GDPR Compliance Statement
Last updated: January 2024
Areoa-gxru is committed to protecting the personal data of all individuals, including those in the European Economic Area (EEA). This page outlines our compliance with the General Data Protection Regulation (GDPR) and explains how we fulfill our obligations under this framework.
Our Role Under GDPR
When we collect and process personal data from visitors to our website or clients using our services, Areoa-gxru acts as the data controller. This means we determine the purposes and means of processing personal data and are responsible for ensuring that processing complies with applicable data protection laws.
Legal Bases for Processing
Under GDPR, we must have a lawful basis to process your personal data. Depending on the circumstances, we rely on one or more of the following:
Contract Performance
When you engage our services, we process your data as necessary to fulfill our contractual obligations. This includes using your contact information to communicate about repairs, processing payment details, and maintaining service records.
Legitimate Interests
We may process data based on our legitimate business interests, such as improving our services, preventing fraud, and ensuring network security. We balance these interests against your rights and only proceed when our interests do not override your fundamental freedoms.
Consent
For certain processing activities, such as sending marketing communications or placing non-essential cookies, we obtain your explicit consent. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Legal Obligation
We may process personal data when required to comply with legal obligations, such as tax reporting requirements or responding to valid legal requests from authorities.
Your Rights Under GDPR
If you are located in the EEA, you have specific rights regarding your personal data:
Right of Access
You can request confirmation of whether we process your personal data and obtain a copy of that data along with information about how we use it.
Right to Rectification
You have the right to request correction of inaccurate personal data or completion of incomplete data we hold about you.
Right to Erasure
Under certain circumstances, you can request deletion of your personal data. This right is not absolute and depends on factors such as legal retention requirements and whether we have ongoing legitimate grounds for processing.
Right to Restrict Processing
You can ask us to limit how we use your data in certain situations, such as while we verify the accuracy of contested data or when processing is unlawful but you prefer restriction over deletion.
Right to Data Portability
Where we process your data based on consent or contract performance using automated means, you can request to receive your data in a structured, commonly used, machine-readable format.
Right to Object
You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such automated decision-making.
Exercising Your Rights
To exercise any of your GDPR rights, please contact us at [email protected]. We may need to verify your identity before processing your request. We aim to respond to all valid requests within one month, though complex or numerous requests may require an extension of up to two additional months.
There is no fee for exercising your rights in most cases. However, we may charge a reasonable fee for manifestly unfounded or excessive requests, or we may decline to act on such requests.
International Data Transfers
As a Canadian company, data we collect may be processed and stored in Canada. Canada has been recognized by the European Commission as providing an adequate level of data protection. When we transfer data to other countries, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission.
Data Protection Measures
We implement technical and organizational measures designed to protect personal data, including:
- Encryption of data in transit and at rest where appropriate
- Access controls limiting data access to authorized personnel
- Regular security assessments and updates
- Staff training on data protection practices
- Incident response procedures for potential data breaches
Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach where feasible. If the breach is likely to result in high risk to you, we will also notify you directly without undue delay.
Supervisory Authority
If you are located in the EEA and believe that our processing of your personal data violates GDPR, you have the right to lodge a complaint with your local supervisory authority. However, we encourage you to contact us first so we can address your concerns directly.
Updates to This Statement
We may update this GDPR compliance statement periodically to reflect changes in our practices or regulatory requirements. Material changes will be communicated through our website, and the "last updated" date will be revised accordingly.
Contact Information
For questions about our GDPR compliance or to exercise your data protection rights, please contact us:
Email: [email protected]
Please include "GDPR Request" in your subject line to help us route your inquiry appropriately.