GDPR Compliance

Last Updated: September 29, 2026

Introduction

This page outlines how cliff-drift complies with the General Data Protection Regulation (GDPR) and explains your rights regarding personal data processing. We are committed to protecting your privacy and ensuring transparent data handling practices.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you provide explicit consent for specific processing activities
• Contract Performance: When processing is necessary to deliver services you have requested
• Legitimate Interests: When processing serves our legitimate business interests and does not override your rights
• Legal Obligation: When required by law to process certain data

Your Rights Under GDPR

As a data subject, you have the following rights:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure

You can request deletion of your personal data when it is no longer necessary for the purposes it was collected, or when you withdraw consent.

Right to Restrict Processing

You can request limitation of how we use your data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You can request transfer of your data in a structured, commonly used format to another data controller where technically feasible.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

When processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

Data Protection Officer

For questions about data processing or to exercise your rights, contact us at:

Email: [email protected]
Address: 2847 Granville Street, Vancouver, BC V6H 3J4, Canada

Data Processing Activities

We process the following categories of personal data:

• Contact information (name, email address)
• Professional information (company name, role)
• Service inquiry details
• Website usage data

Third-Party Data Sharing

We may share data with:

• Service providers who assist with business operations (hosting, analytics)
• Legal authorities when required by law

All third parties are required to implement appropriate security measures and process data only as instructed.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by legal obligations. Specific retention periods depend on the type of data and the nature of our relationship.

Security Measures

We implement technical and organizational measures to protect personal data against unauthorized access, loss, or destruction. These measures include encryption, access controls, and regular security assessments.

International Data Transfers

When transferring data outside the European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

Automated Decision Making

We do not use automated decision-making processes or profiling that produce legal effects or similarly significant effects on individuals.

Supervisory Authority

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your local data protection supervisory authority.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month, though this period may be extended by two additional months for complex requests.

Changes to This Policy

We may update our GDPR compliance documentation to reflect changes in processing activities or legal requirements. Significant changes will be communicated through our website.