GDPR Compliance

Our Commitment to Data Protection

meadow-saga is committed to protecting the personal data of all individuals, including those in the European Union (EU) and European Economic Area (EEA). Although we are a Canadian company, we recognize the importance of the General Data Protection Regulation (GDPR) and have implemented measures to comply with its requirements when processing personal data of EU and EEA residents.

What is GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It establishes rules for how organizations must handle and protect personal data of individuals in the EU and EEA. The regulation applies to any organization that processes personal data of EU residents, regardless of where the organization is located.

Personal Data We Process

When you interact with our website or services, we may process the following categories of personal data:

• Identity Data: Name, job title, organization name
• Contact Data: Email address, mailing address
• Technical Data: IP address, browser type, device information
• Usage Data: Information about how you use our website
• Communication Data: Your preferences for receiving communications from us

Legal Basis for Processing

Under GDPR, we must have a valid legal basis for processing your personal data. We rely on the following legal bases:

• Consent: Where you have given us explicit consent to process your data for specific purposes, such as receiving marketing communications
• Contractual Necessity: Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract
• Legitimate Interests: Where processing is necessary for our legitimate business interests, provided these interests do not override your fundamental rights and freedoms
• Legal Obligation: Where processing is necessary to comply with a legal obligation

Your Rights Under GDPR

If you are a resident of the EU or EEA, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you and information about how we process it.

Right to Rectification

You have the right to request that we correct any inaccurate personal data we hold about you or complete any incomplete data.

Right to Erasure

You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes.

Right to Withdraw Consent

Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data violates the GDPR.

Exercising Your Rights

To exercise any of your rights under GDPR, please contact us using the information provided below. We will respond to your request within one month of receiving it. In some cases, we may need to verify your identity before processing your request.

Please note that some of these rights are not absolute and may be subject to exceptions. We will inform you if any exceptions apply to your request.

International Data Transfers

As a Canadian organization, when we collect personal data from individuals in the EU or EEA, that data may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing an adequate level of data protection, which means that personal data can be transferred from the EU to Canada without additional safeguards under GDPR.

Where we transfer data to countries that have not received an adequacy decision, we implement appropriate safeguards such as standard contractual clauses approved by the European Commission.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and the purposes for which we process the data.

Data Security

We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risks presented by our processing activities. These measures include:

• Encryption of personal data where appropriate
• Access controls to limit who can access personal data
• Regular security assessments and testing
• Staff training on data protection
• Incident response procedures

Data Protection Officer

While we are not required to appoint a Data Protection Officer under GDPR, we have designated a privacy contact to handle data protection matters. You can reach our privacy contact using the information below.

Contact Us

If you have questions about GDPR compliance or wish to exercise your rights, please contact us at:

meadow-saga
350 Bay Street, Suite 1200
Toronto, Ontario M5H 2S6
Canada

Email: [email protected]

Updates to This Page

We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated revision date.