GDPR Compliance

Our Commitment to GDPR

turquoise-moss is committed to protecting the privacy and rights of individuals in accordance with the General Data Protection Regulation (GDPR). This page outlines our approach to GDPR compliance and explains the rights available to data subjects under this regulation.

Legal Basis for Processing

We process personal data only when we have a lawful basis to do so. The legal bases we rely on include:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose.
• Contract: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legal Obligation: Where processing is necessary for compliance with a legal obligation to which we are subject.
• Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

Right of Access

You have the right to request access to the personal data we hold about you. This includes the right to obtain confirmation as to whether personal data concerning you is being processed, and where that is the case, access to the personal data and information about the processing.

Right to Rectification

You have the right to request correction of inaccurate personal data and to have incomplete personal data completed.

Right to Erasure

You have the right to request the deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purpose for which it was collected, when you withdraw consent (where consent was the legal basis for processing), or when the data has been unlawfully processed.

Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when processing is unlawful but you oppose erasure.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to have that data transmitted to another controller without hindrance, where technically feasible.

Right to Object

You have the right to object to the processing of your personal data in certain circumstances, including processing based on legitimate interests or processing for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the processing is necessary for entering into or performing a contract, authorized by law, or based on your explicit consent.

Data Protection Officer

For questions regarding our GDPR compliance or to exercise your rights under the GDPR, please contact us at the address provided below. We will respond to your request within the timeframes required by the GDPR.

International Data Transfers

When we transfer personal data outside the EEA, we ensure that appropriate safeguards are in place to protect your data. These safeguards may include standard contractual clauses approved by the European Commission or other legally recognized transfer mechanisms.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the appropriate supervisory authority within 72 hours of becoming aware of the breach, where feasible. We will also notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms.

Data Protection by Design

We implement data protection principles from the initial design stages of our processing activities and throughout their lifecycle. This includes implementing appropriate technical and organizational measures to ensure that, by default, only personal data which is necessary for each specific purpose of the processing is collected and processed.

Exercising Your Rights

To exercise any of your rights under the GDPR, please contact us at:

turquoise-moss
250 University Avenue, Suite 800
Toronto, ON M5H 3E5
Canada
[email protected]

We will respond to your request within one month. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receiving the request.

Complaints

If you are not satisfied with how we handle your personal data or believe we have not complied with GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.