GDPR Information

Introduction

The General Data Protection Regulation (GDPR) is a European Union regulation that establishes comprehensive data protection rights for individuals. While prairie-kudu is based in Canada, we respect these principles and extend similar protections to all users regardless of location.

Data Controller

For purposes of data protection law, the data controller is:

prairie-kudu Wilderness Expeditions
427 Birch Trail Avenue
Canmore, Alberta T1W 2K8
Canada
Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

Consent

When you submit a reservation request or inquiry, you provide explicit consent for us to process the information you share for the purpose of responding to your request and potentially providing services.

Legitimate Interests

We may process certain data based on legitimate business interests, such as improving website functionality, preventing fraud, and maintaining business records. We balance these interests against your rights and freedoms.

Legal Obligations

In some cases, we process data to comply with legal requirements, such as tax regulations and business record-keeping obligations.

Your Rights Under GDPR

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used format.

Right to Rectification

If personal data we hold is inaccurate or incomplete, you have the right to request correction.

Right to Erasure

You may request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected, or if you withdraw consent.

Right to Restrict Processing

You can request that we limit how we use your personal data in specific situations, such as while we verify data accuracy or assess legitimate grounds for processing.

Right to Data Portability

Where technically feasible, you have the right to receive personal data you provided to us in a portable format and to transmit it to another controller.

Right to Object

You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing conducted before withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe your data protection rights have been violated.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with the subject line "Data Protection Request." Please include:

• Your full name
• The email address associated with your data
• Specific right you wish to exercise
• Any relevant details to help us locate your information

We will respond to your request within 30 days. If the request is complex or we receive multiple requests, we may extend this period by an additional 60 days and will notify you of the extension.

Data We Collect

We collect the following categories of personal data:

Contact Information

Name and email address provided through reservation requests or inquiries.

Communication Content

Information you choose to share about experience level, interests, physical fitness, dietary requirements, or accessibility needs when communicating with us.

Technical Data

IP address, browser type, device information, and browsing behavior on our website collected through cookies and similar technologies.

Data Retention

We retain personal data only as long as necessary for the purposes outlined in our Privacy Policy:

• Reservation inquiries: 3 years from last contact
• Client expedition records: 5 years for liability and business purposes
• Technical data: 12 months unless required for security purposes

You may request earlier deletion subject to legal obligations that require retention.

Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include:

• Encryption of data in transit and at rest
• Access controls limiting who can view personal data
• Regular security assessments
• Staff training on data protection

International Data Transfers

Our operations are based in Canada. If you are accessing our website from the European Union or other jurisdictions with data protection laws, your information may be transferred to and processed in Canada.

Canada has been recognized by the European Commission as providing adequate protection for personal data under the GDPR for certain sectors. We take additional steps to ensure your data receives equivalent protection regardless of where it is processed.

Third-Party Processing

We engage limited third-party service providers who may process personal data on our behalf, such as email communication platforms. These processors are bound by contractual obligations to handle data securely and only for specified purposes.

We do not sell or rent personal data to third parties.

Updates to This Information

We may update this GDPR information periodically to reflect changes in our practices or legal requirements. Material changes will be indicated by updating the effective date.

Contact

For questions about GDPR compliance or to exercise your data protection rights:

Email: [email protected]
Subject: Data Protection Inquiry