Information for individuals protected by the General Data Protection Regulation
Last Updated: September 2024
Solar-heron recognizes the importance of the General Data Protection Regulation (GDPR) and is committed to ensuring that we handle personal data of individuals in the European Economic Area (EEA) in accordance with GDPR requirements. This page provides additional information specific to GDPR compliance.
Solar-heron acts as the data controller for personal information collected through our website and enrollment processes. Our contact details are:
Solar-heron
245 Technology Boulevard, Suite 800
Toronto, Ontario M5V 3K2
Canada
Email: [email protected]
We process personal data under the following legal bases as defined by GDPR:
If you are located in the EEA, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you and to receive information about how it is processed.
You have the right to request correction of inaccurate personal data or completion of incomplete data.
You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
You have the right to request that we limit how we use your personal data in certain circumstances.
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
As a Canadian organization, personal data transferred from the EEA to Canada is protected by an adequacy decision from the European Commission, which recognizes Canada as providing adequate data protection under PIPEDA (Personal Information Protection and Electronic Documents Act).
Where we engage service providers located outside of countries with adequacy decisions, we implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required by law. When determining retention periods, we consider the nature and sensitivity of the data, potential risks from unauthorized use or disclosure, and applicable legal requirements.
We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects individuals.
To exercise any of your rights under GDPR, please contact us using the following details:
Email: [email protected]
Subject Line: GDPR Data Subject Request
We will respond to your request within 30 days. In complex cases or where we receive a high volume of requests, we may extend this period by up to two additional months, in which case we will inform you of the extension and the reasons for it.
If you believe that we have not handled your personal data properly or have failed to respond to your requests to exercise your rights, you have the right to lodge a complaint with a supervisory authority. You may do so in the EU member state of your habitual residence, place of work, or place of the alleged infringement.
We may update this GDPR compliance information from time to time to reflect changes in our practices or legal requirements. We encourage you to review this page periodically for the latest information.