Our Commitment to GDPR Compliance
Plateau-craft is committed to protecting the personal data of individuals in the European Economic Area (EEA) in accordance with the General Data Protection Regulation (GDPR). This page outlines how we comply with GDPR requirements and explains your rights as a data subject.
Data Controller Information
For the purposes of GDPR, the data controller is:
Plateau-craft
1247 Granville Street, Suite 400
Vancouver, BC V6Z 1M4
Canada
Email: [email protected]
Lawful Basis for Processing
We process your personal data only when we have a lawful basis to do so under GDPR Article 6:
1. Consent (Article 6(1)(a))
When you provide explicit consent for us to process your personal data for specific purposes, such as receiving marketing communications or using certain cookies.
2. Contract Performance (Article 6(1)(b))
Processing necessary to fulfill our contractual obligations when you enroll in our programs, including providing access to materials and processing payments.
3. Legal Obligation (Article 6(1)(c))
Processing necessary to comply with legal obligations, such as tax and accounting requirements.
4. Legitimate Interests (Article 6(1)(f))
Processing necessary for our legitimate business interests, such as improving our services, preventing fraud, and maintaining security, provided these interests do not override your fundamental rights and freedoms.
Your Rights Under GDPR
As a data subject under GDPR, you have the following rights:
Right to Access (Article 15)
You have the right to obtain confirmation of whether we process your personal data and to access that data. You may request a copy of your personal information we hold.
Right to Rectification (Article 16)
You have the right to request correction of inaccurate personal data and to have incomplete personal data completed.
Right to Erasure (Article 17)
Also known as the "right to be forgotten," you have the right to request deletion of your personal data in certain circumstances, such as when:
- The data is no longer necessary for the purposes for which it was collected
- You withdraw consent and there is no other legal ground for processing
- You object to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
Right to Restriction of Processing (Article 18)
You have the right to request restriction of processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.
Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
Right to Object (Article 21)
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making (Article 22)
You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. We do not engage in automated decision-making that produces such effects.
Right to Withdraw Consent
Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
How to Exercise Your Rights
To exercise any of these rights, please contact us at [email protected]. Include the following information in your request:
- Your full name and email address associated with your account
- Specific right you wish to exercise
- Detailed description of your request
- Any relevant supporting information
We will respond to your request within one month of receipt. In complex cases or if we receive multiple requests, we may extend this period by two additional months, in which case we will inform you of the extension and the reasons for the delay.
Data Protection Principles
In accordance with GDPR Article 5, we ensure that personal data is:
- Processed lawfully, fairly, and transparently: We process data only when we have a lawful basis and communicate clearly about our processing activities
- Collected for specified, explicit, and legitimate purposes: We collect data only for defined purposes and do not use it in ways incompatible with those purposes
- Adequate, relevant, and limited: We collect only the minimum data necessary for our purposes
- Accurate and up to date: We take reasonable steps to ensure data accuracy and provide mechanisms for correction
- Kept for no longer than necessary: We retain data only as long as required for the purposes collected
- Processed securely: We implement appropriate technical and organizational measures to protect data
International Data Transfers
When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, such as:
- Standard Contractual Clauses approved by the European Commission
- Adequacy decisions recognizing equivalent data protection standards
- Other legally recognized transfer mechanisms
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by GDPR Article 34.
Data Protection by Design and Default
We implement data protection principles into our processing activities and business practices from the design stage, ensuring that:
- Only necessary personal data is processed
- Privacy settings default to the most protective options
- Personal data is protected throughout its lifecycle
- Technical and organizational measures ensure security
Supervisory Authority
You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your habitual residence, place of work, or place of alleged infringement, if you believe our processing of your personal data violates GDPR.
While we encourage you to contact us first to resolve any concerns, this right exists independent of any administrative or judicial remedy.
Updates to GDPR Compliance Information
We may update this information to reflect changes in our data processing practices or legal requirements. Material changes will be communicated through our website and, where appropriate, via direct communication.
Contact for Data Protection Matters
For questions about our GDPR compliance or to exercise your rights, contact us at:
Email: [email protected]
Subject line: GDPR Request