GDPR Information

Last updated: September 21, 2026

Our Commitment to Data Protection

Frost & Fade Studio is committed to compliance with the General Data Protection Regulation (GDPR) and protecting the privacy rights of individuals in the European Economic Area and beyond.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: You provide explicit consent when submitting appointment requests or contacting us
• Legitimate Interests: Processing necessary for our business operations and service delivery
• Contractual Necessity: Processing required to fulfill our service obligations

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Access

You can request copies of all personal information we hold about you.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

You can request deletion of your personal data under certain circumstances.

Right to Restrict Processing

You can request limitation of how we use your personal data.

Right to Data Portability

You can request transfer of your data to another service provider in a structured format.

Right to Object

You can object to processing of your personal data for specific purposes.

Right to Withdraw Consent

You can withdraw consent for data processing at any time without affecting prior processing.

Data We Collect

We collect and process the following categories of personal data:

• Identity data (name)
• Contact data (email address)
• Transaction data (appointment bookings, service selections)
• Technical data (IP address, browser type for security purposes only)

How We Protect Your Data

We implement appropriate technical and organizational security measures including:

• Encrypted data transmission
• Secure data storage with restricted access
• Regular security assessments
• Staff training on data protection
• Incident response procedures

Data Retention

We retain personal data only as long as necessary for the purposes it was collected or as required by law. Appointment records are retained for two years, after which they are securely deleted.

International Data Transfers

Your data is stored and processed in Canada. We do not transfer personal data outside of Canada except where necessary to fulfill our services, and only with appropriate safeguards in place.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with your request. We will respond within 30 days of receiving your request.

Complaints

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with your local data protection authority.

Contact Our Data Protection Officer

For questions regarding GDPR compliance or data protection practices, contact us at [email protected]