GDPR Compliance
Our commitment to protecting your data under the General Data Protection Regulation
Last Updated: January 2024
This page explains how Lush-atoll complies with the General Data Protection Regulation (GDPR) for visitors and customers located in the European Economic Area (EEA), United Kingdom, and Switzerland.
Data Controller
For the purposes of GDPR, the data controller is:
Lush-atoll
247 Lakeview Boulevard
Toronto, ON M4T 2S9
Canada
Legal Basis for Processing
We process personal data under the following legal bases:
- Consent: Where you have given clear consent for us to process your personal data for a specific purpose
- Contractual Necessity: Where processing is necessary for the performance of a contract or to take steps at your request prior to entering into a contract
- Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided those interests do not override your fundamental rights and freedoms
- Legal Obligation: Where processing is necessary for compliance with a legal obligation
Your Rights Under GDPR
If you are located in the EEA, UK, or Switzerland, you have the following rights:
Right of Access
You have the right to request copies of your personal data. We may charge a small fee for this service in certain circumstances.
Right to Rectification
You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
Right to Erasure
You have the right to request that we erase your personal data, under certain conditions.
Right to Restrict Processing
You have the right to request that we restrict the processing of your personal data, under certain conditions.
Right to Data Portability
You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.
Right to Object
You have the right to object to our processing of your personal data, under certain conditions.
Right to Withdraw Consent
Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time.
International Data Transfers
As we are based in Canada, your personal data may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing an adequate level of data protection. For any transfers to other countries, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission.
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. The criteria used to determine retention periods include:
- The duration of our relationship with you
- Legal obligations requiring data retention for certain periods
- Statute of limitations under applicable law
- Guidelines issued by relevant data protection authorities
Automated Decision-Making
We do not engage in automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.
Exercising Your Rights
To exercise any of your rights, please contact us at the address provided above. We will respond to your request within one month, though this period may be extended by two further months where necessary, taking into account the complexity and number of requests.
Complaints
If you believe that we have not complied with your data protection rights, you have the right to lodge a complaint with your local supervisory authority. However, we encourage you to contact us first so we can address your concerns directly.
Updates to This Notice
We may update this GDPR compliance notice from time to time. Any changes will be posted on this page with an updated revision date.