GDPR Compliance

Last Updated: August 17, 2026

Our Commitment to GDPR

Although owl-roam operates primarily in Canada, we respect the data protection rights of all users, including those in the European Economic Area. We comply with the General Data Protection Regulation (GDPR) principles in our data handling practices.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: When you submit inquiry forms or subscribe to communications
• Legitimate Interests: To improve our services and provide relevant educational content
• Contractual Necessity: To fulfill requested services and program information

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate or incomplete personal information.

Right to Erasure

You can request deletion of your personal data under certain circumstances, including when data is no longer necessary for its original purpose.

Right to Restrict Processing

You can request limitation of how we use your data in specific situations.

Right to Data Portability

You can receive your personal data in a structured, machine-readable format and transmit it to another controller.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects concerning you.

Data Protection Officer

For GDPR-related inquiries or to exercise your rights, contact our Data Protection Officer:

Email: [email protected]
Address: 428 Laurier Avenue West, Ottawa, Ontario K1R 7Y9, Canada

Data Transfers

Your personal data is stored and processed in Canada. If we transfer data outside the EEA, we ensure appropriate safeguards are in place through standard contractual clauses or other approved mechanisms.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours of becoming aware of the breach.

Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal data violates GDPR.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, typically:

• Inquiry data: 24 months from last contact
• Marketing consent: Until withdrawn
• Analytics data: 14 months

Third-Party Processing

We work with limited third-party processors for email delivery and analytics. All processors are contractually bound to GDPR compliance standards.