GDPR Compliance

Last Updated: August 26, 2026

General Data Protection Regulation

This page provides information about how reef-dash complies with the General Data Protection Regulation (GDPR) for individuals located in the European Economic Area (EEA), the United Kingdom, and Switzerland.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: When you voluntarily provide your information through our inquiry forms or communications
• Contractual necessity: When processing is necessary to fulfill our agreement to provide you with journey experiences
• Legitimate interests: For improving our services, maintaining security, and conducting business operations
• Legal obligations: When required to comply with applicable laws and regulations

Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

Right to Access

You have the right to request copies of your personal data that we hold. We may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

Right to Rectification

You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.

Right to Erasure

You have the right to request that we erase your personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data under certain conditions.

Right to Data Portability

You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

Right to Object

You have the right to object to our processing of your personal data under certain conditions, particularly for processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with the subject line "GDPR Request." Please include:

• Your full name and email address associated with your inquiry or registration
• A clear description of which right you wish to exercise
• Any relevant details to help us locate your information

We will respond to your request within one month. If your request is complex or we receive multiple requests, we may extend this period by two additional months, and we will inform you of any such extension.

Data Protection Officer

For questions specifically about data protection and GDPR compliance, you may contact our data protection representative at [email protected] with the subject line "Data Protection Officer."

International Data Transfers

As we are based in Canada, your personal data may be transferred outside the EEA. Canada has been granted an adequacy decision by the European Commission, meaning it is recognized as providing an adequate level of data protection. We ensure that appropriate safeguards are in place for any transfers to other jurisdictions.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Inquiry information: 2 years from last contact
• Participant journey records: 5 years from journey completion
• Marketing communications: Until you unsubscribe or request deletion
• Legal and accounting records: As required by applicable law

Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting who can view personal data
• Staff training on data protection obligations

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your residence, place of work, or place of the alleged infringement, if you believe our processing of your personal data violates GDPR.

Updates to This Information

We may update this GDPR compliance information from time to time. Material changes will be communicated through our website and, where appropriate, via email to registered users.

Contact Information

reef-dash Educational Journeys
427 Cordova Street West
Vancouver, BC V6B 1E5
Canada
Email: [email protected]