GDPR Policy

1. Introduction

This GDPR Policy explains the rights and protections established by the General Data Protection Regulation (GDPR) and how individuals may exercise those rights when the GDPR applies to our activities.

2. Scope and Applicability

The GDPR is a European Union data protection law that may apply to organizations established within the EU and, under certain conditions, organizations established outside the EU.

Whether the GDPR applies to our website depends on the circumstances specified in Article 3 of the GDPR, including whether relevant processing activities are carried out in the context of an EU establishment, whether goods or services are offered to individuals who are in the EU, or whether their behavior within the EU is monitored.

Having a US address or primarily serving customers in the United States does not automatically exclude the GDPR. Likewise, the mere accessibility of a website to individuals in Europe does not, by itself, establish that the GDPR applies.

The applicability of the GDPR must therefore be assessed based on the actual business activities, relevant processing operations, and applicable legal requirements. Nothing in this policy should be interpreted as a definitive statement that the GDPR either applies or does not apply to every activity associated with this website.

3. Key Data Protection Principles

Where the GDPR applies, personal data processing is subject to the following principles:

  • Lawfulness, Fairness, and Transparency: Personal data must be processed lawfully, fairly, and transparently.

  • Purpose Limitation: Personal data should be collected for specified, explicit, and legitimate purposes and not processed incompatibly with those purposes.

  • Data Minimization: Personal data should be adequate, relevant, and limited to what is necessary for the intended purposes.

  • Accuracy: Personal data should be accurate and, where necessary, kept up to date.

  • Storage Limitation: Personal data should not be retained longer than necessary for the purposes for which it is processed, subject to applicable legal requirements.

  • Integrity and Confidentiality: Personal data must be processed with appropriate security to protect against unauthorized or unlawful processing and accidental loss, destruction, or damage.

  • Accountability: Where required, the relevant data controller must be able to demonstrate compliance with applicable GDPR obligations.

These principles describe the GDPR's legal framework and do not constitute a claim that any particular compliance assessment or certification has been completed.

4. Your Rights Under GDPR

Where the GDPR applies, you may have the following rights concerning your personal data. The availability and scope of each right depend on the circumstances, applicable legal requirements, and any relevant exceptions.

Right of Access

You may request confirmation of whether your personal data is being processed and, where applicable, obtain access to that data and information about the processing, as provided by the GDPR.

Right to Rectification

You may request that inaccurate personal data be corrected. Where applicable, you may also request that incomplete personal data be completed.

Right to Erasure

In certain circumstances, you may request the deletion of your personal data. This right is not absolute and may be limited where continued processing is permitted or required by law, including in certain circumstances involving legal obligations or the establishment, exercise, or defense of legal claims.

Right to Restriction of Processing

You may request that the processing of your personal data be restricted in circumstances specified by the GDPR, such as certain disputes concerning data accuracy or the lawfulness of processing.

Right to Data Portability

Where the applicable legal conditions are met, you may request to receive personal data that you have provided in a structured, commonly used, and machine-readable format. You may also have the right to transmit that data to another controller where the GDPR permits.

This right generally applies to processing based on your consent or a contract and carried out by automated means.

Right to Object

You may have the right to object to certain processing activities where the GDPR provides this right, including processing based on legitimate interests or the performance of a task in the public interest, subject to the applicable conditions.

Where personal data is processed for direct marketing, you have the right to object to that processing in accordance with the GDPR. If you object to processing for direct marketing, the personal data must no longer be processed for that purpose.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

Rights Related to Automated Decision-Making

Where applicable, you may have rights relating to decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

The GDPR provides protections and exceptions for these situations. The availability of a particular right depends on the nature of the decision and the relevant legal conditions.

5. How to Submit a GDPR Request

If you believe the GDPR applies to your personal data and wish to exercise a relevant right, you may contact us at:

Email: solutions@rionfiorasair.com

Please describe the nature of your request and provide sufficient information for us to understand what you are asking us to do. If relevant, you may identify the account, order, or interaction associated with your request.

Please do not send passwords, full payment card numbers, card security codes, or other unnecessary sensitive information by ordinary email.

Where permitted by applicable law, we may request proportionate additional information to verify your identity or authority to act on behalf of another person. Any verification measures should be appropriate to the circumstances and the nature of the request.

6. Response Time and Verification

Where the GDPR applies, requests to exercise data subject rights are generally subject to the response requirements in Article 12.

We must, where required, provide information on action taken in response to a request without undue delay and generally within one month of receiving it.

Where necessary, taking into account the complexity and number of requests, this period may be extended by up to two additional months if the GDPR's conditions are satisfied. In such cases, the individual must be informed of the extension and the reasons for it within the initial one-month period.

If we cannot act on a request, the GDPR may require us to inform the individual of the reasons and explain the right to lodge a complaint with a supervisory authority and seek a judicial remedy.

We may apply reasonable and legally permitted identity-verification procedures. We do not guarantee that every request will result in the requested action, as certain rights are subject to legal conditions, exceptions, and applicable restrictions.

7. Legal Bases and International Data Transfers

Legal Bases for Processing

Where the GDPR applies, personal data processing must have an appropriate legal basis under Article 6. Depending on the circumstances, recognized legal bases include:

  • Consent: The individual has given consent to processing for one or more specific purposes.

  • Contract: Processing is necessary to perform a contract with the individual or take steps at the individual's request before entering into a contract.

  • Legal Obligation: Processing is necessary to comply with a legal obligation.

  • Vital Interests: Processing is necessary to protect the vital interests of an individual.

  • Public Task: Processing is necessary for a task carried out in the public interest or in the exercise of official authority, where applicable.

  • Legitimate Interests: Processing is necessary for legitimate interests pursued by a controller or a third party, provided those interests are not overridden by the individual's rights and freedoms and the applicable conditions are met.

The appropriate legal basis depends on the specific processing activity and its circumstances. This policy does not assert that any particular legal basis applies to every processing activity associated with this website.

International Data Transfers

Where the GDPR applies and personal data is transferred to a country outside the European Economic Area or to an international organization, the transfer must comply with the applicable requirements of Chapter V of the GDPR.

Depending on the circumstances, the legal framework may permit transfers on the basis of an applicable adequacy decision or through other legally recognized safeguards or exceptions.

The applicable requirements depend on the countries involved, the parties to the transfer, and the relevant legal conditions. This policy does not claim that a particular transfer mechanism or safeguard has been implemented.

8. Complaints to a Data Protection Authority

Where the GDPR applies, you may have the right to lodge a complaint with a competent data protection supervisory authority, particularly in the EU Member State where you habitually reside, work, or where an alleged infringement occurred.

You may contact the relevant supervisory authority if you believe that the processing of your personal data infringes the GDPR.

You do not have to contact us before lodging a complaint where the GDPR permits you to approach a supervisory authority directly. Depending on the circumstances, you may also have the right to an effective judicial remedy.

The appropriate authority depends on the circumstances of your case and the applicable legal rules.

9. Updates to This Policy

We may update this GDPR Policy when necessary to reflect changes in applicable legal requirements or relevant business activities.

Any revised version will be published on this page with an updated revision date where appropriate. We encourage you to review this page periodically to remain informed about the GDPR-related information provided here.

10. Contact Us

Address: 2511 White Magnolia Way, Sanford, FL 32771, USA
Phone: +1 (407) 325-1962   
Email: solutions@rionfiorasair.com  
Business Hours: Monday–Friday, 9:00 AM–6:00 PM (Central Time, CT) 

  •