GDPR Compliance

Last Updated: September 29, 2026

General Data Protection Regulation (GDPR) Commitment

Aurora-otter is committed to protecting the privacy rights of individuals in accordance with the General Data Protection Regulation (GDPR). This page outlines how we comply with GDPR requirements and respect your data protection rights.

Legal Basis for Processing

We process personal data based on one or more of the following legal grounds:

• Consent: You have given explicit consent for processing your personal data for specific purposes
• Contract: Processing is necessary for the performance of a contract with you
• Legal Obligation: Processing is required to comply with legal obligations
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your rights

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request access to the personal data we hold about you and receive a copy of that information.

Right to Rectification

You can request correction of inaccurate or incomplete personal data we maintain about you.

Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data when there is no compelling reason for its continued processing.

Right to Restrict Processing

You can request that we limit the processing of your personal data under certain circumstances.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and transmit it to another controller.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. When personal data is no longer needed, we securely delete or anonymize it.

International Data Transfers

If we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements.

Data Protection Officer

For questions regarding GDPR compliance or to exercise your rights, please contact us at:

Email: [email protected]
Address: 347 Bay Street, Suite 1200, Toronto, ON M5H 2R7, Canada

Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data
• Regular security assessments
• Access controls and authentication
• Employee training on data protection

Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and inform the relevant supervisory authority within 72 hours of becoming aware of the breach.

Updates to This Page

We may update this GDPR compliance information as our practices evolve or regulations change. Please review this page periodically for the latest information.