GDPR - Canvas-branch

Last updated: November 2024

1. Introduction

Canvas-branch is committed to ensuring the protection of personal data in compliance with the General Data Protection Regulation (GDPR). This page provides information for individuals in the European Economic Area (EEA) and the United Kingdom about their rights under GDPR and how we process their personal data.

This information supplements our Privacy Policy and provides additional details specific to GDPR requirements.

2. Data Controller

For the purposes of GDPR, Canvas-branch is the data controller responsible for your personal data. Our contact details are:

Canvas-branch
142 Studio Lane
Surry Hills NSW 2010
Australia

Email: [email protected]

3. Legal Basis for Processing

We process personal data under the following legal bases:

Consent: Where you have given clear consent for us to process your personal data for a specific purpose, such as receiving marketing communications or accepting cookies.
Contract: Where processing is necessary for the performance of a contract with you, such as providing our training services.
Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests.
Legal Obligation: Where processing is necessary to comply with a legal obligation.

4. Your Rights Under GDPR

If you are located in the EEA or UK, you have the following rights regarding your personal data:

4.1 Right of Access

You have the right to request access to your personal data and receive a copy of the information we hold about you. This includes information about the purposes of processing, categories of data, recipients, and retention periods.

4.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data we hold about you.

4.3 Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected, or when you withdraw consent.

4.4 Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

4.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

4.6 Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

4.7 Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

5. Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month. In some cases, we may need to extend this period by up to two months, in which case we will inform you of the extension and the reasons for it.

We may need to verify your identity before processing your request. If your request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on the request.

6. International Data Transfers

As Canvas-branch is based in Australia, personal data collected from individuals in the EEA or UK may be transferred to and processed in Australia. We ensure that appropriate safeguards are in place for such transfers, including standard contractual clauses approved by the European Commission.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. The criteria used to determine retention periods include:

The duration of our relationship with you
Legal obligations requiring data retention
Applicable statutes of limitation
The purposes for which the data was collected

8. Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

Encryption of personal data where appropriate
Regular testing and evaluation of security measures
Processes for ensuring confidentiality, integrity, and availability of data
Procedures for restoring access to data following an incident

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

10. Right to Lodge a Complaint

If you believe that we have not complied with your data protection rights, you have the right to lodge a complaint with a supervisory authority. For individuals in the EEA, this would be the data protection authority in your country of residence or work, or where the alleged infringement took place.

11. Children's Data

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete that information.

12. Updates to This Information

We may update this GDPR information from time to time. We will notify you of any material changes by posting the updated information on our website and updating the "Last updated" date.

13. Contact Us

For questions about this GDPR information or to exercise your rights, please contact us: