GDPR Compliance Statement

Our Commitment to GDPR

vivid-savanna is committed to compliance with the General Data Protection Regulation (GDPR) and respecting the data protection rights of individuals in the European Economic Area (EEA) and United Kingdom.

This statement outlines how we fulfill our obligations under GDPR and how you can exercise your rights regarding personal data processing.

Data Controller Information

vivid-savanna acts as the data controller for personal information collected through our website and services.

Contact details:
vivid-savanna
42 Merchant Street
Glasgow G1 2BH
United Kingdom
Email: [email protected]

Legal Basis for Processing

We process personal data only when we have a valid legal basis under GDPR. Our processing activities rely on the following legal grounds:

• Consent: When you provide explicit consent for specific processing activities
• Contractual Necessity: Processing required to fulfill travel planning and booking services you've requested
• Legitimate Interests: Processing necessary for our business operations, provided your rights don't override these interests
• Legal Obligations: Processing required to comply with legal requirements

Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

Right to Access

You have the right to request confirmation of whether we process your personal data and to receive a copy of that data.

Right to Rectification

You may request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data when processing is no longer necessary, when you withdraw consent, or when you object to processing.

Right to Restriction of Processing

You may request limitation of how we process your data in certain circumstances, such as when you contest data accuracy or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects. We do not engage in such automated decision-making.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with the following information:

• Your full name and contact information
• Description of your request and which right you wish to exercise
• Any relevant information to help us locate your data

We will respond to your request within one month. In complex cases, this period may be extended by two additional months, and we will inform you of such extension.

We do not charge fees for exercising your rights unless requests are manifestly unfounded or excessive.

Data Protection Principles

We adhere to the following GDPR data protection principles:

• Lawfulness, Fairness, Transparency: We process data lawfully, fairly, and transparently
• Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes
• Data Minimization: We collect only data that is adequate, relevant, and necessary
• Accuracy: We take reasonable steps to ensure data accuracy and update or delete inaccurate data
• Storage Limitation: We retain data only as long as necessary for processing purposes
• Integrity and Confidentiality: We implement appropriate security measures to protect data
• Accountability: We demonstrate compliance with all GDPR principles

International Data Transfers

When we transfer personal data outside the EEA or UK, we ensure appropriate safeguards are in place:

• Transfers to countries with adequacy decisions from the European Commission or UK government
• Standard Contractual Clauses approved by regulatory authorities
• Other legally recognized transfer mechanisms

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay.

We will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in risk to individual rights.

Complaints and Supervisory Authority

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority.

UK Supervisory Authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

We encourage you to contact us first so we can address your concerns directly.

Data Protection Impact Assessments

Where processing operations are likely to result in high risk to individual rights, we conduct Data Protection Impact Assessments (DPIAs) to evaluate and mitigate those risks.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website.