peak-fable

Legal Basis for Processing

We process personal data under the following legal bases as defined by GDPR:

Consent: When you provide explicit permission for specific processing activities
Contract Performance: When processing is necessary to deliver services you've requested
Legal Obligation: When we must process data to comply with legal requirements
Legitimate Interest: When processing supports our business operations without overriding your rights

Your Rights Under GDPR

If you are located in the European Economic Area, you have specific rights regarding your personal data:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate personal information or completion of incomplete data.

Right to Erasure

You can request deletion of your personal data under certain circumstances, including when data is no longer necessary for its original purpose or when you withdraw consent.

Right to Restrict Processing

You can request limitation of how we use your data in specific situations, such as while verifying data accuracy.

Right to Data Portability

You can request transfer of your data to another service provider in a structured, commonly used format.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produces legal effects or similarly significant impacts.

How to Exercise Your Rights

To exercise any of these rights, submit a request to [email protected]. Include sufficient detail to identify yourself and specify which right you wish to exercise.

We will respond to valid requests within one month. Complex requests may require additional time, in which case we will notify you of the extension.

Data Transfers

Your information may be processed in Canada or other jurisdictions where our service providers operate. When transferring data outside the EEA, we implement appropriate safeguards to ensure adequate protection as required by GDPR.

Data Protection Officer

For questions specifically about data protection practices or to contact our data protection representative, email [email protected] with "Data Protection Inquiry" in the subject line.

Supervisory Authority

If you believe our processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority in your jurisdiction, particularly in the EU member state where you reside, work, or where the alleged infringement occurred.

Data Retention Periods

We retain personal data only as long as necessary for the purposes outlined in our Privacy Policy or as required by law. Specific retention periods vary based on data type and purpose:

Client engagement data: Duration of engagement plus six years for legal compliance
Marketing communications data: Until consent is withdrawn or three years of inactivity
Website analytics: Aggregated and anonymized after 26 months

Security Measures

We implement technical and organizational measures to ensure data security appropriate to the risks, including encryption, access controls, regular security assessments, and staff training on data protection.