GDPR Compliance

Last updated: September 29, 2026

Introduction

This document explains how wind-beaver complies with the General Data Protection Regulation (GDPR) when processing personal data of individuals located in the European Union or European Economic Area.

While our primary operations are based in Canada, we respect the data protection rights of EU/EEA residents who may access our services or website.

Legal Basis for Processing

We process personal data only when we have a valid legal basis under GDPR, including:

  • Contract Performance: Processing necessary to deliver coaching services you've enrolled in
  • Consent: Where you have provided explicit consent for specific processing activities
  • Legitimate Interests: For business operations that don't override your fundamental rights
  • Legal Obligations: Where required by applicable law

Your Rights Under GDPR

If you are an EU/EEA resident, you have the following rights regarding your personal data:

Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data along with information about how it's being used.

Right to Rectification

You can request correction of inaccurate or incomplete personal information we hold about you.

Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data in certain circumstances, such as when:

  • The data is no longer necessary for the purposes it was collected
  • You withdraw consent and there's no other legal basis for processing
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed

Right to Restriction of Processing

You can request that we limit how we use your personal data in specific situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to transmit that data to another controller.

Right to Object

You may object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.

Right to Lodge a Complaint

You have the right to file a complaint with your local data protection supervisory authority if you believe we have violated your data protection rights.

Data Processing Activities

We process personal data for the following purposes:

  • Providing career transformation coaching services
  • Managing client relationships and communications
  • Processing payments and maintaining financial records
  • Improving our services through analysis and feedback
  • Complying with legal and regulatory obligations

Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Client records: Maintained for the duration of the coaching relationship plus seven years for legal and tax purposes
  • Inquiry records: Deleted after two years if no service relationship is established
  • Marketing communications: Until you unsubscribe or withdraw consent
  • Website cookies: As specified in our Cookies Policy

International Data Transfers

Your personal data may be transferred to and processed in Canada. Canada has been recognized by the European Commission as providing an adequate level of data protection under its federal privacy legislation (PIPEDA).

When we use service providers in jurisdictions without adequacy decisions, we implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

Data Security Measures

We implement technical and organizational measures to ensure appropriate security of personal data, including:

  • Encryption of data in transit and at rest
  • Access controls and authentication procedures
  • Regular security assessments and updates
  • Staff training on data protection principles
  • Incident response procedures for data breaches

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.

Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

Third-Party Data Processors

We work with third-party service providers who process personal data on our behalf. These processors are carefully selected and bound by data processing agreements that ensure GDPR compliance.

Categories of processors include:

  • Cloud hosting and storage providers
  • Email and communication platforms
  • Payment processing services
  • Video conferencing platforms

Exercising Your Rights

To exercise any of your GDPR rights, contact us at:

Email: [email protected]
Subject line: "GDPR Data Subject Request"

We will respond to verified requests within one month. In complex cases, we may extend this period by two additional months, and we will inform you of any such extension.

Contact Information

For questions about our GDPR compliance or data protection practices:

wind-beaver
427 West Hastings Street, Suite 304
Vancouver, BC V6B 1L4
Canada
Email: [email protected]

Updates to This Policy

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. The last updated date at the top of this document indicates when changes were made.