GDPR Data Protection Information

1. Introduction

While Reed-bear operates primarily in Canada, we recognize that some of our website visitors and customers may be located in the European Union or European Economic Area. This page outlines how we comply with the General Data Protection Regulation (GDPR) and what rights you have regarding your personal data.

The GDPR provides enhanced privacy protections for individuals in the EU/EEA. Even though Canadian privacy laws offer similar protections, we want to ensure EU/EEA residents understand their specific rights under GDPR.

2. Data Controller

For purposes of GDPR, Reed-bear acts as the data controller for personal information collected through our website and services. Our contact information is:

Reed-bear
287 King Street East
Toronto, ON M5A 1K2
Canada
Email: [email protected]

3. Legal Basis for Processing

We process personal data under the following legal bases:

Contractual Necessity

When you book services with us, we process your personal information as necessary to fulfill that contract, including coordinating schedules, providing confirmations, and delivering the services you've purchased.

Legitimate Interest

We process certain data based on our legitimate business interests, such as analyzing website traffic to improve user experience, maintaining security, and communicating about services similar to those you've used. We balance these interests against your privacy rights and provide opt-out options where appropriate.

Consent

For certain activities like marketing communications beyond transactional emails, we rely on your explicit consent. You can withdraw consent at any time without affecting the lawfulness of processing conducted before withdrawal.

Legal Obligation

In some cases, we process data to comply with legal requirements, such as maintaining financial records for tax purposes or responding to valid legal requests from authorities.

4. Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right of Access

You can request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information in a commonly used electronic format.

Right to Rectification

If personal data we hold about you is inaccurate or incomplete, you have the right to request correction or completion of that information.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when you object to processing and no overriding legitimate grounds exist.

Right to Restriction of Processing

In certain circumstances, you can request that we limit how we use your personal data, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive personal data you've provided to us in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

We do not currently engage in automated decision-making or profiling that produces legal effects or similarly significant impacts. If this changes, we will update this policy and provide appropriate information and safeguards.

5. Exercising Your Rights

To exercise any of the rights described above, please contact us at [email protected] with the subject line "GDPR Request." Please specify which right you wish to exercise and provide sufficient information to verify your identity.

We will respond to your request within one month, though this period may be extended by two additional months for complex requests. We will inform you of any such extension within the initial one-month period.

You will not be charged a fee for exercising your rights unless requests are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse to act on the request.

6. Data Transfers

As a Canadian organization, personal data you provide is processed and stored in Canada. Canada has received an adequacy decision from the European Commission, recognizing that Canadian privacy law provides an adequate level of protection for personal data.

We do not routinely transfer personal data to other countries. If circumstances require such transfers, we will ensure appropriate safeguards are in place as required by GDPR.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations. Typical retention periods include:

• Booking and service records: 3 years from the date of service
• Financial records: 7 years as required by Canadian tax law
• Marketing communications records: until you opt out or withdraw consent
• Website analytics data: 90 days in identifiable form

After retention periods expire, we securely delete or anonymize personal data.

8. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures are reviewed regularly and updated as necessary to maintain adequate security.

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities as required by GDPR, typically within 72 hours of becoming aware of the breach.

9. Children's Data

Our services are not directed to children under 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate parental consent, we will delete it promptly.

10. Right to Lodge a Complaint

If you believe we have processed your personal data in violation of GDPR, you have the right to lodge a complaint with a supervisory authority, particularly in the EU member state where you reside, where you work, or where the alleged violation occurred.

We encourage you to contact us first so we can address your concerns directly, but this does not limit your right to approach a supervisory authority.

11. Changes to This Information

We may update this GDPR information periodically to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website and, where appropriate, directly to affected individuals.

12. Contact and Questions

For questions about GDPR compliance or to exercise your rights, contact us at:

Reed-bear
287 King Street East
Toronto, ON M5A 1K2
Canada
Email: [email protected]
Subject: GDPR Inquiry