Data Controller
For the purposes of applicable data protection law, the data controller is:
alpine-drift Heritage Center
87 Railway Heritage Avenue
Edmonton, Alberta T5J 2G3
Canada
[email protected]
Legal Basis for Processing
We process personal data under the following legal bases:
Contractual Necessity
Processing is necessary to fulfill booking agreements and deliver heritage experiences you have requested. This includes managing reservations, communicating program details, and providing services.
Legitimate Interest
We process certain data based on legitimate interests in operating our heritage programs effectively, improving services, and communicating with individuals who have expressed interest in railway heritage education.
Consent
Where required, we obtain explicit consent before processing personal data, particularly for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
Your Data Protection Rights
Under data protection law, you have the following rights:
Right of Access
You have the right to obtain confirmation of whether we process your personal data and to access that data along with supplementary information about processing activities.
Right to Rectification
You may request correction of inaccurate personal data and completion of incomplete data.
Right to Erasure
Under certain circumstances, you may request deletion of your personal data. This right is not absolute and may be limited by legal obligations or legitimate grounds for retention.
Right to Restriction
You may request restriction of processing in specific circumstances, such as when contesting data accuracy or objecting to processing.
Right to Data Portability
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used format and transmit it to another controller.
Right to Object
You may object to processing based on legitimate interests or for direct marketing purposes. Upon objection to direct marketing, we will cease processing for that purpose.
Rights Related to Automated Decision-Making
We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.
Data Retention
Personal data is retained only as long as necessary for the purposes for which it was collected. Booking information is typically retained for three years following program completion for customer service and operational purposes. Marketing consent records are maintained until consent is withdrawn.
Some information may be retained longer where required by law or for legitimate purposes such as dispute resolution.
Data Security
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks involved in processing personal data. These measures include encryption, access controls, secure storage systems, and staff training on data protection.
International Data Transfers
Our operations are primarily based in Canada. If personal data is transferred outside Canada, we ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection law.
Third-Party Processors
We engage third-party service providers to assist with specific functions such as email communications, payment processing, and website hosting. These processors act on our instructions and are contractually bound to implement appropriate security measures and process data only for specified purposes.
Exercising Your Rights
To exercise any of your data protection rights, please contact us at [email protected] or write to the address provided above. We will respond to your request within one month, though this period may be extended for complex requests.
You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates data protection law.
Changes to This Statement
We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website or direct notification.
Contact
For questions about data protection practices or to exercise your rights, contact:
[email protected]
87 Railway Heritage Avenue
Edmonton, Alberta T5J 2G3
Canada