periwinkle-comet

Introduction

The General Data Protection Regulation (GDPR) is a regulation in European Union law on data protection and privacy. Although periwinkle-comet is based in Canada, we are committed to protecting the privacy rights of all our visitors, including those from the European Economic Area (EEA).

This page explains your rights under the GDPR and how we process personal data in compliance with this regulation.

Data Controller

periwinkle-comet acts as the data controller for personal data collected through this website. As the data controller, we determine the purposes and means of processing personal data.

Contact details:

periwinkle-comet
742 Expedition Way
Vancouver, BC V6B 2P8
Canada
Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

Consent: When you submit a form or accept cookies, you provide consent for us to process your data for the specified purposes.
Contractual necessity: When you book a tour, processing your data is necessary to fulfill our contractual obligations to you.
Legitimate interests: We may process data based on our legitimate interests, such as improving our services and maintaining security, provided these interests are not overridden by your rights.
Legal obligation: We may process data when required by law.

Your Rights Under GDPR

If you are located in the European Economic Area, you have the following rights regarding your personal data:

Right to Access

You have the right to request copies of your personal data. We may charge a small fee for this service in certain circumstances.

Right to Rectification

You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete information you believe is incomplete.

Right to Erasure

You have the right to request that we erase your personal data, under certain conditions. This right is not absolute and only applies in certain circumstances.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data, under certain conditions.

Right to Object to Processing

You have the right to object to our processing of your personal data, under certain conditions, particularly where we rely on legitimate interests as our legal basis.

Right to Data Portability

You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

Right to Withdraw Consent

Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex or you have made multiple requests, we may extend this period by two months, in which case we will inform you of the extension and the reasons for it.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information or exercise other rights.

International Data Transfers

As a Canadian company, data you provide to us may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing an adequate level of data protection.

If we transfer data to other countries that have not received an adequacy decision, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. The retention period varies depending on the context and our legal obligations.

Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, and regular security assessments.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

Automated Decision-Making

We do not use automated decision-making, including profiling, in a way that produces legal effects concerning you or similarly significantly affects you.

Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information.

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. For EEA residents, this is typically the data protection authority in your country of residence.

Changes to This Policy

We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated revision date.

Contact Us

For any questions regarding GDPR compliance or to exercise your data protection rights, please contact us at: