General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) is a regulation that protects the personal data of individuals located in the European Union (EU) and the European Economic Area (collectively the EU) from possible privacy and data breaches. The GDPR allows individuals control over their personal data that is held or processed by data controllers, which includes Creative Therapy Consultants (CTC).

The GDPR defines “personal data” as: “any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

CTC is committed to protecting and maintaining the privacy of personal data. As a data controller, CTC is responsible for explaining to you how and why it processes personal data. CTC will collect and process your personal data lawfully, fairly, and in a transparent manner; process, use, and disclose your personal data only for valid purposes; keep the personal data it collects and maintains accurate and up to date; keep your personal data secure in accordance with applicable laws and regulations; and store personal data only as long as necessary to meet CTC’s legitimate needs.

This GDPR Privacy Notice outlines CTC’s collection, use, processing, and disclosure of personal data that you provide to CTC. When you submit personal data to CTC, communicate with CTC, or you use CTC’s websites or other services, you consent to CTC’s collection, use, processing, and disclosure of your personal data as described in this GDPR Privacy Notice. In the event of a data breach that poses a high risk to your personal data, CTC will notify you of the breach without undue delay.

COLLECTION AND USE OF INFORMATION

CTC collects, receives, and records your personal data any time you contact CTC or interact with CTC, such as using CTC’s services, operations, or websites. CTC may also combine personal data you provide to CTC with information from CTC’s affiliates or third parties from time to time. You are not required to provide your personal data to CTC. Any personal data you provide to CTC is voluntary.

CTC also collects certain information when you use its websites, which is recordable anytime you use the internet or other means of communication. This information, includes the Internet Protocol (IP) address used to connect your computer to the internet; your domain name, if any; and computer and connection information, such as a browser type and version.

Like other websites, CTC’s websites use “cookies” to record your activity while visiting CTC’s websites. CTC uses this information to learn how you use CTC’s websites, to remember your preferences, and to diagnose problems. You can learn more about how CTC uses these systems and technology in CTC’s Privacy Policy which is available at: https://www.creativethereapyconsultants.com/online-privacy-policy/

CTC collects, records, and processes your personal data as necessary to accomplish CTC’s legitimate interests, purposes, functions, and responsibilities.

USE AND DISCLOSURE OF INFORMATION

CTC only uses or discloses your personal data if it has your consent, or it is otherwise authorized to do so by the GDPR or other applicable international, federal, state, and local laws or regulations. CTC may also use or disclose your personal data as follows:

• Emergency Circumstances: CTC may share your personal data when necessary to protect your interests if you are physically or legally incapable of providing consent.
  • Necessity: CTC may share your personal data when necessary in accordance with applicable law, provided that your personal data is protected by appropriate safeguards to prevent further unauthorized use or disclosure.
  • Public Information: CTC may share your personal data if you have manifestly publicized your personal data.
  • Archiving: The may share your personal data for archival purposes such as public interest needs, public health, and for other historical research and statistical purposes.
  • Performance of a Contract: CTC may share your personal data if it is necessary to administer a contract you have with CTC.
  • Legal Obligation: CTC may share your personal data if disclosure is required or permitted by international, federal, and state laws and regulations.
  • Service Providers: CTC may use affiliate and third party service provides who have entered into a contract with CTC to assist CTC in performing its services, duties, functions, and operations. In these cases, CTC may share your personal data with such party provided that your personal data is protected by appropriate safeguards to prevent further unauthorized use or disclosure. Third party services providers may include:

• 1ShoppingCart: CTC uses 1ShoppingCart to store user data and process payment information. For more information about how this data is protected, please see 1ShoppingCarts’s data privacy policy:  https://www.1shoppingcart.com/Legal/assets/privacy-policy.pdf
• WordPress: By default, WordPress does not collect any personal data about visitors, and only collects the data shown on the User Profile screen from registered users.
• Social Media: We use Google Analytics to track social shares made at our website. Google automatically collects and stores certain information in their server logs which includes device event information such as crashes, system activity, hardware settings, browser type, browser language, the date and time of your request and referral URL, cookies that may uniquely identify your browser or your Google Account, in accordance with their data privacy policy: https://policies.google.com/privacy 
  For more information about how this data may be used, please see Facebook’s data privacy policy: https://www.facebook.com/about/privacy/update
• Contact Forms: We may keep contact form submissions for a certain period for customer service purposes.
• Course Applications/Forms: We do store personal information submitted during the application or registration of our continuing education courses. This information is stored for customer service purposes, but we do not share the information submitted through them for marketing purposes.
• Cookies: If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. If you have an account and you log in to this site, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser. When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.
• Embedded content from other websites: Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
• Analytics: Google Analytics Dashboard for Word Press (GADWP) does not send personal information data to Google by default. Personally identifiable information (PII) includes and is not limited to: names, social security numbers, email addresses, data that permanently identifies a particular device (such as a mobile phone’s unique device identifier if such an identifier cannot be reset), or similar data. See here for their privacy information: https://exactmetrics.com/google-analytics-gdpr-and-user-data-privacy-compliance/
• WishList: We collect information about you during the course purchase process (see 1shoppingcart), as well as information relating to your course progression and quiz performance. When you purchase from us, we’ll ask you to provide an email address. We’ll use this information for purposes, such as, to:
  -Send you information about your account and order
  -Create your account for our learning management system
  If you register for a free account, then we will store your personal data. We store information about you for as long as your account exists. We store course progress, including completion status, quiz scores, assignments and/or essay submissions (if applicable). We will also store comments on courses, lessons, topics, assignments, and essays if you choose to leave them. Members of our team have access to the information you provide us. For example, both Administrators and Group Leaders can access: Order information such as your enrolled courses, course progress and username / email address. Any additional information added in your WordPress User Profile can also be visible to the administrator(s). We accept payments through 1ShoppingCart. When processing payments, some of your data will be passed to 1shoppingcart, including information required to process or support the payment, such as the purchase total and billing information. Please see the 1ShoppingCart Privacy Policy for more details.
• Mailchimp: CTC utilizes Mailchimp to distribute email correspondence, including but not limited to Quarterly Newsletters, email follow up, and course/conference details. For more information about how this data is protected, view Mailchimp’s privacy policy: https://mailchimp.com/legal/privacy/
• Synology: CTC utilizes Synology to backup and store personal data. For more information about how this data is protected, view Synology’s privacy policy at https://www.synology.com/en-us/privacy
• Dropbox: CTC uses Dropbox to backup, store, and share information within the CTC team. For more information about how personal data is protected, view Dropbox’s privacy policy at https://www.dropbox.com/privacy
• CTC-Affiliated Programs: CTC may share your personal data with parties that are affiliated with CTC for the purpose of contacting you about products, services, or benefits that may be of interest to you.
• De-Identified and Aggregate Information: CTC may use and disclose personal data in de-identified or aggregate form without limitation. However, this information will not include personally identifiable information, is purely statistical in nature, and cannot be tied to you.

CTC may use and disclose your personal data on its own behalf, share it with its affiliates and other third parties, or share it with other individuals or third parties to whom you have authorized CTC to disclose your personal data for the purposes of processing information; communicating with you on behalf of CTC; providing services or products that you have requested; or for other authorized activities or functions. CTC may also use or disclose your personal data to conduct general demographic and statistical research to improve CTC programs and operations, to enforce CTC policies, and to comply with applicable laws and regulations.

Where your personal data is disclosed to CTC’s affiliates or third parties, CTC requires the recipient to agree to process and use personal data based on instructions from CTC and in compliance with CTC’s contracts with the third party, and other appropriate confidentiality and security measures.

SECURITY

CTC uses appropriate technical and organizational security measures to protect your personal data from unauthorized access and unauthorized alteration, use, disclosure or destruction.

These measures include internal reviews of CTC’s data collection, storage and processing practices and security measures, including appropriate encryption and physical security measures to guard against unauthorized access to systems where CTC stores data. You can learn more about CTC’s data security by reading CTC’s Privacy Policy.
Personal data created in the European Union will be transferred out of the European Union to CTC in compliance with appropriate safeguards and applicable law, including the GDPR and federal, state, and local information privacy laws.

If you feel CTC has not complied with applicable EU laws regulating such personal data, you have the right to file a complaint with the appropriate supervisory authority in the EU in accordance with your rights listed in this GDPR Privacy Notice.

RETENTION AND DESTRUCTION OF INFORMATION

Your personal data will be retained by CTC in accordance with applicable state and federal laws, and the applicable retention periods in CTC’s records management policy. Your personal data will be destroyed upon your request unless applicable laws or regulations require destruction after the expiration of an applicable retention period. The manner of destruction will be appropriate to preserve and ensure the confidentiality of your personal data given the level of sensitivity, value and importance to you and to CTC. If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.
For users that register on our website, we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

YOUR RIGHTS

At any point in which CTC is in possession of or is processing your personal data, you have the following rights, subject to applicable laws and regulations:

• Right of access: You have the right to request a copy of the information that CTC holds about you.
  • Right of rectification: You have a right to correct data that CTC hold about you that is inaccurate or incomplete.
  • Right to be forgotten: In certain circumstances you can ask for the data CTC holds about you to be erased from its records.
  • Right to restriction of processing: Where certain conditions apply, you have a right to restrict CTC’s processing of your personal data.
  • Right of portability: You have the right to have the data CTC holds about you transferred to another organization.
  • Right to object: You have the right to object to certain types of processing such as direct marketing.
  • Right to object to automated processing, including profiling: You have the right to not be subject to the legal effects of automated processing or profiling.
  • Right to judicial review: In the event that CTC refuses your request under any of the above rights, it will provide you with a reason as to why. You have the right to complain as outlined in this GDPR Privacy Notice.
  • Right to withdraw consent: You have the right to withdraw your consent to CTC’s collection, recording, use, processing, or disclosure of your personal data at any time. However, your withdrawal of consent will not affect CTC’s lawful use or disclosure of your personal data while your consent was in effect.

Any exercise of the above rights can also be forwarded to any third party involved in the processing of your personal data. Your rights may differ depending upon the location within the world where your personal information was created or shared. The erasure of your information may also be subject to CTC’s records retention and management policies. Should your personal data fall within one of the areas where CTC is legally required to retain your personal data for a certain period of time, CTC will retain that personal data in accordance with its legal obligations.

Please note that your rights in this GDPR Privacy Notice are not absolute and CTC may refuse certain requests where exceptions apply. Should CTC determine that you are not entitled to exercise a certain right, CTC will provide you with the reason(s) for the denial.

REQUESTS FOR PERSONAL DATA HELD BY CTC

At any time, you may request that CTC provide you with the personal data CTC collects about you and to transmit your personal data to another data controller where possible. You may also request that CTC confirms what personal data it possesses about you and whether or not your personal data is being processed by CTC; is subject to the use of automated decision-making; and how CTC processes your personal data.

Similarly, you can request confirmation as to whether CTC received your personal data; if it disclosed your personal data to a third party; and how long CTC will store your personal data under its records management policy.
If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you by going here: https://creativetherapyconsultants.com/gdpr-request-personal-data/. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

UPDATES TO THIS GDPR PRIVACY NOTICE

CTC may update or change this GDPR Privacy Notice at any time. Your continued use of CTC’s websites or third party applications, or continued interaction with CTC or submission of personal data to CTC, after any such change indicates your acceptance of the changes.

COMPLAINTS AND CONTACT INFORMATION

In the event that you wish to make a complaint about how your personal data is being processed by CTC or its authorized third parties, or how your complaint has been handled, you may lodge a complaint directly with the GDPR supervisory authority and CTC.

If you wish to contact CTC or file a complaint concerning CTC’s collection, recording, use, processing, or disclosure of personal data please contact us at:

Creative Therapy Consultants
8540 Wildcat Road
Tipp City, Ohio 45371

855-CTC-NTMC