GDPR Compliance Statement
Last Updated: September 24, 2026
Introduction
noble-heron is committed to protecting the privacy and personal data of individuals in the European Union (EU) and European Economic Area (EEA). This statement outlines our compliance with the General Data Protection Regulation (GDPR).
While we are based in Canada, we recognize our obligations under GDPR when processing personal data of EU/EEA residents who visit our website or engage with our services.
Data Controller
For the purposes of GDPR, noble-heron acts as the data controller for personal information collected through our website and services.
noble-heron
147 King Street West, Suite 420
Toronto, ON M5H 1J9
Canada
Email: [email protected]
Legal Basis for Processing
We process personal data under the following legal bases:
- Consent: When you provide explicit consent for us to process your personal data for specific purposes, such as subscribing to communications or submitting inquiries.
- Contract Performance: When processing is necessary to fulfill a contract with you or to take steps at your request before entering into a contract.
- Legitimate Interests: When processing is necessary for our legitimate business interests, such as improving our services, website functionality, and security, provided your rights do not override these interests.
- Legal Obligation: When processing is required to comply with applicable legal obligations.
Your Rights Under GDPR
If you are an EU/EEA resident, you have the following rights regarding your personal data:
Right to Access
You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data.
Right to Rectification
You have the right to request correction of inaccurate or incomplete personal data.
Right to Erasure (Right to be Forgotten)
You have the right to request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected or when you withdraw consent.
Right to Restrict Processing
You have the right to request restriction of processing of your personal data under certain conditions.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
Right to Object
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent
Where processing is based on consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or place of alleged infringement.
How to Exercise Your Rights
To exercise any of your GDPR rights, please contact us at [email protected] with the subject line "GDPR Request." We will respond to your request within one month, as required by GDPR.
We may need to verify your identity before processing your request to ensure the security of your personal data.
Data Collection and Processing
What Data We Collect
We collect the following types of personal data:
- Name and email address
- Company name and professional information
- Service preferences and inquiry details
- Technical data such as IP address, browser type, and usage data
How We Use Your Data
We use your personal data for the following purposes:
- To respond to your inquiries and provide services you request
- To communicate with you about our services
- To improve our website and service offerings
- To comply with legal obligations
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Retention periods vary depending on the nature of the data and the purpose of processing.
When personal data is no longer needed, we securely delete or anonymize it.
International Data Transfers
Your personal data may be transferred to and processed in Canada. We ensure that appropriate safeguards are in place to protect your data in accordance with GDPR requirements.
Data Security
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit and at rest
- Access controls and authentication mechanisms
- Regular security assessments and updates
- Employee training on data protection
Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or significantly affects you.
Cookies and Tracking
We use cookies and similar tracking technologies on our website. You can manage your cookie preferences through our cookie banner or browser settings. For more information, please see our Cookies Policy.
Changes to This Statement
We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. We will post updates on this page with a revised "Last Updated" date.
Contact Us
If you have questions about our GDPR compliance or wish to exercise your rights, please contact us:
Email: [email protected]
Address: 147 King Street West, Suite 420, Toronto, ON M5H 1J9, Canada