GDPR Compliance Information

Introduction

Although Spark-fern is an Australian-based company, we recognize that the General Data Protection Regulation (GDPR) applies when we process personal data of individuals in the European Union. This page outlines our GDPR compliance measures.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you provide explicit consent for specific purposes
• Contract: When processing is necessary to fulfill a service agreement
• Legitimate Interest: When we have a legitimate business interest that does not override your rights
• Legal Obligation: When required to comply with legal requirements

Your Rights Under GDPR

If you are an EU resident, you have the following rights:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

You can request deletion of your personal data under certain circumstances.

Right to Restriction

You can request that we limit how we use your personal data.

Right to Data Portability

You can request a copy of your personal data in a structured, commonly used format.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time.

Data Protection Officer

For GDPR-related inquiries, you may contact our data protection representative at:

[email protected]

International Data Transfers

Personal data collected from EU residents may be transferred to and stored in Australia. We ensure appropriate safeguards are in place for such transfers, including:

• Standard contractual clauses approved by the European Commission
• Ensuring recipients are located in countries with adequate data protection laws
• Implementing technical and organizational security measures

Data Retention Periods

We retain personal data only as long as necessary for the purposes outlined in our Privacy Policy. Specific retention periods include:

• Inquiry data: 2 years from last contact
• Client project data: 7 years from project completion
• Marketing consent data: Until consent is withdrawn
• Website analytics: 26 months

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments
• Access controls and authentication
• Staff training on data protection
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with the subject line "GDPR Request." We will respond to your request within one month, unless the request is complex or we receive multiple requests, in which case we may extend the response period by up to two additional months.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority in the EU member state where you reside, work, or where the alleged infringement occurred.

Contact Information

For questions regarding GDPR compliance:

Spark-fern
Level 14, 120 Collins Street
Melbourne VIC 3000
Australia
[email protected]