GDPR Compliance
Last Updated: September 9, 2026
While spring-stag operates primarily in Canada, we recognize the rights of individuals in the European Union and European Economic Area under the General Data Protection Regulation (GDPR). This page outlines how we comply with GDPR principles when processing data of EU/EEA residents.
Legal Basis for Processing
We process your personal data under the following legal bases:
- Contract performance: Processing is necessary to fulfill our contractual obligations when you book an experience
- Legitimate interests: We process data to operate our business, improve our services, and ensure participant safety
- Legal compliance: We process data to meet regulatory requirements for adventure tourism operations
- Consent: For marketing communications and non-essential cookies, we obtain your explicit consent
Your GDPR Rights
If you are an EU/EEA resident, you have the following rights regarding your personal data:
Right to Access
You can request a copy of all personal data we hold about you. We will provide this information in a structured, commonly used format within 30 days of your request.
Right to Rectification
You can request correction of inaccurate or incomplete personal data. We will update your information within 30 days and notify any third parties with whom we shared the data.
Right to Erasure
You can request deletion of your personal data. We will comply unless we have legitimate grounds to retain the information, such as legal obligations or pending bookings.
Right to Restriction of Processing
You can request that we limit how we use your data while we investigate concerns about accuracy or lawfulness of processing.
Right to Data Portability
You can request your personal data in a machine-readable format to transfer to another service provider.
Right to Object
You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.
Data Transfers
Your personal data is stored and processed in Canada. Canada has received an adequacy decision from the European Commission, recognizing that Canadian privacy law provides adequate protection for personal data transferred from the EU/EEA.
Data Retention
We retain personal data for the following periods:
- Booking inquiries: 2 years from inquiry date
- Completed bookings: 7 years from completion date (for legal and insurance purposes)
- Marketing communications: Until consent is withdrawn or 3 years of inactivity
- Cookie data: As specified in our Cookies Policy
Data Protection Officer
For questions about GDPR compliance or to exercise your rights, contact us at:
Email: [email protected]
Subject line: GDPR Request
Address: 427 Mountain View Avenue, Canmore, Alberta, T1W 2E8, Canada
Supervisory Authority
If you are not satisfied with our response to your GDPR request or believe we are not processing your data lawfully, you have the right to lodge a complaint with your local data protection authority in the EU/EEA, or with the Office of the Privacy Commissioner of Canada.
Changes to GDPR Compliance
We may update our GDPR compliance practices to reflect changes in regulations or our operations. Material changes will be communicated through our website and, where appropriate, directly to affected individuals.