GDPR Compliance

Last Updated: January 2024

Overview

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to organizations processing personal data of individuals in the European Union. Although Common Downpour is based in Canada, we are committed to providing robust data protection for all our website visitors and clients, regardless of location.

This page outlines how we comply with GDPR principles and the rights available to you regarding your personal data.

Our Commitment to Data Protection

We process personal data in accordance with the following principles:

• Lawfulness, Fairness, and Transparency: We process data lawfully and in a manner that is fair and transparent to you.
• Purpose Limitation: We collect data only for specified, explicit, and legitimate purposes and do not process it in ways incompatible with those purposes.
• Data Minimization: We collect only the personal data that is necessary for the purposes for which it is processed.
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date.
• Storage Limitation: We retain personal data only for as long as necessary for the purposes for which it was collected.
• Integrity and Confidentiality: We implement appropriate security measures to protect personal data against unauthorized processing, loss, or damage.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you have given clear consent for us to process your personal data for a specific purpose, such as receiving communications from us.
• Contract: When processing is necessary for the performance of a contract with you, such as processing appointment requests.
• Legitimate Interests: When processing is necessary for our legitimate interests, provided these are not overridden by your rights. This includes improving our services and website functionality.
• Legal Obligation: When we are required to process data to comply with applicable laws.

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

• Right to Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: You have the right to request deletion of your personal data in certain circumstances, also known as the "right to be forgotten."
• Right to Restrict Processing: You have the right to request that we limit how we use your personal data in certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data for certain purposes, including direct marketing.
• Right to Withdraw Consent: Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority if you believe your rights have been violated.

Exercising Your Rights

To exercise any of these rights, please contact us using the information provided below. We will respond to your request within one month of receipt. If your request is complex or we receive numerous requests, we may extend this period by up to two additional months, in which case we will inform you of the extension and the reasons for it.

We may request specific information from you to help us confirm your identity and ensure we are releasing data to the right person. This is a security measure to protect your personal data.

Data Transfers

As a Canadian organization, any personal data you provide may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing an adequate level of protection for personal data, which means your data is protected under equivalent standards when transferred to Canada.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. The specific retention period depends on the nature of the data and the purposes for which it is processed:

• Appointment request data is retained for up to 24 months after your last appointment.
• Communication records are retained for up to 12 months.
• Cookie consent preferences are stored for up to 12 months.

When personal data is no longer required, we securely delete or anonymize it.

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using HTTPS
• Regular security assessments and updates
• Access controls limiting who can access personal data
• Staff training on data protection practices

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

Contact Information

If you have any questions about our GDPR compliance or wish to exercise your data protection rights, please contact us at:

Common Downpour
247 Wellington Street
Toronto, ON M5V 3C7
Canada
Email: [email protected]

We aim to resolve any concerns you have about our use of your personal data. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.