GDPR Compliance
Last updated: November 2024
Our Commitment to Data Protection
We respect your privacy rights under the General Data Protection Regulation (GDPR) and similar data protection laws. This page explains how we comply with GDPR requirements when processing personal data of individuals in the European Economic Area.
Legal Basis for Processing
We process your personal data based on the following legal grounds:
- Contract Performance: Processing necessary to fulfill our training program agreements with you
- Legitimate Interests: Improving our services, website functionality, and business operations
- Consent: Marketing communications and optional features (you may withdraw consent anytime)
- Legal Obligations: Compliance with applicable laws and regulations
Your GDPR Rights
Under GDPR, you have the following rights regarding your personal data:
Right to Access
You may request confirmation of whether we process your personal data and obtain a copy of that data.
Right to Rectification
You may request correction of inaccurate personal data or completion of incomplete data.
Right to Erasure
You may request deletion of your personal data under certain circumstances, such as when data is no longer necessary for the purposes collected or when you withdraw consent.
Right to Restriction of Processing
You may request limitation of processing in specific situations, such as when disputing data accuracy.
Right to Data Portability
You may request to receive your personal data in a structured, commonly used format and transmit it to another controller.
Right to Object
You may object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time without affecting prior processing.
Right to Lodge a Complaint
You may file a complaint with a supervisory authority in your jurisdiction if you believe we have violated your data protection rights.
Data Controller Information
For purposes of GDPR, the data controller is:
maroon-hollow
142 King Street West, Suite 300
Toronto, ON M5H 1J5
Canada
Email: [email protected]
International Data Transfers
We are based in Canada. If you are located in the European Economic Area, your personal data may be transferred to and processed in Canada. We ensure appropriate safeguards are in place for such transfers in accordance with GDPR requirements.
Data Processing Activities
We process personal data for the following purposes:
- Program enrollment and participant management
- Communication regarding sessions and materials
- Providing access to educational content and recordings
- Customer support and inquiry responses
- Website functionality and analytics
- Marketing communications (with consent)
Data Security Measures
We implement appropriate technical and organizational measures to protect personal data, including:
- Encryption of data in transit and at rest
- Access controls and authentication mechanisms
- Regular security assessments
- Employee training on data protection
- Incident response procedures
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes outlined in our Privacy Policy or as required by law. After program completion, we maintain enrollment records for six years for administrative and legal compliance purposes.
Third-Party Processors
We engage third-party service providers who process personal data on our behalf. All processors are selected carefully and bound by data processing agreements ensuring GDPR compliance.
Exercising Your Rights
To exercise any of your GDPR rights, please contact us at [email protected] with your request. We will respond within one month, though this period may be extended by two additional months for complex requests.
When submitting a request, please provide sufficient information to verify your identity and specify which right you wish to exercise.
Updates to This Notice
We may update this GDPR compliance notice to reflect changes in our practices or legal requirements. Material changes will be communicated to enrolled participants via email.