GDPR Compliance

General Data Protection Regulation

While Base-reef is an Australian-based practice, we recognize the importance of protecting the personal data of individuals in the European Union. This page outlines our commitment to GDPR compliance when processing data of EU residents.

The General Data Protection Regulation (GDPR) is a comprehensive privacy law that grants EU residents specific rights regarding their personal data and imposes obligations on organizations that process such data.

Legal Basis for Processing

We process personal data only when we have a lawful basis, including:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary to fulfill a contract with you or to take steps before entering into a contract
• Legal Obligation: Processing is necessary to comply with legal requirements
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided this does not override your rights

Your Rights Under GDPR

If you are an EU resident, you have the following rights regarding your personal data:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data under certain circumstances
• Right to Restrict Processing: Request limitation on how we use your data
• Right to Data Portability: Request transfer of your data to another organization
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Rights Related to Automated Decision Making: Protection from decisions based solely on automated processing

Data Protection Principles

We adhere to the following data protection principles:

• Process data lawfully, fairly, and transparently
• Collect data only for specified, explicit, and legitimate purposes
• Ensure data is adequate, relevant, and limited to what is necessary
• Maintain accurate and up-to-date data
• Retain data only as long as necessary
• Process data securely with appropriate technical and organizational measures

Data Security Measures

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, secure data storage, and regular security assessments.

International Data Transfers

As an Australian organization, any personal data you provide may be transferred to and processed in Australia. We ensure appropriate safeguards are in place when transferring data internationally, consistent with GDPR requirements.

Third-Party Data Processors

Where we engage third-party service providers to process personal data on our behalf, we ensure they provide sufficient guarantees regarding data security and GDPR compliance. We maintain written contracts with data processors that specify their obligations.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals and relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by GDPR.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month, though this may be extended by up to two months for complex requests.

You also have the right to lodge a complaint with your local data protection authority if you believe we have not adequately addressed your concerns.

Contact Information

For questions regarding GDPR compliance or to exercise your rights, please contact us at [email protected].