Our Commitment to GDPR
opal-comet is committed to compliance with the General Data Protection Regulation (GDPR) for all individuals in the European Economic Area (EEA). This page outlines your rights and our obligations under GDPR.
Data Controller
opal-comet acts as the data controller for personal information collected through this website and during the booking process. Our contact details for data protection matters:
Email: [email protected]
Address: 1847 Mountain View Road, Canmore, Alberta T1W 2V4, Canada
Lawful Bases for Processing
We process personal data under the following lawful bases:
- Contract: Processing necessary to fulfill booking agreements and provide expedition services
- Legitimate Interest: Processing necessary for business operations, fraud prevention, and service improvement
- Consent: Processing based on your explicit consent, particularly for marketing communications
- Legal Obligation: Processing required to comply with applicable laws and regulations
Your GDPR Rights
Under GDPR, you have the following rights:
Right of Access
You may request a copy of the personal data we hold about you. We will respond within 30 days and provide the information free of charge.
Right to Rectification
You may request correction of inaccurate or incomplete personal data we hold about you.
Right to Erasure
You may request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when processing is unlawful. This right does not apply where we must retain data for legal compliance.
Right to Restrict Processing
You may request that we limit how we use your data while we address concerns you have raised about its accuracy or our lawful basis for processing.
Right to Data Portability
You may request your personal data in a structured, commonly used, machine-readable format to transfer to another service provider.
Right to Object
You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making
We do not make decisions based solely on automated processing that produce legal effects or significantly affect you.
International Data Transfers
As opal-comet is based in Canada, your data may be transferred outside the EEA. Canada has been recognized by the European Commission as providing adequate data protection. For transfers to other jurisdictions, we implement appropriate safeguards including standard contractual clauses.
Data Protection Measures
We implement technical and organizational measures appropriate to the risk, including:
- Encryption of data in transit and at rest
- Access controls limiting data access to authorized personnel
- Regular security assessments
- Staff training on data protection
- Incident response procedures
Data Breach Notification
In the event of a data breach likely to result in high risk to your rights and freedoms, we will notify you without undue delay and inform the relevant supervisory authority within 72 hours of becoming aware of the breach.
Exercising Your Rights
To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before processing your request. We will respond within 30 days, or inform you if an extension is necessary.
Complaints
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in the EU member state of your residence, workplace, or where the alleged infringement occurred.