GDPR Compliance Statement

Last updated: September 22, 2026

Overview

Sage Dusk is committed to compliance with the General Data Protection Regulation (GDPR) and respects the data protection rights of individuals in the European Economic Area (EEA), United Kingdom, and Switzerland. This statement outlines how we comply with GDPR requirements.

Data Controller

For the purposes of GDPR, Sage Dusk acts as the data controller for personal information collected through our website and services.

Contact details:
Sage Dusk
478 Mountain View Road
Canmore, Alberta T1W 2R8
Canada
Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis under GDPR Article 6:

• Consent (Article 6(1)(a)): When you voluntarily submit information through our website forms
• Legitimate interests (Article 6(1)(f)): To operate our business, improve our services, prevent fraud, and ensure website security
• Legal obligation (Article 6(1)(c)): To comply with applicable laws and regulations

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, to access that data along with information about how it is processed.

Right to Rectification (Article 16)

You have the right to request correction of inaccurate personal data and to have incomplete personal data completed.

Right to Erasure (Article 17)

Also known as the "right to be forgotten," you have the right to request deletion of your personal data under certain circumstances, including when the data is no longer necessary for the purposes for which it was collected.

Right to Restriction of Processing (Article 18)

You have the right to request that we restrict processing of your personal data under certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object (Article 21)

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent (Article 7(3))

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right to Lodge a Complaint (Article 77)

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with the subject line "GDPR Rights Request." Please include:

• Your full name
• Contact information
• Description of the specific right you wish to exercise
• Any relevant details to help us locate your information

We will respond to your request within one month of receipt. In complex cases, we may extend this period by two additional months and will inform you of any such extension.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Booking inquiry data: 3 years from last interaction
• Website analytics data: 26 months
• Cookie consent records: 12 months

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit using SSL/TLS protocols
• Access controls limiting data access to authorized personnel only
• Regular security assessments and updates
• Staff training on data protection principles

International Data Transfers

As we are based in Canada, personal data collected from EEA residents may be transferred outside the EEA. Canada has been recognized by the European Commission as providing adequate protection for personal data. We ensure that any other international transfers comply with GDPR requirements through appropriate safeguards.

Data Protection Officer

While we are not required to appoint a Data Protection Officer under GDPR, we have designated a privacy contact responsible for overseeing data protection compliance. For privacy-related inquiries, contact [email protected]

Automated Decision-Making and Profiling

We do not engage in automated decision-making or profiling activities that produce legal effects or similarly significantly affect individuals.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33 and 34.

Children's Data

Our services are not directed to children under 16 years of age. We do not knowingly process personal data of children without parental consent where required by GDPR.

Updates to This Statement

We may update this GDPR Compliance Statement periodically. Material changes will be communicated through prominent notice on our website.

Supervisory Authority

If you are located in the EEA and have concerns about our data processing practices, you have the right to lodge a complaint with your local supervisory authority. A list of supervisory authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en