basin-osprey

Our Commitment to GDPR

Although basin-osprey operates primarily in Australia, we recognize that some of our clients may be residents of the European Union or European Economic Area. We are committed to complying with the General Data Protection Regulation (GDPR) for all EU/EEA data subjects.

This statement outlines how we meet GDPR requirements and protect the rights of EU/EEA individuals.

Legal Basis for Processing

We process personal data under the following legal bases:

Contract Performance: Processing necessary to fulfill service bookings and agreements
Consent: Where you have provided explicit consent for specific processing activities
Legitimate Interests: For business operations, fraud prevention, and service improvement, where not overridden by your rights
Legal Obligation: Where required by applicable laws and regulations

Your GDPR Rights

If you are an EU/EEA resident, you have the following rights under GDPR:

Right to Access

You may request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You may request correction of inaccurate or incomplete personal data.

Right to Erasure

You may request deletion of your personal data under certain circumstances, such as when the data is no longer necessary or when you withdraw consent.

Right to Restrict Processing

You may request limitation of how we process your data in specific situations.

Right to Data Portability

You may request transfer of your data to another service provider in a structured, commonly used format.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Right to Lodge a Complaint

You may lodge a complaint with your local supervisory authority if you believe we have not complied with GDPR.

Data Protection Officer

For GDPR-related inquiries or to exercise your rights, contact our data protection team at:

Email: info@basin-osprey.com

Subject Line: GDPR Request

We will respond to all requests within one month, as required by GDPR.

International Data Transfers

As we are based in Australia, personal data from EU/EEA residents may be transferred outside the European Economic Area. When such transfers occur:

We ensure appropriate safeguards are in place, such as standard contractual clauses
We limit transfers to what is necessary for service delivery
We require third parties to maintain adequate data protection standards

Australia's privacy framework has been recognized as providing adequate protection under previous adequacy assessments.

Data Retention Under GDPR

We retain personal data only as long as necessary for the purposes for which it was collected:

Service booking data: Duration of service plus seven years for financial records
Communication records: Three years from last contact
Marketing consent: Until consent is withdrawn
Website analytics: 26 months maximum

After these periods, data is securely deleted or anonymized.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

Data Breach Notification

In the event of a data breach affecting EU/EEA residents, we will:

Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
Notify affected individuals without undue delay if the breach poses a high risk to their rights and freedoms
Provide information about the nature of the breach and steps taken to address it

Third-Party Processors

We work with third-party service providers who process data on our behalf. All processors are:

Contractually obligated to comply with GDPR requirements
Required to implement appropriate security measures
Prohibited from using data for their own purposes
Subject to regular compliance assessments

Children's Data

We do not knowingly process personal data of children under 16 without parental consent. If we discover such processing has occurred, we will delete the data immediately.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated to affected individuals.

Exercising Your Rights

To exercise any GDPR rights or for questions about our data protection practices: