GDPR Compliance

Overview

Tranquil-peak is committed to protecting the privacy and personal data of individuals in accordance with the General Data Protection Regulation (GDPR). This document outlines how we process personal data, your rights under GDPR, and our compliance measures.

Data Controller

Tranquil-peak acts as the data controller for personal information collected through our website and during client engagements. We determine the purposes and means of processing your personal data.

Contact information:
Tranquil-peak
287 Richmond Street West, Suite 400
Toronto, ON M5V 1X1
Canada
Email: [email protected]

Legal Basis for Processing

We process personal data based on the following legal grounds:

• Consent: When you provide explicit consent for specific processing activities, such as receiving communications or participating in coaching programs.
• Contract Performance: Processing necessary to fulfill coaching services you've engaged with us to provide.
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving services, conducting business analytics, and maintaining security, provided these interests don't override your rights.
• Legal Obligations: Processing required to comply with legal and regulatory requirements.

Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right to Access: You can request confirmation of whether we process your personal data and obtain a copy of that data.
• Right to Rectification: You can request correction of inaccurate or incomplete personal data.
• Right to Erasure: You can request deletion of your personal data under certain circumstances, such as when data is no longer necessary for its original purpose.
• Right to Restriction: You can request limitation of processing in specific situations, such as when you contest data accuracy.
• Right to Data Portability: You can receive your personal data in a structured, commonly used format and transmit it to another controller.
• Right to Object: You can object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw that consent at any time.

Exercising Your Rights

To exercise any of these rights, contact us at [email protected] with your specific request. We will verify your identity before processing requests and respond within 30 days.

If you're unsatisfied with our response, you have the right to lodge a complaint with a supervisory authority in your jurisdiction.

Data Protection Measures

We implement appropriate technical and organizational measures to ensure data security, including:

• Encryption of data in transit and at rest where appropriate
• Access controls limiting data access to authorized personnel only
• Regular security assessments and updates
• Employee training on data protection principles
• Contractual protections with third-party processors

International Data Transfers

We are based in Canada, which the European Commission has recognized as providing adequate data protection. If we engage service providers outside Canada or the EU/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

Data Retention

We retain personal data only as long as necessary for the purposes outlined in our Privacy Policy or as required by law. Client engagement records are retained for seven years following service completion, after which they are securely deleted unless legal obligations require longer retention.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.

Updates to This Document

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material updates will be communicated via email to active clients and posted on this page with a revised effective date.