Your rights under the General Data Protection Regulation
Last Updated: October 1, 2026
This page provides information for visitors from the European Economic Area (EEA) and the United Kingdom regarding their rights under the General Data Protection Regulation (GDPR) and similar data protection laws.
lush-rhythm acts as the data controller for personal information collected through this website. Our contact details are:
lush-rhythm
341 Campbell Street, Suite 204
Tofino, British Columbia
Canada V0R 2Z0
Email: [email protected]
We process your personal data based on the following legal grounds:
Where you have provided explicit consent for specific processing activities, such as receiving marketing communications or the use of non-essential cookies.
Where processing is necessary to perform a contract with you, such as processing booking inquiries and delivering expedition services.
Where processing is necessary for our legitimate business interests, such as improving our services, preventing fraud, and ensuring website security, provided these interests do not override your fundamental rights.
Where processing is necessary to comply with legal requirements, such as tax and accounting obligations.
If you are located in the EEA or UK, you have the following rights regarding your personal data:
You have the right to request a copy of the personal information we hold about you and information about how we process it.
You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
You have the right to object to processing based on legitimate interests or for direct marketing purposes.
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such automated decision-making.
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. This period may be extended by two further months where necessary, taking into account the complexity and number of requests.
We may request specific information from you to help us confirm your identity and ensure your right to access your personal data or exercise other rights.
As we are based in Canada, personal data collected from EEA and UK visitors is transferred to Canada. Canada has been recognized by the European Commission as providing adequate data protection. For transfers to other countries, we implement appropriate safeguards such as Standard Contractual Clauses.
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. Specific retention periods vary based on the type of data and the purposes for processing:
If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. For EEA residents, this is typically the data protection authority in your country of residence. For UK residents, this is the Information Commissioner's Office (ICO).
We encourage you to contact us first so we can address your concerns directly.
We may update this GDPR notice from time to time. Any changes will be posted on this page with an updated revision date.