GDPR Compliance

We are committed to protecting your personal data and respecting your privacy rights in accordance with the General Data Protection Regulation and applicable Australian privacy laws.

Legal Basis for Processing

We process your personal data based on one or more of the following legal grounds:

  • Contract Performance: Processing necessary to fulfill our service obligations to you
  • Consent: You have given explicit consent for specific processing activities
  • Legitimate Interest: Processing necessary for our legitimate business interests, balanced against your rights
  • Legal Obligation: Processing required to comply with legal requirements

Data Subject Rights

Under GDPR and Australian privacy law, you have the following rights:

Right to Access

You have the right to obtain confirmation about whether we process your personal data and to access that data. We will provide a copy of your personal information in a commonly used electronic format upon request.

Right to Rectification

You can request correction of inaccurate personal data we hold about you. You may also request completion of incomplete data by providing supplementary information.

Right to Erasure

You may request deletion of your personal data in certain circumstances, including:

  • Data no longer necessary for original collection purpose
  • Consent withdrawal where consent was the processing basis
  • Objection to processing based on legitimate interests
  • Data processed unlawfully
  • Legal requirement to delete the data

This right is not absolute. We may need to retain certain information to comply with legal obligations or establish legal claims.

Right to Restriction of Processing

You may request that we limit how we use your data in specific situations:

  • While we verify data accuracy following your correction request
  • When processing is unlawful but you prefer restriction over deletion
  • When we no longer need the data but you require it for legal claims
  • While we verify legitimate grounds following your objection to processing

Right to Data Portability

Where technically feasible, you have the right to receive personal data you provided to us in a structured, commonly used, machine-readable format. You may also request direct transmission to another controller where technically possible.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests or we need the data for legal claims.

Rights Related to Automated Decision-Making

We do not currently use automated decision-making or profiling that produces legal effects or similarly significant impacts. Should this change, you will be informed and provided appropriate rights regarding such processing.

Exercising Your Rights

To exercise any of these rights, submit a request to [email protected]. Please include:

  • Clear description of which right you are exercising
  • Sufficient information to verify your identity
  • Specific details about the data or processing in question

We will respond to verified requests within one month. Complex requests may require additional time, about which we will inform you.

Data Protection Measures

We implement appropriate technical and organizational measures to ensure data security:

  • Encryption of data in transit and at rest
  • Regular security assessments and penetration testing
  • Access controls and authentication mechanisms
  • Staff training on data protection principles
  • Incident response procedures for data breaches
  • Regular backups with secure storage

Data Breach Notification

In the event of a data breach that poses risks to your rights and freedoms, we will notify you without undue delay and no later than 72 hours after becoming aware of the breach. Notification will include:

  • Nature of the breach and categories of data affected
  • Likely consequences of the breach
  • Measures taken or proposed to address the breach
  • Contact information for further inquiries

International Data Transfers

If we transfer your data outside Australia, we ensure appropriate safeguards are in place through:

  • Standard contractual clauses approved by relevant authorities
  • Adequacy decisions recognizing equivalent protection levels
  • Binding corporate rules for intra-group transfers

Data Processing Records

We maintain records of processing activities including:

  • Purposes of processing
  • Categories of data subjects and personal data
  • Recipients of personal data
  • International transfers and safeguards
  • Retention periods
  • Security measures implemented

Third-Party Processors

We carefully select third-party processors and ensure they:

  • Provide sufficient guarantees of GDPR compliance
  • Process data only on our documented instructions
  • Maintain confidentiality obligations
  • Implement appropriate security measures
  • Assist with data subject rights requests
  • Delete or return data upon service termination

Complaints

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Office of the Australian Information Commissioner or relevant supervisory authority in your jurisdiction.

We encourage you to contact us first so we can address your concerns directly.

Contact Information

For GDPR-related inquiries or to exercise your rights:

Email: [email protected]
Address: Level 8, 420 George Street, Sydney NSW 2000, Australia

Last updated: June 23, 2026