GDPR Compliance
Last updated: November 2024
While we are an Australian-based business primarily serving Australian clients, we recognize that data protection principles embodied in the European Union's General Data Protection Regulation (GDPR) represent best practices for personal data handling. This page outlines our commitment to GDPR-aligned data protection standards.
Legal Basis for Processing
We process personal data under the following legal bases:
- Consent: When you submit an inquiry form, you provide explicit consent for us to process the information you provide to respond to your request
- Contract: When you engage our consulting services, processing is necessary to fulfill our contractual obligations
- Legitimate Interest: We maintain records of business communications for our legitimate interest in managing client relationships and resolving potential disputes
Data Minimization
We collect only the personal information necessary to fulfill the specific purpose for which it is requested. Our inquiry forms request only name, email address, and optional business context. We do not collect personal data speculatively for potential future uses.
Your Rights Under GDPR Principles
Regardless of your location, we extend the following rights to all individuals whose personal data we process:
Right to Access
You may request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information in a commonly used electronic format.
Right to Rectification
You may request correction of inaccurate personal data or completion of incomplete personal data we hold about you.
Right to Erasure
You may request deletion of your personal data when it is no longer necessary for the purposes for which we collected it, when you withdraw consent, or when you object to processing and we have no overriding legitimate grounds to continue. This right is subject to our legal obligations to retain certain business records.
Right to Restrict Processing
You may request that we limit how we use your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.
Right to Data Portability
Where technically feasible, you may request that we transfer your personal data to another controller in a structured, commonly used, machine-readable format.
Right to Object
You may object to processing of your personal data based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Exercising Your Rights
To exercise any of these rights, send a detailed request to [email protected]. We will respond within 30 days of receiving your request. We may require additional information to verify your identity before fulfilling requests involving personal data disclosure or deletion.
Data Protection Measures
We implement appropriate technical and organizational measures to ensure data security commensurate with the risks associated with processing:
- Personal data is stored on servers with encryption at rest and in transit
- Access to personal data is restricted to authorized personnel on a need-to-know basis
- Regular security assessments identify and address potential vulnerabilities
- Staff handling personal data receive training on data protection principles and procedures
Data Breach Notification
In the event of a data breach that poses a risk to individual rights and freedoms, we will notify affected individuals within 72 hours of becoming aware of the breach, providing details about the nature of the breach, likely consequences, and measures taken to address it.
International Data Transfers
We do not routinely transfer personal data outside Australia. If circumstances require international data transfer to jurisdictions without adequate data protection frameworks, we will implement appropriate safeguards such as standard contractual clauses and obtain your explicit consent where required.
Automated Decision-Making
We do not use automated decision-making processes or profiling that produces legal effects or similarly significant effects on individuals.
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Inquiry records: 3 years from last contact
- Client engagement records: 7 years from project completion (to comply with business record-keeping requirements)
- Operational data from consulting projects: Returned or destroyed upon project completion unless retention is requested
Accountability
We maintain documentation of our data processing activities, security measures, and data protection impact assessments to demonstrate compliance with data protection principles.
Supervisory Authority
If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with the Office of the Australian Information Commissioner or, if you are located in the European Union, with your local data protection supervisory authority.
Contact Information
For questions about our GDPR compliance or to exercise your data protection rights:
Email: [email protected]
Address: Level 7, 342 Flinders Lane, Melbourne VIC 3000, Australia