GDPR Compliance

General Data Protection Regulation Compliance

This page provides information about how thicket-crane.com complies with the European Union's General Data Protection Regulation (GDPR) for individuals located in the European Economic Area (EEA).

Legal Basis for Processing

We process your personal data under the following legal bases:

Consent

When you provide explicit consent for specific processing activities, such as subscribing to communications or submitting inquiry forms.

Contract Performance

When processing is necessary to perform our services or respond to your service requests.

Legitimate Interests

When we have legitimate business interests that do not override your fundamental rights and freedoms, such as improving our services or preventing fraud.

Legal Obligations

When we must process data to comply with legal requirements.

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

You can request deletion of your personal data in certain circumstances, including when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction of Processing

You can request that we limit how we use your data in certain situations.

Right to Data Portability

You can request to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your residence, workplace, or where an alleged infringement occurred.

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: [email protected]
Subject line: "GDPR Data Request"

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of such extension.

Data Protection Officer

For questions specifically related to data protection and GDPR compliance, you may contact our data protection contact:

Email: [email protected]
Address: 428 Granville Street, Vancouver, BC V6C 1V2, Canada

Data Processing Activities

Categories of Personal Data

We process the following categories of personal data:

• Identity data (name, professional title)
• Contact data (email address, postal address)
• Professional data (career information, service interests)
• Technical data (IP address, browser data, usage data)
• Communication data (inquiry content, correspondence)

Recipients of Personal Data

We may share your personal data with:

• Service providers who support our operations (hosting, analytics)
• Professional advisors (lawyers, accountants, auditors)
• Regulatory authorities when required by law

International Transfers

Your data may be transferred to and processed in Canada. We ensure appropriate safeguards are in place for such transfers, including:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions where applicable
• Other legally recognized transfer mechanisms

Data Retention

We retain personal data only as long as necessary for the purposes stated in our Privacy Policy:

• Inquiry data: retained for 2 years after last contact
• Client data: retained for duration of engagement plus 7 years for legal compliance
• Marketing data: retained until consent is withdrawn
• Technical data: typically retained for 12 months

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments
• Access controls and authentication
• Employee training on data protection
• Incident response procedures

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and within 72 hours of becoming aware of the breach, where feasible.

Updates to This Information

We may update this GDPR compliance information periodically to reflect changes in our practices or legal requirements. Material changes will be communicated through our website.

Supervisory Authority

If you are located in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.