GDPR Compliance

Our Commitment to GDPR

topaz-sprout is committed to ensuring the security and protection of the personal information that we process, and to providing a compliant and consistent approach to data protection. We have implemented robust organizational and technical measures to ensure our compliance with the General Data Protection Regulation (GDPR) for all individuals whose data we process.

Data Controller

topaz-sprout acts as the data controller for personal information collected through our website and services. As the data controller, we determine the purposes and means of processing personal data and are responsible for ensuring compliance with data protection regulations.

Contact details:
topaz-sprout
145 Wellington Street West, Suite 400
Toronto, ON M5J 1H8
Canada
[email protected]

Your Rights Under GDPR

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your personal data.

Right to Access

You have the right to request access to the personal data we hold about you. This allows you to receive a copy of the personal data we hold and to check that we are lawfully processing it.

Right to Rectification

You have the right to request correction of personal data that we hold about you if it is incomplete or inaccurate.

Right to Erasure

You have the right to request that we delete or remove personal data when there is no good reason for us to continue processing it, or when you have successfully exercised your right to object to processing.

Right to Restrict Processing

You have the right to request that we suspend the processing of your personal data in certain circumstances, such as if you want us to establish the data's accuracy or the reason for processing it.

Right to Data Portability

You have the right to request the transfer of your personal data to you or to a third party in a commonly used, machine-readable format.

Right to Object

You have the right to object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation that makes you want to object to processing on this ground.

Right to Withdraw Consent

Where we are relying on consent to process your personal data, you have the right to withdraw that consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

Lawful Basis for Processing

We process personal data under one or more of the following lawful bases:

• Consent: You have given clear consent for us to process your personal data for a specific purpose.
• Contract: Processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
• Legitimate Interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.
• Legal Obligation: Processing is necessary for us to comply with the law.

International Transfers

As a Canadian organization, some personal data may be transferred to and stored in locations outside the EEA. When we transfer data outside the EEA, we ensure appropriate safeguards are in place to protect your personal data in accordance with GDPR requirements.

Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.

Security Measures

We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Secure storage and access controls
• Regular security assessments
• Staff training on data protection
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

Exercising Your Rights

To exercise any of your rights under GDPR, please contact us at [email protected]. We will respond to your request within one month. In certain circumstances, we may extend this period by two further months if the request is complex or we receive a number of requests.

There is no fee for exercising your rights in most cases. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

Complaints

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

Updates to This Information

We may update this GDPR compliance information from time to time. We encourage you to periodically review this page for the latest information on our privacy practices.