Last updated: September 2026
Overview
petal-jay respects the privacy rights of individuals in the European Economic Area (EEA) and is committed to compliance with the General Data Protection Regulation (GDPR). This notice supplements our Privacy Policy with additional information specific to EEA residents.
Data Controller
For the purposes of GDPR, petal-jay acts as the data controller for personal information collected through this website. Our contact details are:
petal-jay
250 Front Street West, Suite 1400
Toronto, ON M5V 3G5
Canada
Email: [email protected]
Legal Bases for Processing
We process personal data of EEA residents on the following legal bases:
- Consent: Where you have given explicit consent for us to process your data for specific purposes
- Contract: Where processing is necessary to fulfill our contractual obligations to you
- Legitimate Interests: Where processing is necessary for our legitimate business interests, provided these do not override your fundamental rights
- Legal Obligation: Where we are required by law to process your data
Your Rights Under GDPR
As an EEA resident, you have the following rights regarding your personal data:
Right of Access
You have the right to request a copy of the personal data we hold about you and information about how we process it.
Right to Rectification
You may request that we correct any inaccurate or incomplete personal data we hold about you.
Right to Erasure
You may request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes it was collected.
Right to Restrict Processing
You may request that we limit how we use your personal data in certain circumstances.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to Object
You may object to the processing of your personal data where we are relying on legitimate interests as our legal basis.
Rights Related to Automated Decision-Making
You have rights regarding automated decision-making and profiling. We do not currently engage in solely automated decision-making that produces legal effects.
International Data Transfers
As we are based in Canada, your personal data may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing an adequate level of data protection. Where transfers occur to other countries without adequacy decisions, we implement appropriate safeguards such as standard contractual clauses.
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected. For EEA residents, upon request, we will delete your personal data unless retention is required by law or for the establishment, exercise, or defense of legal claims.
Exercising Your Rights
To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases or where we receive numerous requests, this period may be extended by two additional months, in which case we will inform you.
Complaints
If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with a supervisory authority. For EEA residents, this is typically the data protection authority in your country of residence.
Updates
We may update this GDPR notice periodically. Any changes will be posted on this page with an updated revision date.