Effective Date: January 1, 2024
1. Our Commitment to GDPR
Supra Vacations is committed to protecting your personal data and respecting your privacy rights under the General Data Protection Regulation (GDPR).
2. Legal Basis for Processing
We process your personal data based on the following legal grounds:
- Consent: When you provide explicit consent for marketing communications
- Contract: To fulfill our travel services contract with you
- Legal Obligation: To comply with legal requirements
- Legitimate Interest: To improve our services and prevent fraud
3. Your Rights Under GDPR
Right of Access (Article 15)
You have the right to obtain confirmation of whether we process your personal data and access to that data.
Right to Rectification (Article 16)
You have the right to have inaccurate personal data corrected or completed if incomplete.
Right to Erasure (Article 17)
You have the right to request deletion of your personal data under certain circumstances.
Right to Restrict Processing (Article 18)
You have the right to request restriction of processing under certain conditions.
Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used format.
Right to Object (Article 21)
You have the right to object to processing based on legitimate interests or for direct marketing.
Right to Withdraw Consent (Article 7)
You have the right to withdraw consent at any time where processing is based on consent.
4. Data Protection Officer
Our Data Protection Officer can be contacted at:
Email: dpo@supravacations.cyou
Phone: +1 (305) 555-0187
5. Data Transfers
When we transfer personal data outside the EU/EEA, we ensure appropriate safeguards are in place, including:
- Adequacy decisions by the European Commission
- Standard contractual clauses
- Binding corporate rules
- Certification schemes
6. Data Retention
We retain personal data only for as long as necessary:
- Customer data: 7 years after last transaction
- Marketing data: Until consent is withdrawn
- Website analytics: 26 months
- Legal compliance: As required by law
7. Data Breach Notification
In case of a data breach likely to result in high risk to your rights, we will notify you within 72 hours of becoming aware of the breach.
8. Supervisory Authority
You have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not complied with GDPR requirements.
9. Privacy by Design
We implement privacy by design principles, ensuring data protection is built into our systems and processes from the ground up.
10. Regular Updates
We regularly review and update our GDPR compliance measures to ensure ongoing protection of your personal data.
For any questions about our GDPR compliance or to exercise your rights, please contact our Data Protection Officer at dpo@supravacations.cyou
