GDPR Compliance

Last Updated: September 22, 2026

Our Commitment to GDPR

Polar Tundra is committed to protecting the privacy rights of individuals in accordance with the General Data Protection Regulation (GDPR). Although we are based in Canada, we recognize and respect the data protection rights of European Union residents who interact with our services.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you provide explicit consent for specific processing activities, such as receiving marketing communications
• Contract: When processing is necessary to fulfill our contractual obligations for expedition services
• Legal Obligation: When required to comply with applicable laws and regulations
• Legitimate Interests: When necessary for our legitimate business interests, balanced against your rights and freedoms

Your GDPR Rights

If you are an EU resident, you have the following rights under GDPR:

Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data.

Right to Rectification

You may request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure

You can request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes it was collected.

Right to Restriction of Processing

You may request that we limit how we use your personal data in specific situations.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time.

Right to Lodge a Complaint

You have the right to file a complaint with a supervisory authority in your jurisdiction if you believe your data protection rights have been violated.

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: [email protected]

We will respond to your request within 30 days. In some cases, we may need to verify your identity before processing your request.

Data Controller Information

The data controller responsible for your personal information is:

Polar Tundra
487 Wilderness Trail Road
Whitehorse, Yukon Territory Y1A 3T4
Canada
Email: [email protected]

International Data Transfers

Your personal data is primarily stored and processed in Canada. When we transfer data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with GDPR requirements.

Data Protection Officer

For questions specifically related to data protection and GDPR compliance, you may contact our data protection team at [email protected].

Automated Decision-Making

We do not use automated decision-making or profiling that would have legal or similarly significant effects on individuals.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary based on the type of data and purpose:

• Inquiry forms and general contact information: 2 years from last contact
• Expedition participant records: 7 years for safety and liability purposes
• Marketing consent records: Until consent is withdrawn or 3 years of inactivity
• Financial transaction records: As required by applicable tax and accounting laws

Security Measures

We implement technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication procedures
• Employee training on data protection practices
• Incident response and breach notification procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and, where required, inform the relevant supervisory authority within 72 hours of becoming aware of the breach.

Updates to This Policy

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised date.

Contact Us

If you have questions about our GDPR compliance or wish to exercise your data protection rights, please contact us at [email protected].