GDPR Compliance
Last Updated: October 2026
This page provides information about how Atoll-craft complies with the General Data Protection Regulation (GDPR) for visitors from the European Economic Area (EEA).
Data Controller
Atoll-craft acts as the data controller for personal information collected through this website. Our contact details are:
Atoll-craft
1847 Railway Avenue, Suite 302
Vancouver, BC V6H 3X9
Canada
Email: [email protected]
Legal Basis for Processing
We process personal data under the following legal bases:
- Consent: When you submit an inquiry form, you consent to our processing of your data to respond to your request.
- Contract: Processing necessary to fulfill travel booking requests.
- Legitimate Interests: Processing for website analytics and improvement, provided these interests are not overridden by your rights.
Your Rights Under GDPR
If you are located in the EEA, you have the following rights regarding your personal data:
Right of Access
You have the right to request copies of your personal data held by us.
Right to Rectification
You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
Right to Erasure
You have the right to request that we erase your personal data under certain conditions.
Right to Restrict Processing
You have the right to request that we restrict the processing of your personal data under certain conditions.
Right to Data Portability
You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.
Right to Object
You have the right to object to our processing of your personal data under certain conditions.
Right to Withdraw Consent
Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time.
Exercising Your Rights
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex, we may extend this period by two additional months, in which case we will inform you.
International Data Transfers
As we are based in Canada, your personal data may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing an adequate level of data protection. Where we transfer data to other countries, we ensure appropriate safeguards are in place.
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Specifically:
- Inquiry data: Retained for three years from the date of inquiry
- Booking data: Retained for seven years for legal and accounting purposes
- Analytics data: Retained for 26 months
Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.
Complaints
If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. For EEA residents, this would be the data protection authority in your country of residence.
Changes to This Notice
We may update this GDPR compliance notice from time to time. Any changes will be posted on this page with an updated revision date.