GDPR Compliance Statement

Last Updated: September 9, 2026

Our Commitment to Data Protection

While bamboo crane is based in Canada, we recognize that individuals from the European Union may visit our website or use our services. We are committed to respecting the data protection rights outlined in the General Data Protection Regulation (GDPR).

Legal Basis for Processing

We process personal data under the following legal bases:

Consent: When you provide explicit consent for us to process your information for specific purposes
Contract: When processing is necessary to fulfill a service booking or respond to your inquiry
Legitimate Interests: When we have a legitimate business interest that does not override your privacy rights
Legal Obligation: When we must process data to comply with applicable laws

Your Rights Under GDPR

If you are a resident of the European Union, you have the following rights:

Right to Access: You may request a copy of the personal data we hold about you
Right to Rectification: You may request correction of inaccurate or incomplete data
Right to Erasure: You may request deletion of your personal data under certain circumstances
Right to Restriction: You may request that we limit how we use your data
Right to Data Portability: You may request your data in a structured, commonly used format
Right to Object: You may object to processing based on legitimate interests or for marketing purposes
Right to Withdraw Consent: You may withdraw previously given consent at any time

Data Protection Officer

For questions regarding data protection or to exercise your GDPR rights, please contact us at [email protected]. We will respond to your request within 30 days.

International Data Transfers

Your personal information may be transferred to and processed in Canada, which has been recognized by the European Commission as providing adequate data protection. We ensure appropriate safeguards are in place for any data transfers.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by GDPR.

Automated Decision Making

We do not use automated decision-making processes or profiling that would produce legal effects or similarly significantly affect you.

Supervisory Authority

If you are located in the EU and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

Changes to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website.