Last updated: August 26, 2026
This document outlines how valley-leap complies with the General Data Protection Regulation (GDPR) when processing personal data of individuals in the European Economic Area, even though we operate primarily in Canada.
We process personal data under the following legal bases:
When you book wilderness expeditions, we process your data to fulfill contractual obligations including expedition coordination, safety management, and service delivery.
We process certain data based on legitimate business interests such as fraud prevention, network security, and improving service quality. These interests are balanced against your privacy rights.
Some data processing occurs to comply with Canadian legal requirements including record-keeping for business operations and responding to legal requests from authorities.
If you are located in the European Economic Area, you have specific rights regarding your personal data:
You can request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information in a structured, commonly used format.
You can request correction of inaccurate personal data. We will update records promptly upon verification of corrected information.
You can request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent. This right is subject to legal retention requirements that may mandate continued data storage.
You can request limitation on how we process your data in specific circumstances, such as when you contest data accuracy or object to processing based on legitimate interests.
You can request your personal data in a machine-readable format and have it transmitted to another service provider where technically feasible.
You can object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.
Valley-leap does not employ automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.
To exercise any GDPR rights, contact us at [email protected] with your request. We will respond within one month, though complex requests may require up to three months with explanation for the extension.
We may request additional information to verify your identity before processing rights requests, particularly for data access or deletion requests.
Questions regarding GDPR compliance or data protection practices should be directed to [email protected].
If you believe our data processing violates GDPR, you have the right to lodge a complaint with your local data protection supervisory authority in the European Economic Area.
Personal data collected through valley-leap.com is stored and processed in Canada. We implement appropriate safeguards to protect data transferred outside the European Economic Area, though Canada is not currently recognized as providing adequate data protection under GDPR.
We retain personal data for three years following expedition completion unless you exercise your right to erasure or legal requirements mandate different retention periods.
We may update this document to reflect changes in data protection practices or regulatory requirements. Material changes will be posted with an updated revision date.