GDPR - Northside Barber Shop

Last updated: September 2026

Northside Barber Shop is committed to ensuring the protection of personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Canadian privacy legislation. This page outlines your rights and our obligations regarding data protection.

Data Controller Information

Northside Barber Shop acts as the data controller for personal information collected through this website. Our contact details are:

Northside Barber Shop
847 Queen Street West
Toronto, Ontario M6J 1G1
Canada
Email: [email protected]

Legal Basis for Processing

We process personal data based on the following legal grounds:

Consent: When you submit an appointment request or accept cookies, you provide consent for us to process your data for those specific purposes.
Contractual necessity: Processing required to fulfill appointment requests and service delivery.
Legitimate interests: Processing necessary for our legitimate business interests, such as improving our website and services, provided these do not override your fundamental rights.
Legal obligations: Processing required to comply with applicable laws and regulations.

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this information free of charge within one month of receiving your request.

Right to Rectification

You have the right to request that we correct any inaccurate personal data or complete any incomplete data we hold about you.

Right to Erasure

Also known as the "right to be forgotten," you may request that we delete your personal data when:

The data is no longer necessary for the purpose it was collected
You withdraw consent and there is no other legal basis for processing
You object to processing and there are no overriding legitimate grounds
The data has been unlawfully processed
The data must be erased to comply with legal obligations

Right to Restrict Processing

You may request that we limit the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not currently engage in automated decision-making processes.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex or we receive numerous requests, we may extend this period by two additional months, in which case we will inform you of the extension.

Data Transfers

As a Canadian business, we are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), which has been recognized by the European Commission as providing adequate protection for personal data. Any transfers of personal data are conducted in compliance with applicable data protection regulations.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Specific retention periods are:

Appointment request data: Up to 24 months
Communication records: Up to 36 months
Cookie consent preferences: Until consent is withdrawn or cookies are cleared

Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit
Secure storage practices
Access controls and authentication
Regular security assessments

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

Complaints

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. For EEA residents, this would be the data protection authority in your country of residence. For Canadian residents, complaints may be directed to the Office of the Privacy Commissioner of Canada.

Updates to This Policy

We may update this GDPR compliance information periodically. Any significant changes will be communicated through our website. We encourage you to review this page regularly.

Contact Us

For any questions regarding GDPR compliance or to exercise your data protection rights, please contact: