GDPR Compliance

Last updated: November 12, 2026

Our Commitment to Data Protection

pebble-sable is committed to complying with the General Data Protection Regulation (GDPR) and protecting the privacy rights of individuals in the European Economic Area (EEA). This page explains how we implement GDPR principles in our data processing activities.

Legal Basis for Processing

We process personal data only when we have a valid legal basis. The legal bases we rely on include:

• Consent: When you provide explicit consent for specific processing activities
• Contract: When processing is necessary to fulfill our contractual obligations
• Legal Obligation: When required by law
• Legitimate Interests: When necessary for our legitimate business interests, provided your rights are not overridden

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. We will provide this information in a commonly used electronic format.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request that we correct or complete it.

Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Deletion is required to comply with a legal obligation

Right to Restriction of Processing

You have the right to request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. We do not engage in such automated decision-making.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month, though this period may be extended by two additional months in complex cases.

When submitting a request, please provide sufficient information to verify your identity and specify which right you wish to exercise.

Data Protection Principles

We adhere to the following GDPR data protection principles:

• Lawfulness, Fairness, and Transparency: We process data lawfully, fairly, and in a transparent manner
• Purpose Limitation: We collect data for specified, explicit, and legitimate purposes
• Data Minimization: We collect only data that is adequate, relevant, and limited to what is necessary
• Accuracy: We take reasonable steps to ensure personal data is accurate and up to date
• Storage Limitation: We retain personal data only as long as necessary
• Integrity and Confidentiality: We implement appropriate security measures to protect data

Data Transfers Outside the EEA

If we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission or other legally valid transfer mechanisms.

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Data Protection Officer

For questions regarding GDPR compliance or to exercise your rights, you may contact our data protection representative at [email protected].

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe we have violated your data protection rights. You may contact the supervisory authority in your country of residence, place of work, or where the alleged violation occurred.

Updates to This Policy

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website.

Contact Information

For GDPR-related inquiries or to exercise your rights, please contact:

Email: [email protected]
Address: 525 Granville Street, Vancouver, BC V6C 1X6, Canada