GDPR Compliance

Our Commitment to GDPR

mountain-starling is committed to protecting the personal data of visitors from the European Economic Area in compliance with the General Data Protection Regulation (GDPR). This page provides additional information specific to GDPR requirements, supplementing our main Privacy Policy.

Data Controller

mountain-starling acts as the data controller for personal information collected through this website. Our contact details are: 45 Harbour Road, V&A Waterfront, Cape Town, 8001, South Africa. Email: [email protected]

Legal Basis for Processing

We process personal data from EEA visitors based on the following legal grounds:

• Consent: Where you have provided explicit consent for specific processing activities, such as receiving communications
• Contract: Where processing is necessary to fulfil a booking or service request you have made
• Legitimate Interests: Where processing is necessary for our legitimate business interests, such as improving our services and website security, provided these interests do not override your rights
• Legal Obligation: Where we are required to process data to comply with applicable laws

Your GDPR Rights

If you are located in the European Economic Area, you have specific rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you
• Right to Rectification: You may request correction of inaccurate or incomplete data
• Right to Erasure: You may request deletion of your personal data under certain circumstances
• Right to Restrict Processing: You may request that we limit how we use your data
• Right to Data Portability: You may request your data in a structured, machine-readable format
• Right to Object: You may object to processing based on legitimate interests
• Rights Related to Automated Decision-Making: You have rights concerning automated processing that produces legal effects

International Data Transfers

As we are based in South Africa, personal data collected from EEA visitors may be transferred outside the European Economic Area. South Africa has received an adequacy decision from the European Commission, recognising that South African data protection laws provide an adequate level of protection. We also implement appropriate safeguards to ensure your data remains protected.

Data Retention for EEA Visitors

Personal data is retained only as long as necessary for the purposes for which it was collected. Enquiry data is typically retained for 24 months, after which it is securely deleted unless a longer retention period is required by law or for ongoing business purposes.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with your request. We will respond within one month of receiving your request. In certain circumstances, we may extend this period by two months if your request is complex.

We may request verification of your identity before processing your request to ensure data security.

Supervisory Authority

If you are not satisfied with our response to your enquiry or believe we are processing your data unlawfully, you have the right to lodge a complaint with a supervisory authority in your country of residence.

Changes to This Information

We may update this GDPR compliance information as regulations evolve or our practices change. Significant updates will be communicated through our website.