1. Who is Responsible for Your Information?

Patrice Bouffard, operating under the brand Roatan Québécois, is the controller of personal information collected via the website https://roatanquebecois.ca and associated channels (Messenger, WhatsApp, email, forms).

Controller: Patrice Bouffard
Email: patrice@roatanquebecois.ca
Phone: +1 514 900 1921
Operational office: West Bay, Roatán, Honduras

2. What Data I Collect

2.1 Data You Provide Directly

Booking form (Web3Forms): name, email, phone, desired travel dates, stay type (hotel/Airbnb/cruise), pickup location, package type, number of people, preferred hotel, comments.
Messaging (Messenger/ManyChat, WhatsApp, Telegram, email): your Facebook name, phone number if provided, conversation content.
Final booking: passport details (full name, date of birth, number), billing address, payment method.

2.2 Data Collected Automatically

Your browser's localStorage:
- referrer + referrer_time: identifier of the referrer who sent you to the site (max 90 days)
- theme: your display preference (light/dark)
sessionStorage: temporary form submission recap (cleared when you close the tab)
Server logs: IP address, browser type, pages visited, dates/times (kept 30 days by our host)
No third-party tracking cookies are placed by the site itself

3. Why I Collect This Data

📩 Provide you a personalized travel proposal per your criteria
📞 Contact you via your preferred channel
💳 Process your booking with wholesalers (Sunwing, Air Canada Vacations, WestJet Vacations) and hoteliers
🎁 Honor affiliate credit for the referrer who sent you (90-day system)
📊 Improve the site (anonymized traffic analysis)

4. Who I Share Your Data With

Your information is shared only with third parties strictly necessary to complete your trip:

Wholesalers (package): Sunwing Vacations (WestJet Travel Group), Air Canada Vacations, WestJet Vacations — to book your flight + hotel
Hoteliers: Media Luna, Infinity Bay, Mayan Princess, Henry Morgan, etc. per your choice — to confirm your room
Payment processors: Stripe (cards), Desjardins (Interac) if applicable
Form platform: Web3Forms (form relay to my email)
Messaging platform: Meta (Facebook Messenger), ManyChat, WhatsApp, Telegram — per the channel YOU choose
Hosting: Hetzner Online GmbH (server in Germany)

I never sell your data. No third-party marketing, no mass prospecting, no rented lists.

5. Data Transfers Outside Quebec

Per Law 25, I must inform you that some data transfers outside Quebec occur:

Germany: website hosting (Hetzner Online GmbH — subject to GDPR, equivalent protection level)
United States: Meta services (Messenger, WhatsApp), Stripe, Web3Forms — subject to standard contractual clauses
Honduras: on-ground operations (local organizations, transfers, restaurants) — minimal sharing (name + dates only)

6. How Long I Keep Your Data

Unused request forms: 12 months then deletion
Messenger/WhatsApp/Telegram conversations: variable per platform (Meta, etc.)
Confirmed booking data: 7 years (Canadian accounting obligation)
localStorage referrer: 90 days, then auto-expires
Server logs: 30 days

7. Your Rights (Law 25)

As a Quebec resident (or person whose data is processed in Quebec), you have the following rights — free of charge, at any time:

✅ Access: Know what data I hold about you
✏️ Correction: Fix inaccurate information
🗑️ Deletion (right to be forgotten): Have your data removed
⛔ Opposition: Refuse certain processing
🔁 Portability: Receive your data in an open format
📩 Complaint: File with Quebec's Commission d'accès à l'information (CAI)

To exercise a right, email me at patrice@roatanquebecois.ca with "Law 25 — access request" in the subject. I respond within 30 days.

8. Cookies and Similar Technologies

The site uses two audience measurement tools, and no advertising pixel (no Facebook, no Google Ads):

Google Analytics 4 (Google): counts page views, where visits come from and how our tools are used (ship calendar, crowd barometer, map). It sets cookies (_ga, _ga_*).
Microsoft Clarity (Microsoft): records clicks, scrolling and movement on pages, without your name, to spot what is hard to use. Booking form fields (name, email, phone, payment) are masked and never recorded. It sets cookies (_clck, _clsk).

To opt out: a tracker blocker in your browser, or Google's official add-on (tools.google.com/dlpage/gaoptout). The other data stored locally in your browser are:

localStorage.referrer + referrer_time: affiliate system (90 days)
localStorage.theme: your display choice (permanent until cleared)
sessionStorage: temporary session data (cleared on close)

To clear these: use your browser's "Clear site data" function, or type RQ_clearReferrer() in the DevTools console (F12).

9. Security

I protect your data through:

🔒 HTTPS everywhere (TLS 1.3, Cloudflare Origin CA certificate)
🔐 Email and messaging accounts protected by two-factor authentication
🛡️ Server hosted by Hetzner (Germany, GDPR-compliant)
📑 No plain-text storage of passwords or credit card numbers

10. TikTok Data

When the Roatan Québécois TikTok account is connected to our publishing tool, we receive from TikTok the account's open id, display name and avatar (user.info.basic scope) and an access token used to upload and publish videos to that account (video.upload and video.publish scopes). This data is used only to publish our videos. It is never sold or shared, and the token is stored encrypted on our server (Hetzner, Germany) until disconnection. To revoke access: TikTok › Settings and privacy › Security › Apps and services, or email patrice@roatanquebecois.ca; data is deleted within 30 days.

11. Changes to This Policy

I may modify this policy. The update date above reflects the current version. If a major change affects your rights, I'll notify you by email if you're an active client.

12. Questions?

Patrice Bouffard — Personal Information Protection Officer
Email: patrice@roatanquebecois.ca
Phone: +1 514 900 1921
Full contact page →

Useful links:
→ Commission d'accès à l'information du Québec (CAI)
→ Text of Law 25 (LPRPSP)

Privacy Policy