California Privacy Notice

Rocky Mountaineer, for the purpose of our business or for the purpose of your interactions with our website, collects and uses the following categories of personal data:

Rocky Mountaineer collects these categories of personal data from the following sources:

• Directly from the individual the information is about.
• Indirectly form travel agents and other companies involved in facilitating your travel arrangements.
• Indirectly from an individual’s interaction with our website.

We use and disclose personal data in accordance with the purposes established in the “How we collect and process your personal data” and “who has access to your personal data” sections of the general Privacy Notice.

Rocky Mountaineer has shared personal data in the last twelve months on all the categories identified in this Privacy Notice for the purposes described.

As the term is defined by the CPRA, we "sold" the following categories of your personal data in the last 12 months: identifiers, online activity information, and inferences drawn from personal data. We "sold" each category to advertising networks, data analytics providers, and social networks.

The business or commercial purposes of "selling" personal information is for third-party companies to perform services on our behalf, such as marketing, advertising, and audience measurement.

The CPRA provides California residents with rights over their personal data. As a California resident, you have the following rights with respect to your personal data:

• You have the right to request to know about personal data collected, disclosed, or sold.
• You have the right to rectify any personal data that we hold about you that, in your opinion, is not correct.
• You have the right to request the deletion of personal data.
• You have the right to portability, which means that you may request that we provide you a copy of specific pieces of personal information we have collected about you in the past 12 months in an electronic format.
• You have the right to request that we limit the disclosure of your sensitive personal information unless the disclosure is required for the provision of our services to you or for any other regulatory or legal requirements.
• You have the right to opt-out of the sale of your personal data at any time.

Once we receive a request from you to disclose how your personal data has been collected, used and shared by Rocky Mountaineer over the last twelve months, we will verify your identity and will share with you the following information:

• Categories of personal data Rocky Mountaineer collected about you.
• The sources where we obtained your personal data from.
• The purposes of use of your personal data.
• The third-parties we shared your personal data with.
• Whether we sold or shared your personal data for Rocky Mountaineer’s benefit.

Other rights over your personal data will be managed according to the general Privacy Notice section that details what rights you have regarding your personal data.

We aim to respond to your requests within the established 45 days from receipt. If we require more time to respond, we will let you know within this period. We will deliver our response by mail or electronically, depending on your preference.

We will not discriminate against you for exercising your personal data rights.

We do not perform any automated decision-making with the personal data that we collect about you and do not plan to do so without letting you know in advance.

You may designate an authorized agent to make requests on your behalf. We will require verification that you did, in fact, authorize the agent. Unless the law requires otherwise, your authorized agent must provide contact details for you. We will contact you to confirm that you authorized the agent. Once you confirm, we will promptly respond to the rights request.

To exercise your rights, you may contact us at privacy_officer@rockymountaineer.com or by calling +1-833-824-0021 (toll free). In order to fulfill your request, we may require additional personal information for purposes of verifying your identity. If you make a request through an authorized agent, we may require additional information to verify your authorization of the agent.