Overview
The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. At spry-voyage, we are committed to complying with GDPR requirements and protecting the privacy of all our users, regardless of their location.
Data Controller Information
For the purposes of GDPR, the data controller is:
spry-voyage
250 University Avenue, Suite 400
Toronto, Ontario M5H 3E5
Canada
Email: [email protected]
Your Rights Under GDPR
If you are a resident of the European Economic Area, you have the following data protection rights:
Right to Access: You have the right to request copies of your personal data. We may charge a small fee for this service in certain circumstances.
Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
Right to Erasure: You have the right to request that we erase your personal data, under certain conditions. This is also known as the "right to be forgotten."
Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
Right to Object to Processing: You have the right to object to our processing of your personal data, under certain conditions, particularly where we process data for direct marketing purposes.
Right to Data Portability: You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.
Lawful Bases for Processing
We process personal data only when we have a lawful basis to do so. Our lawful bases include:
- Consent: You have given clear consent for us to process your personal data for a specific purpose.
- Contract: Processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
- Legitimate Interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those interests.
- Legal Obligation: Processing is necessary for us to comply with the law.
Data We Collect
We collect and process the following categories of personal data:
- Identity data (name)
- Contact data (email address)
- Service preference data (services of interest)
- Technical data (IP address, browser type, device information)
- Usage data (how you use our website)
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Specific retention periods depend on the nature of the data and our legal obligations. When data is no longer needed, it is securely deleted or anonymized.
International Transfers
As we are based in Canada, your data may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing adequate protection for personal data. Where we transfer data to other countries, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.
Data Security
We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit
- Regular security assessments
- Access controls and authentication procedures
- Employee training on data protection
Exercising Your Rights
To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month. In certain circumstances, we may need to extend this period by up to two additional months, in which case we will inform you of the extension and the reasons for it.
You will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
Right to Lodge a Complaint
If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with a supervisory authority. For EEA residents, this would typically be the data protection authority in your country of residence.
Changes to This Information
We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated revision date.