GDPR Information

Your Rights Under GDPR

The General Data Protection Regulation (GDPR) provides comprehensive rights regarding your personal data. As a service operating within the European Union, we fully comply with GDPR requirements and are committed to protecting your privacy rights.

Data Controller Information

For the purposes of GDPR, the data controller is:

summit-elk
12 Merrion Square East
Dublin 2, D02 X576
Ireland
Email: [email protected]

Detailed Rights Explanation

Right of Access (Article 15)

You have the right to obtain confirmation as to whether your personal data is being processed, and if so, to access that data along with information about how it is being used. This includes receiving a copy of your personal data in a commonly used format.

How to exercise: Submit a request to [email protected] with "GDPR Access Request" in the subject line. We will respond within 30 days.

Right to Rectification (Article 16)

If your personal data is inaccurate or incomplete, you have the right to have it corrected or completed. We will make reasonable efforts to communicate any corrections to third parties who received your data.

How to exercise: Contact us with the specific information requiring correction, and we will update our records promptly.

Right to Erasure / Right to be Forgotten (Article 17)

You may request deletion of your personal data under certain circumstances, including:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent on which processing is based
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Note: This right is not absolute and may not apply if we need to retain data for legal compliance or defense of legal claims.

Right to Restriction of Processing (Article 18)

You can request that we limit how we use your data in specific situations:

• While we verify the accuracy of disputed data
• When processing is unlawful but you prefer restriction over deletion
• When we no longer need the data but you require it for legal claims
• While we verify legitimate grounds for processing following your objection

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible. This applies to data you provided based on consent or contract performance.

Right to Object (Article 21)

You may object to processing based on legitimate interests or for direct marketing purposes. Upon receiving an objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent (Article 7)

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with your local supervisory authority.

For Ireland, the supervisory authority is:
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland
Website: dataprotection.ie

Data Processing Details

Legal Basis for Processing

We process your data under the following legal bases:

• Consent (Article 6(1)(a)): For marketing communications and certain optional features
• Contract Performance (Article 6(1)(b)): To deliver the services you have requested
• Legal Obligation (Article 6(1)(c)): To comply with tax, accounting, and other legal requirements
• Legitimate Interests (Article 6(1)(f)): To improve our services, prevent fraud, and ensure website security

Data Categories We Process

• Identity data: name, username
• Contact data: email address, physical address
• Technical data: IP address, browser information, device information
• Usage data: how you interact with our website and services
• Service data: information about your participation in our programs

Data Retention Periods

We retain personal data for the following periods:

• Service participant data: Duration of service plus 3 years for legal and contractual purposes
• Inquiry and consultation data: 2 years from last contact
• Marketing consent data: Until consent is withdrawn
• Technical and usage data: 13 months

Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Data Security Measures

We implement appropriate technical and organizational measures including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication procedures
• Staff training on data protection obligations
• Incident response and breach notification procedures

International Transfers

If we transfer your data outside the European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or transfers to countries with adequacy decisions.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with:

• Your full name and contact information
• A clear description of which right you wish to exercise
• Any relevant details to help us locate your data

We will respond to your request within 30 days, or inform you if we require an extension of up to an additional 60 days due to complexity or volume of requests.

Updates to This Information

We may update this GDPR information to reflect changes in our practices or legal requirements. Material changes will be communicated through prominent notices on our website.