GDPR Compliance

Effective Date: June 25, 2026

Last Updated: June 25, 2026

Introduction

While cove ibex is a Canadian company primarily serving Canadian businesses, we recognize that some of our clients or website visitors may be located in the European Union. This page outlines our commitment to data protection principles consistent with the General Data Protection Regulation.

Our Commitment to Data Protection

We are committed to protecting the personal data of all individuals who interact with our services, regardless of their location. Our data handling practices align with internationally recognized data protection standards, including those established by the GDPR.

Legal Basis for Processing

When we process personal data, we do so based on one or more of the following legal grounds:

  • Consent: You have given clear consent for us to process your personal data for a specific purpose.
  • Contract: Processing is necessary to fulfill a contract we have with you or to take steps at your request before entering into a contract.
  • Legal Obligation: Processing is necessary for us to comply with the law.
  • Legitimate Interests: Processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.

Your Data Protection Rights

If you are located in the European Union, you have the following rights regarding your personal data:

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee for multiple copies or manifestly unfounded requests.

Right to Rectification

You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.

Right to Erasure

You have the right to request that we erase your personal data under certain conditions, such as when the data is no longer necessary for the purposes it was collected or you withdraw your consent.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data under certain conditions, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

Right to Object

You have the right to object to our processing of your personal data under certain conditions, particularly when processing is based on legitimate interests or for direct marketing purposes.

Data Processing Activities

We process personal data for the following purposes:

  • Providing administrative outsourcing services to clients
  • Responding to inquiries and service requests
  • Maintaining business records and accounts
  • Improving our services and website functionality
  • Complying with legal and regulatory requirements

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including any legal, accounting, or reporting requirements. Specific retention periods depend on the nature of the data and the purpose for processing:

  • Client service data: retained for the duration of the service relationship plus seven years for business record purposes
  • Inquiry data: retained for two years unless a service relationship is established
  • Marketing consent data: retained until consent is withdrawn

International Data Transfers

Our services and data storage are located in Canada. If you are located in the European Union, any personal data you provide to us will be transferred to and processed in Canada. Canada is recognized by the European Commission as providing an adequate level of data protection for commercial organizations.

Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of data in transit and at rest
  • Regular security assessments and penetration testing
  • Access controls and authentication mechanisms
  • Employee training on data protection principles
  • Incident response and breach notification procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also notify relevant supervisory authorities as required by applicable law.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects individuals.

Children's Data

Our services are not directed to children under the age of 16. We do not knowingly collect or process personal data from children. If we become aware that we have collected data from a child without appropriate consent, we will take steps to delete it promptly.

Exercising Your Rights

To exercise any of your data protection rights, please contact us using the information provided below. We will respond to your request within one month, though this may be extended by up to two months for complex requests. We will inform you of any such extension.

You also have the right to lodge a complaint with a supervisory authority, particularly in the EU member state where you reside, work, or where an alleged infringement occurred.

Data Protection Officer

For questions about data protection or to exercise your rights, you may contact our data protection representative at:

cove ibex
Data Protection Inquiries
427 Laurier Avenue West
Ottawa, Ontario K1R 7Y2
Canada
Email: privacy at cove-ibex.com

Updates to This Statement

We may update this GDPR compliance statement periodically to reflect changes in our practices or legal requirements. We will post the updated statement on this page with a new effective date.

Additional Resources

For more information about GDPR and your data protection rights, you can visit:

  • European Commission Data Protection website
  • Your local EU data protection authority
  • Office of the Privacy Commissioner of Canada