GDPR Compliance

Last updated: July 21, 2026

Your Data Protection Rights

Under the General Data Protection Regulation (GDPR), you have certain rights regarding your personal data. crimson-mountain is committed to protecting these rights and ensuring compliance with GDPR requirements.

Right to Access

You have the right to request access to the personal data we hold about you. We will provide you with a copy of your data in a structured, commonly used, and machine-readable format.

Right to Rectification

If you believe that any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it.

Right to Erasure

You have the right to request that we delete your personal data under certain circumstances, including:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw your consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data under certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes or when processing is based on legitimate interests.

Right to Withdraw Consent

Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

Right to Lodge a Complaint

If you believe that we have not complied with GDPR requirements, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.

Data Processing

We process your personal data on the following legal bases:

• Performance of a contract when you book our services
• Legitimate interests in operating and improving our business
• Consent for specific processing activities
• Legal obligations to which we are subject

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and resolve disputes.

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage.

International Transfers

If we transfer your personal data outside the European Economic Area, we will ensure that appropriate safeguards are in place to protect your data in accordance with GDPR requirements.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month of receipt, though this period may be extended by two additional months where necessary.

Contact Our Data Protection Officer

For questions about our GDPR compliance or data protection practices, you may contact our Data Protection Officer at [email protected]