GDPR Compliance

Plum Harbor is committed to complying with the General Data Protection Regulation (GDPR) and ensuring the protection of personal data for individuals in the European Union and European Economic Area. This page outlines our approach to GDPR compliance and your rights under this regulation.

About the GDPR

The General Data Protection Regulation is a comprehensive data protection law that came into effect on May 25, 2018. It establishes requirements for how organizations collect, store, process, and protect personal data of EU residents. The GDPR provides individuals with significant rights over their personal information and imposes strict obligations on data controllers and processors.

Our Role as Data Controller

When you interact with Plum Harbor, we act as a data controller for your personal information. This means we determine the purposes and means of processing your personal data. As such, we are responsible for ensuring that your data is handled in compliance with GDPR requirements.

Lawful Basis for Processing

Under the GDPR, we must have a valid legal basis for processing your personal data. We rely on the following lawful bases:

• Consent: Where you have provided clear, affirmative consent for us to process your personal data for specific purposes, such as receiving marketing communications.
• Contract: Where processing is necessary for the performance of a contract with you, such as providing language courses you have enrolled in.
• Legitimate Interests: Where we have a legitimate business interest in processing your data, and this interest is not overridden by your rights and freedoms.
• Legal Obligation: Where we are required by law to process certain information.

Your Rights Under GDPR

The GDPR provides you with several important rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information free of charge within one month of receiving your request.

Right to Rectification

If you believe that any information we hold about you is inaccurate or incomplete, you have the right to request correction. We will respond to rectification requests within one month.

Right to Erasure

Also known as the "right to be forgotten," you can request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected, or when you withdraw consent.

Right to Restrict Processing

You can request that we limit the processing of your personal data in specific situations, such as while we verify the accuracy of contested data or while we assess a legitimate interest claim.

Right to Data Portability

Where technically feasible, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. If you object to direct marketing, we will cease processing your data for that purpose immediately.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.

International Data Transfers

If we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to provide adequate protection for your data.

Data Protection Officer

While we may not be legally required to appoint a Data Protection Officer, we have designated a privacy team responsible for overseeing GDPR compliance and addressing data protection concerns.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

Exercising Your Rights

To exercise any of your GDPR rights, please submit a request to us using the contact information below. We may ask you to verify your identity before processing your request. We will respond to all legitimate requests within one month. In complex cases, we may extend this period by two additional months, but we will inform you of any such extension within the initial one-month period.

Complaints

If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with a supervisory authority. For EU residents, this would typically be the data protection authority in your country of residence.

Contact Us

For questions about GDPR compliance or to exercise your data protection rights, please contact us:

Plum Harbor
456 Learning Avenue, Suite 210
Toronto, ON M5V 2T6, Canada
Email: [email protected]