Who We Are (Data Controller)
Canal Club Copenhagen ("we", "us", "our") is the data controller responsible for the personal data we collect and process in connection with our boat experiences, website, and related services. As data controller, we determine the purposes and means of processing your personal data.
- Email: concierge@canalclub.dk
- Phone: +45 31 51 04 44
- Website: https://canalclubcopenhagen.com
- Location: Copenhagen, Denmark
If you have any questions, concerns, or requests relating to the processing of your personal data, please contact us directly at the details above. We will respond to all data-related enquiries within one calendar month.
What Information We Collect
We collect the following categories of personal data in connection with our services:
a) Booking and Contact Information
- Full name
- Email address
- Phone number
- Number of guests and, where relevant, guest names
- Special requirements, dietary needs, or accessibility needs
- Communication and marketing preferences
b) Payment Information
- Payment card details - processed securely through our third-party payment processor. We do not store full card numbers on our own systems.
- Transaction references and billing details
- Refund and payment history
c) Experience Information
- Booking history and experience preferences
- Feedback, ratings, and reviews submitted
- Notes, special requests, or occasion details provided before or during the experience
d) Technical and Usage Data
- IP address and approximate geographic location
- Device type, browser type, and operating system
- Pages visited on our website, time spent, and navigation behaviour
- Referral source and UTM parameters
- Cookie identifiers and session data
e) Communication Data
- Emails, WhatsApp messages, phone call notes, and other communications sent to or received from us
- Customer service records and complaint correspondence
How We Collect Information
We collect personal data through the following means:
- Direct interaction - when you make a booking, submit an enquiry, contact us by email, phone, or WhatsApp, or sign up for our communications.
- Booking platform - through our third-party booking system at booking.canalclub.dk, which collects booking details, payment information, and guest preferences on our behalf.
- Our website - through contact forms, newsletter sign-ups, and automatically via cookies and analytics tools when you browse our website.
- Third-party platforms - including Google Reviews, TripAdvisor, GetYourGuide, Instagram, Facebook, and TikTok where you interact with us, leave reviews, or book experiences through their platforms.
- During your experience - notes made by our crew relating to your preferences, requests, or any incidents, where relevant.
Legal Basis for Processing
Under GDPR, we are required to identify a lawful legal basis for each type of personal data processing we carry out. We rely on the following legal bases:
Performance of a Contract
Art. 6(1)(b)To fulfil your booking, manage your experience, process payments, send booking confirmations and reminders, and communicate with you about your reservation.
Consent
Art. 6(1)(a)For marketing communications, newsletters, use of photographs in which you are identifiable, and any optional data processing activities where you have actively opted in.
Legal Obligation
Art. 6(1)(c)To comply with Danish legal requirements, including tax and accounting obligations, maritime safety and incident reporting, and consumer protection law.
Legitimate Interests
Art. 6(1)(f)For improving our services, preventing fraud, responding to complaints, protecting our legal rights, and analysing website usage to improve the user experience - where these interests are not overridden by your rights.
Where we rely on legitimate interests as our legal basis, we carry out a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may request information about any such balancing test by contacting us.
How We Use Your Information
We use your personal data only for the purposes set out below and only to the extent necessary for each purpose:
a) Booking Management
Processing, confirming, and managing your reservation; issuing booking confirmations, receipts, and pre-experience communications; managing cancellations, rescheduling, and refunds.
b) Service Delivery
Providing and operating the experience you have booked; accommodating special requests and preferences; ensuring the safety and comfort of all guests and crew.
c) Customer Communication
Responding to your enquiries, requests, and feedback; providing customer support; sending operational communications directly related to your booking or an active enquiry.
d) Marketing (with consent only)
Where you have opted in, sending newsletters, seasonal promotions, and information about new experiences and offers from Canal Club Copenhagen. You may withdraw consent at any time by clicking "unsubscribe" in any marketing email, or by contacting us directly at concierge@canalclub.dk. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
e) Legal Compliance and Safety
Complying with Danish maritime regulations, tax and accounting laws, and any applicable legal obligations; maintaining records required by law; handling complaints, disputes, and legal claims.
f) Service Improvement
Analysing booking patterns, feedback, and anonymised usage data to improve our experiences, website, and customer journey; internal staff training.
International Data Transfers
Canal Club Copenhagen is based in Denmark and primarily processes personal data within the European Economic Area (EEA). Some of the third-party service providers we use - including analytics, communication, and booking tools - may transfer or store data outside the EEA.
Where data is transferred outside the EEA, we take all necessary steps to ensure appropriate safeguards are in place to protect your personal data, including:
- Use of Standard Contractual Clauses (SCCs) approved by the European Commission
- Transfers only to countries that benefit from an EU adequacy decision
- Assessment of supplementary measures where required following the Schrems II ruling
You may request further information about our international data transfers, including copies of the relevant safeguards, by contacting us at concierge@canalclub.dk.
How Long We Keep Your Data
We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, or to comply with applicable legal obligations. Our retention periods are as follows:
- Booking and payment records - 5 years from the date of the experience, in accordance with Danish accounting and tax law requirements (Bogføringsloven).
- General communications - 2 years from the date of the last contact or interaction.
- Marketing consent records - for the duration of the marketing relationship, plus 1 additional year as evidence of consent.
- Complaint records - 3 years from the date of resolution, to protect against potential legal claims.
- Website analytics data - typically up to 14 months, as configured within our analytics tools.
After the applicable retention period, we securely delete or irreversibly anonymise your personal data, so that it can no longer be linked to you as an individual.
Your Rights Under GDPR
As a data subject residing in the EU/EEA, you have the following rights in relation to the personal data we hold about you. These rights are not absolute and may be subject to certain legal exceptions, which we will explain if applicable when you make a request.
Right of Access
Art. 15You have the right to request a copy of the personal data we hold about you, along with information about how we use it. Requests are free of charge and will be fulfilled within one calendar month.
Right to Rectification
Art. 16You have the right to request that we correct any inaccurate or incomplete personal data we hold about you, without undue delay.
Right to Erasure ('Right to be Forgotten')
Art. 17You have the right to request that we delete your personal data where it is no longer necessary, where you withdraw consent, or where you have successfully exercised your right to object. This right may be limited where we have a legal obligation to retain data.
Right to Restriction of Processing
Art. 18You have the right to request that we restrict the processing of your personal data in certain circumstances - for example, while a complaint or challenge to accuracy is being resolved.
Right to Data Portability
Art. 20Where processing is based on your consent or on a contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
Right to Object
Art. 21You have the right to object at any time to the processing of your personal data where it is based on legitimate interests, or where it is used for direct marketing purposes (including profiling). We will cease processing unless we can demonstrate compelling legitimate grounds.
Right to Withdraw Consent
Art. 7(3)Where processing is based on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before withdrawal.
Rights re: Automated Decision-Making
Art. 22We do not use automated decision-making processes or profiling that produce legal or similarly significant effects on individuals. No such processing currently takes place at Canal Club Copenhagen.
To exercise any of these rights, please contact us in writing at concierge@canalclub.dk or by calling +45 31 51 04 44. We will respond within one calendar month of receiving your request. We may need to verify your identity before we are able to process your request.
Photography & Marketing
Canal Club Copenhagen staff and contractors may photograph or film experiences for marketing, promotional, and social media purposes. Where photographs or videos capture identifiable guests, we process this data under the lawful basis of consent (GDPR Article 6(1)(a)).
We will inform you at or before the start of your experience that photography may take place for marketing purposes. If you do not wish to appear in Canal Club marketing materials, please inform the Captain or crew verbally or in writing before or at the start of the experience, and we will take all reasonable steps to exclude you from any published content.
You may withdraw your consent for use of photographs in which you are identifiable at any time by contacting us at concierge@canalclub.dk. We will remove such images from active use within a reasonable timeframe, though we may not be able to retrieve images already shared by third parties.
Photographs taken and used without individuals being identifiable (e.g., crowd shots, scenic shots featuring boats and locations) are processed under our legitimate interests and do not require individual consent.
Security Measures
We take the security of your personal data seriously and implement appropriate technical and organisational security measures to protect your data against unauthorised access, accidental loss, alteration, disclosure, or destruction.
Our security measures include, but are not limited to:
- Encrypted secure connections (HTTPS/TLS) across our website and booking platform
- Strict access controls limiting which staff members can access personal data and on a need-to-know basis
- Use of reputable third-party processors with appropriate security certifications and data processing agreements
- Regular internal review and assessment of our data handling and security practices
- Staff awareness and training on data protection obligations
No method of data transmission over the internet or electronic storage can be guaranteed to be 100% secure. While we take all reasonable and proportionate precautions, we cannot guarantee the absolute security of your personal data.
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the Danish Data Protection Authority (Datatilsynet) as required by GDPR Article 33 and 34, without undue delay.
Children's Privacy
Canal Club Copenhagen's experiences are open to guests of all ages, subject to the age restrictions and accompanying adult requirements set out in our Terms and Conditions.
We do not knowingly collect or process personal data directly from children under the age of 16 without the prior verifiable consent of a parent or legal guardian, in accordance with GDPR Article 8 and the Danish Data Protection Act.
Where a booking is made for a group including children, the Lead Booker (as the adult making the booking) is responsible for providing any data relating to those children, and provides it on behalf of the relevant parent or guardian.
If you believe Canal Club Copenhagen has inadvertently collected personal data from a child under 16 without appropriate consent, please contact us immediately at concierge@canalclub.dk and we will take prompt action to delete such data.
Third-Party Links
Our website may contain links to third-party websites, platforms, and services, including social media platforms (Instagram, Facebook, TikTok), our booking platform, review platforms (Google, TripAdvisor, GetYourGuide), and partner websites.
These websites are operated by independent organisations and have their own privacy policies. Canal Club Copenhagen is not responsible for the privacy practices, content, or security of any third-party website. We encourage you to review the privacy policies of any external websites you visit before providing them with your personal data.
The inclusion of a link to a third-party website does not constitute an endorsement of that website by Canal Club Copenhagen.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or business operations. The "Last updated" date at the top of this page indicates when the policy was most recently revised.
When we make material changes to this Privacy Policy, we will notify affected individuals where we hold an active email address, and we will display a prominent notice on our website.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our website or services after any changes have been published constitutes your acknowledgement of the updated policy.
Contact & Supervisory Authority
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us:
- Email: concierge@canalclub.dk
- Phone: +45 31 51 04 44
- Website: canalclubcopenhagen.com
We will respond to all data protection enquiries within one calendar month in accordance with our GDPR obligations.
Danish Supervisory Authority
If you are not satisfied with our response or believe we are processing your personal data in a manner that does not comply with applicable data protection law, you have the right to lodge a complaint with the Danish Data Protection Authority:
Datatilsynet (Danish Data Protection Agency)
- Website: www.datatilsynet.dk
- Email: dt@datatilsynet.dk
- Phone: +45 33 19 32 00
You may also lodge a complaint with the supervisory authority in the EU member state where you habitually reside or work.