gorge-caribou

Our Commitment to GDPR Compliance

gorge-caribou is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This document outlines how we comply with GDPR requirements and explains your rights as a data subject.

Data Controller Information

For the purposes of GDPR, gorge-caribou acts as the data controller for personal information collected through our website and services.

Data Controller: gorge-caribou
Address: 428 Wellington Street West, Toronto, ON M5V 1E3, Canada
Contact: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so under GDPR Article 6. The specific lawful bases we rely on include:

Consent (Article 6(1)(a))

When you provide explicit consent for us to process your personal data for specific purposes, such as sending marketing communications or using cookies for analytics.

Contract Performance (Article 6(1)(b))

When processing is necessary to fulfill our contractual obligations to you, including providing the focus enhancement services you've requested.

Legal Obligation (Article 6(1)(c))

When we must process your data to comply with legal requirements, such as tax reporting or responding to lawful requests from authorities.

Legitimate Interests (Article 6(1)(f))

When we have legitimate business interests that don't override your fundamental rights and freedoms, such as:

Improving our services and website functionality
Preventing fraud and ensuring security
Internal administrative purposes
Understanding how our services are used

Your Rights Under GDPR

As a data subject under GDPR, you have the following rights regarding your personal data:

Right to Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and to access that data. You can request a copy of your personal information in a structured, commonly used format.

Right to Rectification (Article 16)

You have the right to request correction of inaccurate personal data and to have incomplete data completed.

Right to Erasure (Article 17)

Also known as the "right to be forgotten," you can request deletion of your personal data when:

The data is no longer necessary for the purposes it was collected
You withdraw consent and there's no other legal basis for processing
You object to processing and there are no overriding legitimate grounds
The data has been unlawfully processed
Deletion is required to comply with a legal obligation

Right to Restriction of Processing (Article 18)

You can request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to Object (Article 21)

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right Not to Be Subject to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

Right to Withdraw Consent (Article 7(3))

Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with the subject line "GDPR Rights Request."

Please include:

Your full name and contact information
A clear description of which right you wish to exercise
Any relevant details to help us locate your information

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of the extension and reasons for delay.

Data Protection Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption of personal data in transit and at rest
Regular security assessments and penetration testing
Access controls limiting data access to authorized personnel only
Regular staff training on data protection and security
Data backup and disaster recovery procedures
Incident response and breach notification procedures

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary based on:

The nature of the data and services provided
Legal and regulatory requirements
The purposes for which the data was collected

When data is no longer required, we securely delete or anonymize it in accordance with our data retention policy.

International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

Standard Contractual Clauses approved by the European Commission
Adequacy decisions confirming appropriate protection levels
Other legally approved transfer mechanisms

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
Notify affected individuals without undue delay if the breach poses a high risk
Document all breaches and our response measures

Third-Party Processors

When we engage third-party service providers who process personal data on our behalf, we ensure they:

Process data only according to our documented instructions
Implement appropriate technical and organizational security measures
Comply with GDPR requirements
Sign data processing agreements establishing their obligations

Complaints and Supervisory Authority

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority. While we encourage you to contact us first to resolve any concerns, you can contact:

Canadian Supervisory Authority:
Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Canada

If you are located in the EU/EEA, you may also contact your local data protection authority.

Updates to This Policy

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website or via email.

Contact Us

For questions about our GDPR compliance or to exercise your rights, please contact:

gorge-caribou
428 Wellington Street West
Toronto, ON M5V 1E3
Canada
Email: [email protected]
Subject Line: GDPR Inquiry