GDPR Compliance
Our commitment to European data protection standards.
Last updated: January 2024
Our Commitment to GDPR
Although moss-marmot is based in Canada, we recognize the importance of the General Data Protection Regulation (GDPR) for individuals in the European Economic Area (EEA). This page outlines how we comply with GDPR requirements when processing personal data of EEA residents.
Legal Basis for Processing
When we process personal data of EEA residents, we rely on one or more of the following legal bases:
- Consent: Where you have given clear consent for us to process your personal data for specific purposes.
- Contractual Necessity: Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
- Legal Obligation: Where processing is necessary to comply with applicable laws and regulations.
- Legitimate Interests: Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.
Your Rights Under GDPR
If you are a resident of the EEA, you have the following rights regarding your personal data:
- Right of Access: You have the right to request a copy of the personal data we hold about you.
- Right to Rectification: You have the right to request correction of inaccurate personal data.
- Right to Erasure: You have the right to request deletion of your personal data in certain circumstances.
- Right to Restriction: You have the right to request restriction of processing in certain circumstances.
- Right to Data Portability: You have the right to receive your personal data in a structured, commonly used format.
- Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.
- Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw that consent at any time.
Exercising Your Rights
To exercise any of your rights under GDPR, please contact our Data Protection contact using the details provided below. We will respond to your request within one month, though this period may be extended by two further months where necessary, taking into account the complexity and number of requests.
We may need to verify your identity before processing your request. If we cannot verify your identity, we may request additional information from you.
International Data Transfers
As a Canadian company, any transfer of personal data from the EEA to Canada benefits from the European Commission's adequacy decision recognizing Canada as providing an adequate level of data protection for commercial organizations subject to PIPEDA.
Where data is transferred to jurisdictions without an adequacy decision, we implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable laws. Our retention periods are determined based on the nature of the data, the purposes of processing, and legal requirements.
Data Security
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing. These measures include encryption, access controls, regular security assessments, and staff training on data protection.
Data Protection Contact
For GDPR-related inquiries or to exercise your data protection rights, please contact:
Email: [email protected]
Address: Data Protection Contact, moss-marmot, 1847 West Georgia Street, Suite 420, Vancouver, BC V6G 2T3, Canada
Supervisory Authority
If you are not satisfied with our response to your inquiry or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with your local data protection supervisory authority in the EEA.