Privacy Notice

Effective Date: [01/07/2025]

This Privacy Notice ("Notice") is issued by The Cozy Corner, a privately operated short-term rental located in Elora, Ontario, Canada (“we”, “us”, “our”), pursuant to our obligations under applicable data protection and privacy legislation, including but not limited to the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s Anti-Spam Legislation (CASL), and, where applicable, the General Data Protection Regulation (EU) 2016/679 (GDPR) and the United Kingdom General Data Protection Regulation (UK GDPR). This Notice applies to all individuals who interact with our website at https://thecozycornerelora.ca and any digital forms or marketing campaigns we may offer, including but not limited to promotional giveaways and booking functionalities.

1. Identification of the Organization Responsible for Data Processing

The entity responsible for the collection, processing, and protection of your personal data is:
The Cozy Corner Elora
Elora, Ontario, Canada (full address available upon request)
Email: [email protected]

2. Categories of Personal Information Collected

We may collect, use, and retain various categories of personal information, including but not limited to:

Identifiers such as full name, email address, mailing address (if applicable), IP address, and phone number;
Transaction and reservation data such as check-in/check-out dates, number of guests, preferences, and communications related to your stay;
Payment-related metadata, such as transaction IDs and confirmation timestamps (note: full credit card data is processed exclusively via Stripe and is never stored or visible to us);
Device and browser information, including operating system, screen resolution, and referring URLs;
Survey or contest response data, including timestamps, form field values, and opt-in preferences.

3. Purposes of Data Collection and Legal Bases

We collect and process personal data for the following purposes, relying on the following legal bases:

To provide services, including managing bookings and responding to inquiries – based on contractual necessity;
To administer promotions and contests – based on your express consent at time of entry;
To send marketing communications about future stays, discounts, or regional events – based on your express opt-in under CASL and Article 6(1)(a) of the GDPR (where applicable);
To ensure the proper functioning of our website, prevent fraud, and analyze traffic – based on legitimate interests;
To administer promotions and contests – based on your express consent at time of entry. We conduct one (1) random draw per calendar year to select a winner for our free night giveaway. All valid entries submitted prior to the draw date are eligible. Entries do not roll over between years.
To comply with legal, tax, audit, and accounting obligations – based on legal obligations imposed by Canadian law.

4. Method of Consent Acquisition

Consent for processing personal data is obtained via clear, affirmative action. For promotional communication, this is typically a checkbox that must be voluntarily selected by the user and is not pre-checked. Implied consent may apply for transactional communications (e.g., confirming a booking). Individuals have the right to withdraw consent at any time by contacting us at [email protected].

5. Disclosure of Personal Data to Third Parties

We disclose personal data only to the extent necessary to fulfill the purposes described in this Notice, and only to the following third-party data processors:

Stripe, Inc. – for secure online payment processing. Stripe operates in the United States and complies with applicable data transfer mechanisms under GDPR (where applicable).
Lodgify, S.L. – for website hosting, booking management, and property calendar synchronization.
Typeform S.L. – for the collection of data via interactive forms, primarily used for promotional entry and surveys.
Legal or regulatory authorities where required by applicable law or in response to lawful requests, including but not limited to subpoenas, court orders, or investigations.

6. International Data Transfers

Your data may be processed in jurisdictions outside of Canada, including but not limited to the United States and the European Union. Where personal data is transferred internationally, we ensure the application of appropriate safeguards including but not limited to Standard Contractual Clauses (SCCs) adopted by the European Commission or equivalent legal instruments.

7. Data Retention and Disposal

We retain personal data for as long as necessary to fulfill the purposes described in this Notice and comply with legal obligations. Specific periods include:

Booking data – 7 years (Canada Revenue Agency and audit compliance);
Contest entries – 30 days post winner notification unless marketing consent was granted;
Marketing records – until the individual withdraws consent;
Analytics logs – typically anonymized or deleted after 26 months.

8. Data Security Measures

We employ commercially reasonable administrative, physical, and technical safeguards to protect personal data, including but not limited to:

SSL/TLS encryption for data transmission;
Access restrictions and password protection for sensitive platforms;
Backups and audit logs managed through secure third-party providers.

9. Individual Rights

Under Canadian privacy laws and, where applicable, the GDPR, you have the right to:

Request access to your personal data;
Request correction of inaccurate or incomplete data;
Withdraw consent at any time (with future effect);
Request deletion, restriction, or data portability (where applicable);
Lodge a complaint with the Office of the Privacy Commissioner of Canada or an equivalent EU/UK data protection authority if you believe your rights are violated.

10. Cookies and Similar Technologies

Our website may use cookies, pixels, and tracking scripts for analytics, session management, and user experience optimization. Cookies are managed by Lodgify and may include first-party or third-party providers. You may disable or delete cookies via your browser settings; however, certain features of the site may become unavailable.

11. Children’s Privacy

We do not knowingly collect or process personal data from individuals under the age of 13. If we become aware of such a collection, we will delete the data promptly. Parents or guardians may contact us to request removal of a child’s data.

12. Changes to This Notice

We reserve the right to update or revise this Privacy Notice from time to time. Updates will be posted on this page, and the revised version will be identified by the "Effective Date" at the top. Where required by law, we will provide notice of significant changes via email or a site banner.

13. Contact Information

For inquiries, access requests, complaints, or withdrawal of consent, please contact:

The Cozy Corner Elora
📧 [email protected]
📍 Elora, Ontario, Canada