GDPR Compliance

General Data Protection Regulation

This page outlines how we comply with the General Data Protection Regulation and your rights under this regulation.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you submit an inquiry form, you provide explicit consent for us to process your information for the stated purposes.
• Legitimate Interests: Processing necessary for responding to business inquiries and maintaining customer relationships.
• Legal Obligations: Retention of business records as required by applicable laws.

Data Controller Information

quiet-atoll operates as the data controller for personal information collected through this website. We determine the purposes and means of processing your personal data.

Contact for data protection matters: [email protected]

Your Rights Under GDPR

Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data.

Right to Rectification

You may request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure

You can request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent.

Right to Restriction of Processing

Under certain circumstances, you can request that we limit how we use your personal data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

Right to Object

You may object to processing of your personal data based on legitimate interests.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time.

How to Exercise Your Rights

To exercise any of your GDPR rights, send a request to [email protected] with the subject line "GDPR Request." Include:

• Your full name
• The email address you used for inquiry
• Specific right you wish to exercise
• Any relevant details about your request

We will respond to your request within 30 days. In complex cases, this period may be extended by an additional 60 days, and you will be informed of any extension.

Data Transfers

Your personal data is stored on servers located in Canada. We do not transfer personal data outside of Canada except when necessary for service delivery, and only with appropriate safeguards in place.

Automated Decision Making

We do not use automated decision-making or profiling processes that produce legal effects or similarly significant effects on individuals.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you without undue delay and, where required, report the breach to the relevant supervisory authority within 72 hours.

Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe your rights under GDPR have been violated.

Data Protection Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit and at rest
• Regular security assessments
• Access controls limiting who can view personal data
• Staff training on data protection requirements

Children's Data

We do not knowingly process personal data of individuals under 16 years of age. If we become aware that we have collected such data, we will delete it promptly.