GDPR Compliance

Last updated: June 23, 2026

The General Data Protection Regulation (GDPR) is a European Union regulation on data protection and privacy. This page explains how we comply with GDPR requirements and protect the rights of individuals in the European Economic Area.

Legal Basis for Processing

We process personal data under the following legal bases:

Consent: You have given clear consent for us to process your personal data for specific purposes
Contract: Processing is necessary for a contract we have with you
Legal obligation: Processing is necessary for us to comply with the law
Legitimate interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those interests

Your Rights Under GDPR

Under GDPR, you have the following rights:

Right to be informed: You have the right to clear and transparent information about how we use your data
Right of access: You have the right to request a copy of the personal data we hold about you
Right to rectification: You have the right to correct inaccurate or incomplete personal data
Right to erasure: You have the right to request deletion of your personal data in certain circumstances
Right to restrict processing: You have the right to request that we limit how we use your data
Right to data portability: You have the right to receive your data in a structured, commonly used format
Right to object: You have the right to object to certain types of processing
Rights related to automated decision making: You have rights regarding automated decision making and profiling

Data Protection Officer

For questions related to GDPR compliance or to exercise your rights, please contact us at contact at quaint-brook.com.

International Data Transfers

When we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place to protect your information in accordance with GDPR requirements.

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the appropriate supervisory authority within 72 hours and inform affected individuals without undue delay.

Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. When data is no longer needed, we securely delete or anonymize it.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at contact at quaint-brook.com. We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of any such extension.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. You can contact your local data protection authority in the European Economic Area.