GDPR Compliance

Last Updated: September 22, 2026

Tide Ocelot is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR). This page explains how we comply with GDPR requirements and your rights under this regulation.

Data Controller

For the purposes of GDPR, the data controller is:

Tide Ocelot
2847 Redwood Trail
Boulder, CO 80302
United States
Email: [email protected]

Legal Basis for Processing

We process your personal data under the following legal bases:

Purpose	Legal Basis
Program enrollment and service delivery	Performance of contract
Communication about services	Legitimate interest
Website analytics and improvement	Legitimate interest
Marketing communications	Consent
Legal compliance	Legal obligation

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this information in a commonly used electronic format.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required for compliance with a legal obligation

Right to Restriction of Processing

You can request that we limit how we use your data when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you. We do not currently use automated decision-making processes.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with the subject line "GDPR Request" and specify which right you wish to exercise.

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of any such extension.

Data Protection Officer

For questions regarding data protection or to exercise your rights, you can contact our data protection contact at [email protected].

Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions by the European Commission
• Other legally approved transfer mechanisms

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe our processing of your personal data violates GDPR. Contact information for EU data protection authorities can be found at: https://edpb.europa.eu/about-edpb/board/members_en

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. Retention periods vary based on:

• The nature of the data
• The purpose of processing
• Applicable legal requirements
• Legitimate business interests

Children's Data

We do not knowingly process personal data of individuals under 16 years of age. If you believe we have collected data from a child under 16, please contact us immediately so we can delete it.

Updates to This Policy

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. The date of the last update is shown at the top of this page.

Contact Information

For any questions regarding GDPR compliance or to exercise your rights:

Email: [email protected]
Address: 2847 Redwood Trail, Boulder, CO 80302, United States