GDPR Compliance
Our commitment to data protection for European users
Overview
indigo-cliff is committed to complying with the General Data Protection Regulation (GDPR) for any personal data we process that relates to individuals in the European Economic Area (EEA). This page outlines how we meet GDPR requirements and how you can exercise your rights.
Our Role Under GDPR
Depending on the context, indigo-cliff may act as either a Data Controller or a Data Processor:
- Data Controller: When we collect personal information directly from you for our own business purposes (such as account registration and customer support).
- Data Processor: When we store and process documents that you upload to our platform on your behalf.
Legal Basis for Processing
We process personal data under the following legal bases:
- Contract: Processing necessary to provide our services to you
- Legitimate Interests: Processing for business operations, security, and service improvement
- Consent: Processing based on your explicit consent, where applicable
- Legal Obligation: Processing required to comply with applicable laws
Your Rights Under GDPR
If you are located in the EEA, you have the following rights regarding your personal data:
Right of Access
You have the right to request a copy of the personal data we hold about you. We will provide this information within 30 days of your request.
Right to Rectification
You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
Right to Erasure
You have the right to request deletion of your personal data, subject to certain exceptions such as legal retention requirements.
Right to Restrict Processing
You have the right to request that we limit how we use your personal data in certain circumstances.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to Object
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision Making
You have the right not to be subject to decisions based solely on automated processing that produce legal effects. We do not currently use automated decision-making that would fall under this provision.
International Data Transfers
All data stored through our services remains within Canada. If we transfer personal data outside of Canada, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by relevant authorities.
Data Protection Officer
For GDPR-related inquiries, you may contact our Data Protection Officer at:
Email: [email protected]
Supervisory Authority
If you are located in the EEA and believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local supervisory authority.
Exercising Your Rights
To exercise any of your rights under GDPR, please contact us at:
indigo-cliff
150 King Street West, Suite 2100
Toronto, ON M5H 1J9
Canada
Email: [email protected]
We will respond to all legitimate requests within 30 days. If your request is complex or you have made multiple requests, we may extend this period by an additional 60 days, in which case we will notify you.