Your data protection rights under the General Data Protection Regulation
Vermilion-moss is committed to protecting the privacy and security of personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This page provides information about how we comply with GDPR requirements when processing personal data of individuals in the European Economic Area (EEA) and the United Kingdom.
For the purposes of GDPR, Vermilion-moss is the data controller responsible for your personal data. Our contact details are:
Vermilion-moss
250 University Avenue, Suite 800
Toronto, Ontario M5H 3E5
Canada
Email: [email protected]
We process personal data only when we have a lawful basis to do so. The legal bases we rely on include:
Under the GDPR, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you. We will provide this information free of charge within one month of receiving your request.
You have the right to request that we correct any inaccurate personal data we hold about you, or complete any incomplete data.
You have the right to request that we delete your personal data in certain circumstances, including when:
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
You have the right to object to processing of your personal data in certain circumstances, including processing for direct marketing purposes.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
As Vermilion-moss is based in Canada, personal data may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing an adequate level of protection for personal data. For any transfers to other countries, we ensure appropriate safeguards are in place, such as:
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Specific retention periods depend on the type of data and the purpose of processing:
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.
To exercise any of your rights under GDPR, please contact us at:
Email: [email protected]
We will respond to your request within one month. In complex cases, we may extend this period by up to two months, in which case we will inform you of the extension and the reasons for it.
If you believe that we have not complied with your data protection rights, you have the right to lodge a complaint with a supervisory authority. For individuals in the EEA, this is the supervisory authority in the EU member state where you reside, work, or where the alleged infringement occurred.
We may update this GDPR compliance notice from time to time. We will notify you of significant changes by posting a notice on our website or by contacting you directly.