (generally 30 days). If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376).

13. Third-Party Websites

Our website may contain links to third-party websites (for example suppliers or payment pages). This Policy does not apply to those sites, and we encourage you to review their privacy policies.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or in the law. The "Last updated" date at the top shows when it was last revised, and material changes will be posted on this page. Your continued use of our services after changes are posted constitutes acceptance of the updated Policy.

15. Contact Us — Privacy Officer

Questions, access requests, corrections and complaints about personal information should be directed to our Privacy Officer:

Privacy Officer, Ali Travel Inc. o/a Maplelux Holidays
350 Hwy 7, Unit 304, Richmond Hill, Ontario L4B 3N2
Email: [email protected] (subject line: "Privacy Request")
Phone: (416) 560-5888