Data Protection

Last updated: September 24, 2026

This Data Protection notice outlines how sepia-brook.com complies with applicable data protection laws, including the General Data Protection Regulation (GDPR) for users in the European Economic Area and the Personal Information Protection and Electronic Documents Act (PIPEDA) for users in Canada.

Legal Basis for Processing

We process your personal data under the following legal bases:

Consent: When you provide explicit consent for specific processing activities
Contractual necessity: To fulfill our service agreements with you
Legal obligation: To comply with applicable laws and regulations
Legitimate interests: To improve our services and protect our business interests

Your Data Protection Rights

Under applicable data protection laws, you have the following rights:

Right to access: You can request copies of your personal data
Right to rectification: You can request correction of inaccurate or incomplete data
Right to erasure: You can request deletion of your personal data under certain circumstances
Right to restrict processing: You can request limitation of how we use your data
Right to data portability: You can request transfer of your data to another organization
Right to object: You can object to certain types of processing
Right to withdraw consent: You can withdraw previously given consent at any time

Data Controller

sepia-brook.com is the data controller responsible for your personal information. We determine the purposes and means of processing your personal data.

Data Processing Activities

We process personal data for the following purposes:

Service booking and appointment management
Customer communication and support
Website functionality and security
Analytics and service improvement
Legal compliance and record-keeping

International Data Transfers

Your personal data is primarily stored and processed in Canada. If data is transferred internationally, we ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

Booking records: 7 years (business record requirements)
Communication records: 3 years
Website analytics: 24 months
Marketing consent records: Until consent is withdrawn

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

Data Security Measures

We implement appropriate technical and organizational measures to protect personal data, including:

Encryption of data in transit and at rest
Access controls and authentication
Regular security assessments
Staff training on data protection
Incident response procedures

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by law.

Exercising Your Rights

To exercise any of your data protection rights, please contact us at [email protected]. We will respond to your request within one month. In some cases, we may need to verify your identity before processing your request.

Supervisory Authority

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the relevant supervisory authority:

Canada: Office of the Privacy Commissioner of Canada
EU/EEA: Your local data protection authority

Changes to This Notice

We may update this Data Protection notice from time to time. Material changes will be communicated to you via email or prominent notice on our website.

Contact Information

For questions about data protection or to exercise your rights, contact us at: [email protected]