GDPR Compliance

Your data protection rights under the General Data Protection Regulation

Our Commitment to GDPR Compliance

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to the processing of personal data of individuals in the European Union and European Economic Area.

While forest-beam is based in Canada, we are committed to protecting the privacy rights of all our clients and website visitors, including those protected under GDPR.

This page explains your rights under GDPR and how we ensure compliance.

Your Rights Under GDPR

Right to Be Informed

You have the right to know how we collect, use, and process your personal data. This information is provided in our Privacy Policy.

Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used format.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected.

Right to Erasure (Right to Be Forgotten)

You have the right to request that we delete your personal data in certain circumstances, including:

  • The data is no longer necessary for the purpose it was collected
  • You withdraw consent and there is no other legal basis for processing
  • You object to the processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed

Right to Restriction of Processing

You have the right to request that we restrict how we use your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to our processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing that produces legal effects or similarly significantly affects you. We do not currently use automated decision-making processes.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with the subject line "GDPR Rights Request."

When you contact us, please specify which right you wish to exercise and provide sufficient information to verify your identity.

We will respond to your request within one month. In some cases, particularly complex requests, we may extend this period by two additional months, in which case we will inform you of the extension and the reasons for delay.

Legal Basis for Processing

Under GDPR, we must have a legal basis for processing your personal data. We process your data based on the following legal grounds:

Consent

When you enroll in our programs or subscribe to communications, you provide consent for us to process your data for those specific purposes.

Contract Performance

Processing is necessary to fulfill our contractual obligations when you purchase our services.

Legitimate Interests

We may process data based on our legitimate business interests, such as improving our services, provided these interests are not overridden by your rights and freedoms.

Legal Obligations

We may process data to comply with legal obligations, such as tax and accounting requirements.

Data We Collect

The personal data we collect includes:

  • Identification information (name, email address)
  • Contact information
  • Information you provide during coaching sessions
  • Payment information (processed by third-party payment processors)
  • Technical data (IP address, browser type, device information)
  • Usage data (how you interact with our website)

For complete details, please see our Privacy Policy.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

  • Providing our services to you
  • Complying with legal, accounting, or reporting requirements
  • Resolving disputes
  • Enforcing our agreements

Session notes and coaching materials are retained for three years after your last session, unless you request earlier deletion.

Financial records are retained for seven years to comply with tax and accounting requirements.

International Data Transfers

As a Canadian company, your data may be transferred to and processed in Canada, which the European Commission has recognized as providing adequate data protection.

When we use service providers located outside Canada or the EU/EEA, we ensure appropriate safeguards are in place, such as:

  • Standard contractual clauses approved by the European Commission
  • Privacy Shield certification (where applicable)
  • Other mechanisms recognized under GDPR

Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

  • Encryption of data in transit and at rest
  • Regular security assessments
  • Access controls and authentication
  • Staff training on data protection
  • Secure backup systems

Third-Party Processors

We work with third-party service providers who process personal data on our behalf. These processors include:

  • Payment processing services
  • Email service providers
  • Video conferencing platforms
  • Website hosting providers

All third-party processors are required to implement appropriate security measures and process data only according to our instructions.

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Children's Data

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information.

Complaints

If you believe we have not complied with GDPR or have concerns about how we handle your personal data, you have the right to lodge a complaint with a supervisory authority.

In the EU, you can contact your local data protection authority. In Canada, you can contact the Office of the Privacy Commissioner of Canada.

We encourage you to contact us first so we can address your concerns directly.

Updates to Our GDPR Practices

We regularly review our data protection practices to ensure ongoing GDPR compliance. Any significant changes will be reflected in our Privacy Policy and on this page.

Contact Our Data Protection Team

For questions about GDPR compliance or to exercise your rights:

Email: [email protected]
Subject: GDPR Inquiry
Address: 328 Wellington Street West, Suite 1400, Toronto, ON M5V 3T4, Canada