Ocean-saga

Last Updated: January 15, 2026

Ocean-saga is committed to protecting the personal data of all visitors, including those from the European Economic Area (EEA), United Kingdom, and Switzerland. This page supplements our Privacy Policy with specific information about your rights under the General Data Protection Regulation (GDPR) and how we comply with its requirements.

Data Controller

For the purposes of the GDPR, Ocean-saga acts as the data controller for personal data collected through our website and services. Our contact details are:

Ocean-saga
147 Heritage Station Road
Vancouver, BC V6B 2K8
Canada
Email: [email protected]

Legal Basis for Processing

Under the GDPR, we must have a lawful basis for processing your personal data. Depending on the circumstances, we rely on the following legal bases:

Consent (Article 6(1)(a))

Where you have given clear consent for us to process your personal data for a specific purpose. You may withdraw consent at any time by contacting us.

Contractual Necessity (Article 6(1)(b))

Processing necessary for the performance of a contract with you or to take steps at your request before entering into a contract. This applies to reservation requests and booking management.

Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate interests, provided those interests are not overridden by your rights. Our legitimate interests include:

Improving our website and services
Understanding how visitors use our website
Communicating relevant information about our services
Preventing fraud and ensuring security

Your Rights Under GDPR

If you are located in the EEA, UK, or Switzerland, you have the following rights regarding your personal data:

Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, to access that data along with information about how we use it.

Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete data completed.

Right to Erasure (Article 17)

You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected.

Right to Restriction (Article 18)

You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object (Article 21)

You have the right to object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such automated decision-making.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us using the details provided above. We will respond to your request within one month of receipt. If your request is complex or we receive numerous requests, we may extend this period by two months, in which case we will inform you of the extension.

We may request specific information from you to help us confirm your identity before responding to your request. This is a security measure to ensure personal data is not disclosed to unauthorized persons.

International Data Transfers

As a Canadian organization, processing your personal data may involve transferring it to Canada or other countries outside the EEA. When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place:

Canada has been recognized by the European Commission as providing adequate protection for personal data (for certain types of organizations)
Where additional safeguards are required, we implement Standard Contractual Clauses approved by the European Commission
We assess the legal framework of destination countries and implement supplementary measures where necessary

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods are detailed in our Privacy Policy.

Data Protection Officer

Given the nature and scale of our operations, we have not appointed a Data Protection Officer. However, you may contact us with any data protection inquiries at the contact details provided above.

Supervisory Authority

If you believe we have not adequately addressed your concerns about our data processing practices, you have the right to lodge a complaint with a supervisory authority. If you are in the EEA, you may contact the supervisory authority in your country of residence, workplace, or the location of the alleged infringement.

Updates to This Information

We may update this GDPR compliance information periodically to reflect changes in our practices or legal requirements. We encourage you to review this page regularly for the latest information about our data protection practices.

Contact Us

For any questions about this GDPR compliance information or to exercise your data protection rights, please contact us: