GDPR Compliance

Our Commitment to Data Protection

Calm Derrick is committed to protecting the privacy and security of your personal data. Although we are based in Canada, we respect the principles of the General Data Protection Regulation (GDPR) for visitors from the European Union and European Economic Area.

Data Controller

Calm Derrick acts as the data controller for personal information collected through this website. We determine the purposes and means of processing your personal data.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: When you submit a booking request or accept cookies, you provide consent for us to process your data for those specific purposes.
• Legitimate interests: We may process data when it is in our legitimate business interests, such as improving our services or website functionality.
• Legal obligation: We may process data to comply with legal requirements.

Your Rights Under GDPR

If you are located in the EU or EEA, you have the following rights:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can request that we correct inaccurate or incomplete data.
• Right to erasure: You can request that we delete your personal data in certain circumstances.
• Right to restrict processing: You can request that we limit how we use your data.
• Right to data portability: You can request a copy of your data in a structured, machine-readable format.
• Right to object: You can object to certain types of processing, including direct marketing.
• Right to withdraw consent: You can withdraw your consent at any time where processing is based on consent.

How to Exercise Your Rights

To exercise any of your rights, please contact us at [email protected]. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

Data Transfers

Your data is stored and processed in Canada. Canada has been recognized by the European Commission as providing an adequate level of data protection. If we transfer data to other countries, we will ensure appropriate safeguards are in place.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Booking request data is retained for up to 12 months after the service date or the date of the request if no service was provided.

Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Secure data transmission protocols
• Access controls limiting who can view personal data
• Regular security assessments
• Staff training on data protection

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours. If the breach is likely to result in a high risk to you, we will also notify you directly.

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. For EU residents, this is typically the data protection authority in your country of residence.

Updates to This Notice

We may update this GDPR notice periodically. Changes will be posted on this page with an updated effective date.

Contact Us

For any questions about this GDPR notice or our data protection practices, please contact us at [email protected].

Last updated: September 2024