GDPR Information

Last Updated: January 15, 2024

About This Notice

This notice provides additional information for individuals located in the European Economic Area (EEA) and the United Kingdom regarding the processing of their personal data in accordance with the General Data Protection Regulation (GDPR).

Data Controller

khaki-fern is the data controller responsible for your personal data. Our contact details are:

khaki-fern
245 Queen Street West, Suite 1200
Toronto, Ontario M5V 1Z4
Canada
Email: [email protected]

Legal Basis for Processing

We process personal data on the following legal bases:

• Consent: When you have given clear consent for us to process your personal data for a specific purpose
• Contract: When processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
• Legal Obligation: When processing is necessary for us to comply with the law
• Legitimate Interests: When processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests

Your Rights Under GDPR

If you are located in the EEA or UK, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you and to check that we are lawfully processing it.

Right to Rectification

You have the right to request that we correct any incomplete or inaccurate personal data we hold about you.

Right to Erasure

You have the right to request that we delete or remove personal data where there is no good reason for us to continue processing it. This is also known as the "right to be forgotten."

Right to Restrict Processing

You have the right to request that we suspend the processing of your personal data in certain circumstances.

Right to Data Portability

You have the right to request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground.

Right to Withdraw Consent

Where we are relying on consent to process your personal data, you have the right to withdraw your consent at any time.

International Transfers

As we are based in Canada, your personal data may be transferred to and processed in Canada. The European Commission has recognized Canada as providing adequate protection for personal data.

Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Exercising Your Rights

To exercise any of your rights, please contact us using the contact details provided above. We will respond to your request within one month. If your request is complex or you have made multiple requests, we may extend this period by a further two months, but we will notify you if this is the case.

You will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

Complaints

If you are not satisfied with how we handle your personal data or respond to your request, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO). In other EEA countries, you can contact your local data protection authority.

Changes to This Notice

We may update this GDPR notice from time to time. We will notify you of any changes by posting the new notice on this page.