Last updated: July 1, 2026
The General Data Protection Regulation (GDPR) is a European Union regulation that governs data protection and privacy. While basin-trail operates from Canada, we respect the rights of EU residents and comply with GDPR principles when processing their personal data.
Your rights under GDPR
Right to be informed
You have the right to clear information about how we collect and use your personal data. This page and our Privacy Policy fulfill this obligation.
Right of access
You can request a copy of all personal data we hold about you. We will provide this in a commonly used electronic format within 30 days of your request.
To exercise this right, email [email protected] with "GDPR Access Request" in the subject line.
Right to rectification
If personal data we hold about you is inaccurate or incomplete, you can request correction. We will update records within 30 days and notify relevant third parties if necessary.
Right to erasure (right to be forgotten)
You can request deletion of your personal data when:
- The data is no longer necessary for its original purpose
- You withdraw consent and we have no other legal basis for processing
- You object to processing and we have no overriding legitimate grounds
- The data has been unlawfully processed
- Erasure is required to comply with legal obligations
Exceptions: We may retain data when required for:
- Legal obligations (such as tax records)
- Exercise or defense of legal claims
- Public interest purposes
Right to restriction of processing
You can request we limit how we use your data when:
- You contest the accuracy of data (we'll restrict processing while verifying)
- Processing is unlawful but you prefer restriction over erasure
- We no longer need the data but you need it for legal claims
- You've objected to processing (we'll restrict while verifying grounds)
Right to data portability
You can obtain your personal data in a structured, commonly used, machine-readable format (typically JSON or CSV). You can also request we transmit this data directly to another service provider where technically feasible.
This right applies to data:
- You provided to us
- Processed based on consent or contractual necessity
- Processed by automated means
Right to object
You can object to processing based on:
- Legitimate interests: We must stop processing unless we demonstrate compelling legitimate grounds that override your interests
- Direct marketing: We must stop all marketing communications immediately upon request
Rights related to automated decision-making and profiling
We do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you. All journey booking decisions involve human review.
Legal bases for processing
We process personal data under these GDPR-compliant legal bases:
Consent
For marketing communications and optional data collection. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Contractual necessity
To fulfill journey bookings and deliver services you've requested. Without this data, we cannot provide the services.
Legal obligations
To comply with tax laws, financial regulations, and other legal requirements.
Legitimate interests
For website improvement, fraud prevention, and service optimization. We balance these interests against your rights and freedoms.
Data we collect and why
| Data type | Purpose | Legal basis |
|---|---|---|
| Name, email | Communication, booking | Contractual necessity |
| Dietary restrictions | Journey accommodation | Contractual necessity |
| Payment information | Transaction processing | Contractual necessity |
| Website usage data | Site improvement | Legitimate interests |
| Marketing preferences | Optional communications | Consent |
International data transfers
As a Canadian company, we process data outside the European Economic Area. We ensure appropriate safeguards through:
- Processing only necessary data
- Implementing technical security measures equivalent to GDPR standards
- Limiting data access to authorized personnel
- Using service providers who maintain adequate data protection standards
Data retention periods
- Active inquiries: 90 days after last contact
- Completed bookings: 7 years (tax and legal requirements)
- Marketing data: Until consent is withdrawn
- Website analytics: 2 years (anonymized)
Data security measures
We protect your data through:
- Encryption in transit (TLS/SSL) and at rest
- Access controls and authentication requirements
- Regular security audits and assessments
- Staff training on data protection
- Incident response procedures
Data breach notification
In the event of a data breach likely to result in risk to your rights and freedoms, we will:
- Notify relevant supervisory authorities within 72 hours of becoming aware
- Notify affected individuals without undue delay if the breach poses high risk
- Document the breach, its effects, and remedial actions taken
Children's data
We do not knowingly process data of individuals under 16. Our services are designed for adults. If we become aware of processing children's data without appropriate consent, we will delete it immediately.
How to exercise your rights
To exercise any GDPR rights:
- Email [email protected] with your request
- Include "GDPR Request" in the subject line
- Specify which right you're exercising
- Provide information to help us locate your data (name, email used)
- We may request identification verification for security
We will respond within 30 days. If we need more time, we'll explain why and provide an estimated completion date.
Complaints and supervisory authority
If you believe we've mishandled your personal data, you can:
- Contact us directly at [email protected] to resolve the issue
- Lodge a complaint with your local data protection authority
- Lodge a complaint with the Canadian Privacy Commissioner
We encourage you to contact us first so we can address your concerns directly.
Updates to this page
We review and update this GDPR compliance information regularly. Material changes will be communicated to active contacts. Check this page periodically for updates.
Contact our data protection team
For GDPR-related questions or to exercise your rights:
Email: [email protected]
Subject line: GDPR Request
Address: 847 Granville Street, Vancouver, BC V6Z 1K3, Canada