Last Updated: October 2, 2026
Introduction
This page outlines how deft-heath complies with the General Data Protection Regulation (GDPR) and describes your rights regarding personal data processing. While we primarily serve Canadian clients, we respect and uphold data protection principles consistent with GDPR standards.
Legal Basis for Processing
We process personal data based on the following legal grounds:
- Consent: When you provide explicit consent for specific processing activities
- Contract Performance: When processing is necessary to provide services you've requested
- Legitimate Interest: When processing serves our legitimate business interests while respecting your rights
- Legal Obligation: When required to comply with applicable laws
Your Rights Under GDPR
Right to Access
You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. We will provide this information in a commonly used electronic format.
Right to Rectification
You may request correction of inaccurate or incomplete personal data. We will make reasonable efforts to update our records promptly.
Right to Erasure
You may request deletion of your personal data in certain circumstances, including:
- The data is no longer necessary for its original purpose
- You withdraw consent and no other legal basis exists
- You object to processing and no overriding legitimate grounds exist
- The data has been unlawfully processed
Right to Restriction of Processing
You may request that we limit how we use your data in specific situations, such as when you contest the accuracy of the data or object to processing.
Right to Data Portability
You have the right to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible.
Right to Object
You may object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making
You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant impacts. We do not currently engage in such automated decision-making.
How to Exercise Your Rights
To exercise any of these rights, please contact us at:
We will respond to your request within one month, though this period may be extended by two additional months for complex requests. We will inform you of any extension within the initial month.
Data Protection Officer
For questions specifically related to data protection and GDPR compliance, you may contact us at the email address above. We take data protection seriously and will address your concerns promptly.
International Data Transfers
We primarily operate within Canada. If personal data is transferred internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions recognized by relevant authorities.
Data Breach Notification
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you without undue delay in accordance with applicable regulations. We maintain security measures designed to prevent unauthorized access to personal data.
Withdrawal of Consent
Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
Right to Lodge a Complaint
If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.
Data Retention Periods
We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law. Specific retention periods include:
- Client communication records: Duration of professional relationship plus 7 years
- Project documentation: Duration of project plus applicable warranty periods
- Marketing consent records: Until consent is withdrawn or 3 years of inactivity
Contact Information
For any questions regarding GDPR compliance or to exercise your rights:
Email: [email protected]
We are committed to protecting your personal data and respecting your privacy rights under applicable data protection regulations.