GDPR Compliance Statement

1. Our Commitment to Data Protection

Violet-harbor is committed to protecting your personal data in accordance with applicable data protection regulations, including the General Data Protection Regulation (GDPR) for visitors from the European Union and equivalent Canadian privacy legislation.

2. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual Necessity: Processing necessary to fulfill our service obligations when you book an experience
• Legitimate Interests: Processing necessary for our legitimate business operations, such as improving services and ensuring safety
• Legal Obligation: Processing required to comply with legal and regulatory requirements
• Consent: Processing based on your explicit consent, which you may withdraw at any time

3. Your Rights Under GDPR

If you are a resident of the European Union or equivalent jurisdiction, you have the following rights:

Right to Access

You have the right to request a copy of the personal information we hold about you.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

You may request deletion of your personal data, subject to legal retention obligations.

Right to Restrict Processing

You can request that we limit how we use your personal data in certain circumstances.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used format and transmit it to another controller.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

4. Data Controller Information

The data controller responsible for your personal information is:

Violet-harbor
247 Maritime Heritage Lane
Halifax, Nova Scotia, B3H 4R2, Canada
Email: [email protected]

5. Data Processing Activities

We process the following categories of personal data:

• Identity Data: Name and other identifying information
• Contact Data: Email address and correspondence
• Transaction Data: Reservation details, dates, and participant information
• Technical Data: IP address, browser type, device information
• Usage Data: Information about how you use our website

6. International Data Transfers

Your personal data is primarily processed and stored in Canada. If we transfer data to countries outside Canada or the European Economic Area, we ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

7. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Reservation and transaction records: 3 years from date of service
• Communication records: 2 years from last contact
• Technical and usage data: 1 year from collection
• Marketing consent records: Until consent is withdrawn

Longer retention periods may apply where required by law or for the establishment, exercise, or defense of legal claims.

8. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

9. Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication requirements
• Staff training on data protection practices
• Incident response and breach notification procedures

10. Third-Party Processors

We work with limited third-party service providers who process data on our behalf. All processors are carefully selected and required to provide sufficient guarantees of GDPR compliance through contractual agreements.

11. How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at [email protected]. We will respond to your request within one month, or inform you if an extension is necessary due to the complexity of your request.

When contacting us, please provide sufficient information to allow us to verify your identity and locate your data within our systems.

12. Updates to This Statement

We may update this GDPR Compliance Statement to reflect changes in our practices or legal requirements. Material changes will be communicated through prominent notice on our website.