Privacy Policy
One With Whales Expeditions Inc.
We collect less than most travel companies, we don't sell anything to anyone, and we'd rather tell you plainly what happens to your information than bury it. This explains what we hold, why, who sees it, and how long we keep it.
1. Who we are
One With Whales Expeditions Inc., operating as One With Whales, is a company incorporated in British Columbia, Canada. We run in-water whale expeditions internationally.
We are responsible for the personal information described here. Our Privacy Officer can be reached through the contact form at onewithwhales.com/contact.
We are governed by British Columbia's Personal Information Protection Act (PIPA) and, where it applies, Canada's PIPEDA. If you are in the United Kingdom or the European Economic Area, the UK GDPR and EU GDPR also apply to us, and section 10 sets out the additional rights you have.
2. What we collect
When you enquire or join our mailing list: your name, email address, and anything you choose to tell us.
When you apply for a trip: your name, email, phone or WhatsApp number, confirmation of your age, your social media handle if you choose to give it, and your answers to the application questions.
When you book: your emergency contact's name and phone number, your travel insurance details, dietary requirements, allergies, and any medical conditions, disabilities or medications relevant to your safety on the trip. Where a destination requires it, your passport details and nationality, and your flight itinerary.
When you pay: we never see or store your card number. Card payments are handled entirely by Stripe; transfers by Wise or directly to our bank. We hold the record of what you paid and when, not the instrument you paid with.
When you visit our website: basic analytics information — see section 8.
We don't collect anything we don't need, and most of the sensitive material above exists for one reason: so that we can help you if something goes wrong a long way from a hospital.
3. Why we collect it, and our legal basis
| What we use it for | Our basis |
|---|---|
| Managing your booking and communicating with you about your trip | Performance of our contract with you |
| Assessing whether a trip is safe and suitable for you | Performance of our contract, and our legitimate interest in participant safety |
| Health, allergy and medical information | Your explicit consent, given when you disclose it, for the vital purpose of protecting your safety |
| Arranging emergency treatment or evacuation | Protecting your vital interests |
| Meeting permit, regulatory and insurance requirements | Legal obligation |
| Accounting and tax records | Legal obligation |
| Sending you occasional updates about future trips | Your consent, which you can withdraw at any time |
| Understanding how our website is used | Our legitimate interest in running the site, and your consent where cookies require it |
4. Health and medical information
We treat this differently from everything else, because it is more sensitive.
We ask for it so your guides can keep you safe, so we can brief a host or caterer about an allergy, and so that in an emergency we can tell a doctor or an evacuation service what they need to know. We collect only what is relevant to the trip.
We share it only with the people who need it to look after you — your guide, and where necessary a medical provider, evacuation service or your emergency contact. We do not share it with the wider group, and we do not use it for any other purpose.
If you would rather discuss something sensitive directly with the trip leader than write it on a form, tell us and we'll arrange it.
5. Who we share it with
We never sell or rent your information. Not to anyone, for any purpose.
We share what's necessary with:
The people running your trip — boat operators, captains, guides, host families, accommodation providers and local partners in the country you're travelling to. They receive your name, and where relevant your dietary requirements, medical information and emergency contact. Nothing more.
Our service providers — Squarespace (website, forms and email), Stripe (card payments), Wise (transfers). Each processes your information on our instructions and under their own regulatory obligations.
Authorities, where a permit, port authority or government requires a participant list or passport details for entry or for a wildlife interaction permit.
We will also disclose information if we are legally required to.
6. Where your information goes
We operate internationally, so your information travels. Our service providers are based in the United States and Europe, and the operators and hosts running your trip are in the countries you visit — which currently include French Polynesia, Dominica and Timor-Leste.
Data protection law in those places may not be equivalent to the law where you live. We share only what is necessary, only with parties running your trip, and we take reasonable steps to ensure it is handled appropriately. By booking with us you understand your information will be transferred in this way.
7. How long we keep it
| Information | How long we keep it |
|---|---|
| Booking, invoice and payment records | 7 years, for tax and accounting |
| Waivers, medical disclosures and safety records | 16 years, because a claim relating to a trip can be brought for many years afterwards under BC’s Limitation Act |
| Correspondence about a trip | 7 years |
| Applications that don’t result in a booking | 12 months |
| Mailing list details | Until you unsubscribe, after which we keep a record of the unsubscribe so we don’t email you again |
| Website analytics | As set by the providers listed in section 8 |
8. Cookies and analytics
| Cookie | What it does |
|---|---|
| crumb Essential | Protects our forms from cross-site attacks. |
| ss_cvrss_cvtSS_ANALYTICS_ID Optional | Squarespace Analytics — how many people visit and which pages they read. |
| _ga Optional | Google Analytics — how people find us and move through the site. |
| _clck_clsk Optional | Microsoft Clarity — records anonymised page interactions such as clicks and scrolling, so we can see where the site is confusing. Text typed into forms is masked and not captured. |
9. Emails
We only send marketing emails to people who have asked for them. Every email we send identifies us and includes a one-click unsubscribe, and we act on unsubscribes immediately. This is a requirement of Canada's Anti-Spam Legislation and we take it seriously.
Emails about a trip you've booked aren't marketing — you'll get those regardless, because you need them.
10. Your rights
Wherever you live, you can ask us to:
See the personal information we hold about you
Correct anything that's wrong or out of date
Withdraw your consent to marketing, or to anything else we rely on your consent for
Explain how we've used your information and who we've shared it with
Delete information we no longer have a reason to keep
Just ask through the contact form at onewithwhales.com/contact. We'll respond within 30 days.
One honest limit on deletion: where we're legally required to keep something — a waiver, a payment record, a safety report — we can't delete it on request, and we'll tell you if that's the case and why.
If you are in the UK or the EEA, you also have the right to receive your information in a portable format, to object to processing based on our legitimate interests, to ask us to restrict processing while a dispute is resolved, and to complain to your national data protection authority. If you are in Canada, you can complain to the Office of the Information and Privacy Commissioner for British Columbia, or to the Office of the Privacy Commissioner of Canada.
We'd much rather you came to us first, and we'll try to sort it out.
11. Keeping it secure
Your information is held in access-controlled systems with encryption in transit, and only the people who need it can reach it — that means us, and the guides and operators running your trip.
No system is perfect. If a breach happens that creates a real risk of significant harm to you, we will tell you and notify the relevant regulator, as PIPA and GDPR require.
12. Children
Our trips are for participants aged 19 and over, and we don't knowingly collect information about anyone under 19. If you believe we have, tell us and we'll delete it.
13. Changes to this policy
We may update this policy. Changes are published here with a revised version and date. If a change materially affects how we handle information about you, we'll tell you directly.
14. Getting in touch
Questions about this policy, or a request under section 10 — contact our Privacy Officer through the form at onewithwhales.com/contact.
Version 2026.1 — effective 20 August 2026 — One With Whales Expeditions Inc.