Last Updated: December 2024
1. GDPR Overview
The General Data Protection Regulation (GDPR) gives EU residents comprehensive rights over their personal data. Event Artisans is committed to full GDPR compliance.
2. Legal Basis for Processing
We process personal data based on:
- Consent: You have given explicit consent for specific purposes
- Contract: Processing is necessary to fulfill our service agreement
- Legal Obligation: Required to comply with legal requirements
- Legitimate Interest: For business operations that don't override your rights
3. Your GDPR Rights
Right to Access
You can request a copy of all personal data we hold about you, including:
- What data we collect
- How we use your data
- Who we share your data with
- How long we retain your data
Right to Rectification
You can request correction of inaccurate or incomplete personal data.
Right to Erasure (Right to be Forgotten)
You can request deletion of your personal data when:
- Data is no longer necessary for original purposes
- You withdraw consent
- Data has been unlawfully processed
- Erasure is required for legal compliance
Right to Restrict Processing
You can request limitation of data processing in certain circumstances.
Right to Data Portability
You can receive your personal data in a structured, machine-readable format.
Right to Object
You can object to processing based on legitimate interests or for marketing purposes.
4. Data Protection Measures
We implement comprehensive security measures:
- Encryption of data in transit and at rest
- Access controls and authentication systems
- Regular security audits and assessments
- Staff training on data protection
- Incident response procedures
5. Data Breach Notification
In case of a data breach affecting your rights and freedoms:
- We will notify supervisory authorities within 72 hours
- Affected individuals will be notified without undue delay
- We will provide clear information about the breach
- Remedial actions will be taken immediately
6. International Data Transfers
If we transfer your data outside the EU, we ensure adequate protection through:
- Adequacy decisions by the European Commission
- Standard Contractual Clauses
- Binding Corporate Rules
- Certification schemes
7. Data Retention Periods
We retain personal data only as long as necessary:
- Active client data: Duration of service relationship
- Contract information: 7 years for legal purposes
- Marketing data: Until consent is withdrawn
- Financial records: As required by law
8. Children's Data Protection
We do not knowingly process data of children under 16 without parental consent.
9. Exercising Your Rights
To exercise your GDPR rights:
- Email: [email protected]
- Phone: +1 (212) 555-0187
- Written request to our office address
- We will respond within 30 days
10. Complaints
You have the right to lodge a complaint with your local supervisory authority if you believe your data protection rights have been violated.
11. Data Protection Officer
For data protection matters, contact our DPO:
Email: [email protected]
Address: 432 Madison Avenue, Suite 1200, New York, NY 10017
