GDPR - orchard-caribou

Last Updated: January 15, 2026

Our Commitment to GDPR

orchard-caribou is committed to protecting the privacy and personal data of all individuals, including those residing in the European Union and European Economic Area. We comply with the General Data Protection Regulation (GDPR) and related data protection laws.

Data Controller

orchard-caribou acts as the data controller for personal data collected through our website and services. Our contact information is:

orchard-caribou
245 Heritage Lane, Suite 400
Toronto, ON M5V 2K8
Canada
[email protected]

Legal Basis for Processing

We process personal data only when we have a lawful basis to do so. Our legal bases for processing include:

Consent: When you have given clear consent for us to process your personal data for a specific purpose
Contract: When processing is necessary for a contract we have with you or to take steps at your request before entering into a contract
Legitimate Interests: When processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights
Legal Obligation: When processing is necessary for compliance with a legal obligation

Your Rights Under GDPR

If you are a resident of the EU or EEA, you have the following rights regarding your personal data:

Right of Access: You have the right to request copies of your personal data
Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete
Right to Erasure: You have the right to request that we erase your personal data under certain conditions
Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data under certain conditions
Right to Object: You have the right to object to our processing of your personal data under certain conditions
Right to Data Portability: You have the right to request that we transfer the data we have collected to another organization or directly to you under certain conditions
Right to Withdraw Consent: Where we rely on consent as the legal basis for processing, you have the right to withdraw consent at any time

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex or you have made multiple requests, we may extend this period by up to two additional months, and we will inform you of any extension.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. When determining retention periods, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.

International Data Transfers

As we are based in Canada, personal data collected from EU/EEA residents may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing adequate protection for personal data. Where data is transferred to other countries, we ensure appropriate safeguards are in place.

Data Security

We have implemented appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage. These measures include encryption, access controls, and regular security assessments.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. For EU residents, this would be the data protection authority in your country of residence.

Updates to This Notice

We may update this GDPR compliance notice from time to time. We will post any changes on this page and update the "Last Updated" date.

Contact Us

For questions about GDPR compliance or to exercise your data protection rights, please contact us at: