GDPR Information

Your data protection rights under European regulation

Introduction

While nimble-kestrel operates primarily in Canada, we respect and comply with the General Data Protection Regulation (GDPR) for visitors and students from the European Economic Area.

Legal Basis for Processing

When we process your personal data, we do so under one of the following legal bases:

  • Contract Performance: Processing necessary to deliver educational services you've enrolled in
  • Consent: When you've given explicit permission for specific data uses
  • Legitimate Interests: For improving services and website functionality, where not overridden by your rights
  • Legal Obligation: When required by applicable law

Your Rights Under GDPR

Right to Access

You have the right to request confirmation of whether we process your personal data and, if so, to access that data along with information about how it's used.

Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure

You can request deletion of your personal data when:

  • The data is no longer necessary for its original purpose
  • You withdraw consent and no other legal basis exists
  • You object to processing and no overriding legitimate grounds exist
  • The data was unlawfully processed

Right to Restriction of Processing

You may request limitation of processing when:

  • You contest the accuracy of the data
  • Processing is unlawful but you prefer restriction over erasure
  • We no longer need the data but you need it for legal claims
  • You've objected to processing pending verification

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in your EU member state if you believe our processing violates GDPR.

International Data Transfers

Personal data from the EEA may be transferred to and processed in Canada. We ensure appropriate safeguards are in place through:

  • Standard contractual clauses approved by the European Commission
  • Adequate security measures
  • Compliance with applicable data protection laws

Data Protection Officer

For GDPR-related inquiries, contact our data protection officer:

Email: [email protected]
Address: 487 King Street West, Suite 302, Toronto, ON M5V 1K4, Canada

Automated Decision Making

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.

Data Retention Periods

We retain personal data only as long as necessary for the purposes it was collected:

  • Enrollment inquiries: 2 years from last contact
  • Student records: 7 years from program completion
  • Marketing consent: Until withdrawn or 3 years of inactivity
  • Website analytics: 24 months

How to Exercise Your Rights

To exercise any of your GDPR rights, send a written request to:

Email: [email protected]
Subject line: GDPR Rights Request

We will respond to verified requests within one month. Complex requests may require up to three months with notification of the extension.

Verification Process

To protect your privacy, we verify your identity before fulfilling data subject requests. You may be asked to provide:

  • Email address associated with your account
  • Approximate enrollment date or program name
  • Additional identifying information if necessary

Updates to This Information

We may update this GDPR information to reflect changes in our practices or legal requirements. Check this page periodically for updates.