GDPR Compliance

Last Updated: November 2024

Undersfrin is committed to complying with the General Data Protection Regulation (GDPR) for individuals located in the European Economic Area (EEA). This page provides information about how we process personal data in accordance with GDPR requirements and explains your rights as a data subject.

Data Controller

For the purposes of the GDPR, Undersfrin acts as the data controller for personal data collected through our website and in connection with our services. Our contact details are:

Undersfrin
245 Wellington Street West, Suite 1400
Toronto, Ontario M5V 3E7
Canada

Email: [email protected]

Legal Bases for Processing

We process personal data only when we have a valid legal basis to do so. The legal bases we rely on include:

• Consent: Where you have given us explicit consent to process your personal data for specific purposes, such as receiving marketing communications.
• Contractual Necessity: Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
• Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.
• Legal Obligation: Where processing is necessary to comply with a legal obligation to which we are subject.

Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you and information about how we process it.

Right to Rectification

You have the right to request that we correct any inaccurate personal data we hold about you or complete any incomplete data.

Right to Erasure

You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where we rely on consent as the legal basis for processing, you have the right to withdraw your consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

Exercising Your Rights

To exercise any of your rights under the GDPR, please contact us at [email protected]. We will respond to your request within one month of receipt. If your request is complex or we receive numerous requests, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it.

We may need to verify your identity before processing your request. We will not charge a fee for exercising your rights unless your request is manifestly unfounded or excessive.

International Data Transfers

As we are based in Canada, your personal data may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing an adequate level of protection for personal data. Where we transfer data to other countries, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. The retention period depends on the nature of the data and the purposes for processing. When determining retention periods, we consider legal requirements, the nature of our relationship with you, and whether we need to retain data for potential disputes.

Automated Decision-Making

We do not use automated decision-making, including profiling, in a way that produces legal effects concerning you or similarly significantly affects you.

Right to Lodge a Complaint

If you are not satisfied with how we handle your personal data or your request to exercise your rights, you have the right to lodge a complaint with a supervisory authority. If you are located in the EEA, you may contact your local data protection authority.

Changes to This Notice

We may update this GDPR compliance notice from time to time. We will notify you of any material changes by posting the updated notice on our website with a revised "Last Updated" date.