GDPR Compliance

Last Updated: September 10, 2026

Your Data Protection Rights

Under the General Data Protection Regulation (GDPR), individuals in the European Economic Area have specific rights regarding their personal data. While garnet-petal operates primarily in Canada, we respect these rights for all users.

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee for multiple or excessive requests.

Right to Rectification

You have the right to request correction of information you believe is inaccurate or incomplete.

Right to Erasure

You have the right to request deletion of your personal data under certain conditions, including:

• The data is no longer necessary for the original purpose
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restrict Processing

You have the right to request restriction of processing your personal data under certain conditions.

Right to Object

You have the right to object to our processing of your personal data under certain conditions.

Right to Data Portability

You have the right to request transfer of your data to another organization or directly to you under certain conditions.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: You have given clear consent for us to process your personal data for a specific purpose
• Contract: Processing is necessary to fulfill a contract with you
• Legal obligation: Processing is necessary to comply with law
• Legitimate interests: Processing is necessary for our legitimate interests, provided your rights do not override these interests

Data Collection and Use

We collect and process personal data for:

• Responding to commission inquiries
• Processing and fulfilling orders
• Communication regarding your projects
• Improving our services
• Compliance with legal obligations

Data Sharing

We share personal data only when necessary:

• With artisans within our collective to fulfill your commission
• With service providers who assist our operations (shipping, payment processing)
• When required by law or to protect our legal rights

International Data Transfers

As a Canadian organization, data you provide is processed in Canada. We ensure appropriate safeguards are in place for any international data transfers.

Data Retention

We retain personal data only as long as necessary for the purposes outlined or as required by law. Commission-related data is typically retained for seven years for tax and legal purposes.

Automated Decision-Making

We do not use automated decision-making or profiling in ways that produce legal effects or similarly significantly affect you.

How to Exercise Your Rights

To exercise any of your data protection rights, contact us at:

[email protected]

We will respond to your request within one month. If your request is complex or we receive multiple requests, we may extend this period by two months and will inform you.

Supervisory Authority

If you believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local data protection supervisory authority.

Contact Information

For GDPR-related inquiries:

Email: [email protected]