GDPR Compliance

Last updated: September 22, 2026

Your Data Protection Rights

Under the General Data Protection Regulation (GDPR) and applicable Australian privacy laws, you have specific rights regarding your personal data. We are committed to respecting these rights and facilitating their exercise.

Right to Access

You have the right to request copies of your personal data that we hold. We will provide this information in a commonly used electronic format within one month of your request, subject to verification of your identity.

Right to Rectification

If you believe any personal information we hold about you is inaccurate or incomplete, you have the right to request correction. We will make reasonable efforts to update information promptly upon receiving valid correction requests.

Right to Erasure

You may request deletion of your personal data under certain circumstances, including when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and no other legal basis exists for processing
• You object to processing and no overriding legitimate grounds exist
• The data has been unlawfully processed

Note that we may retain certain information where required by law or for legitimate business purposes such as dispute resolution.

Right to Restrict Processing

You have the right to request restriction of processing your personal data in specific situations:

• When you contest the accuracy of the data during verification
• When processing is unlawful but you prefer restriction over erasure
• When we no longer need the data but you require it for legal claims
• When you have objected to processing pending verification of legitimate grounds

Right to Data Portability

Where processing is based on consent or contract performance and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis for processing. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you provide explicit consent for specific processing activities
• Contract performance: Processing necessary to fulfill service agreements
• Legitimate interests: Processing necessary for legitimate business operations, where not overridden by your rights
• Legal obligations: Processing required to comply with applicable laws

Data Transfers

Personal data is primarily processed and stored within Australia. If data must be transferred internationally, we ensure appropriate safeguards are in place to protect your information in accordance with GDPR requirements.

Data Security Measures

We implement technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorized personnel
• Regular security assessments and updates
• Staff training on data protection practices

Exercising Your Rights

To exercise any of your data protection rights, please contact us at [email protected] or write to 147 Spencer Street, Melbourne VIC 3000, Australia. Include sufficient information to verify your identity and specify which right you wish to exercise.

We will respond to valid requests within one month. In complex cases, this period may be extended by two additional months with notification of the delay and reasons.

Complaints

If you believe we have not handled your personal data in accordance with applicable data protection laws, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.

Children's Data

We do not knowingly collect or process personal data from individuals under 18 years of age. If you become aware that a minor has provided us with personal information, please contact us immediately so we can take appropriate action.

Updates to This Notice

We may update this GDPR compliance statement to reflect changes in our practices or applicable regulations. Material changes will be communicated through our website with an updated effective date.