Moor Caribou

Our Commitment to Data Protection

Moor Caribou is committed to ensuring that your personal data is protected in accordance with the General Data Protection Regulation (GDPR) and applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

Data Controller Information

Moor Caribou acts as the data controller for personal information collected through our website and services:

Moor Caribou
245 Richmond Street West, Suite 400
Toronto, ON M5V 1W2
Canada
Email: [email protected]

Legal Basis for Processing

We process your personal data under the following legal bases:

Consent

Where you have given clear consent for us to process your personal data for specific purposes, such as marketing communications or newsletter subscriptions.

Contract Performance

Where processing is necessary to fulfill a contract with you, such as delivering course services you have enrolled in.

Legal Obligation

Where processing is necessary to comply with legal requirements, such as tax and accounting regulations.

Legitimate Interests

Where processing is necessary for our legitimate interests, provided these do not override your fundamental rights and freedoms. This includes improving our services and maintaining the security of our systems.

Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or if GDPR otherwise applies to our processing of your data, you have the following rights:

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information free of charge within one month of your request.

Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure

You have the right to request that we delete your personal data where:

The data is no longer necessary for the purpose it was collected
You withdraw your consent (where consent was the legal basis for processing)
You object to processing and there are no overriding legitimate grounds
The data has been unlawfully processed
The data must be erased to comply with a legal obligation

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data where:

You contest the accuracy of the data (while we verify accuracy)
The processing is unlawful and you oppose erasure
We no longer need the data but you require it for legal claims
You have objected to processing (pending verification of legitimate grounds)

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller without hindrance.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or significantly affect you. We do not currently engage in automated decision-making that would trigger these rights.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We may need to verify your identity before processing your request. We will respond to valid requests within one month, although this period may be extended by two additional months for complex requests.

Data Transfers

As we operate primarily in Canada, your data may be stored and processed in Canada. When we transfer data outside of Canada, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Retention periods vary depending on the type of data and the purpose of processing:

Course enrollment records: 7 years from completion
Marketing consent records: Until consent is withdrawn
Website analytics data: 26 months
Customer support correspondence: 3 years

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit and at rest
Access controls and authentication
Regular security assessments
Staff training on data protection

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

Complaints

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In Canada, you may contact the Office of the Privacy Commissioner of Canada. If you are located in the EEA, you may contact your local data protection authority.

Updates to This Notice

We may update this GDPR compliance notice from time to time. We will notify you of significant changes through our website or by email where appropriate.

Contact Us

For any questions or concerns regarding data protection, please contact us: