GDPR Compliance
Last updated: November 2024
Fuchsia-mesa is committed to protecting the privacy and personal data of individuals in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.
Data Controller
Fuchsia-mesa acts as the data controller for personal information collected through this website. Our contact details are:
Fuchsia-mesa
42 Heritage Lane
Sydney, NSW 2000
Australia
Email: [email protected]
Lawful Basis for Processing
We process personal data on the following legal bases:
- Consent: When you voluntarily submit information through our forms or sign up for communications
- Contract: When necessary to fulfil programme bookings and service requests
- Legitimate interests: For website analytics and service improvement, balanced against your privacy rights
- Legal obligation: When required to comply with applicable laws
Your Rights Under GDPR
If you are located in the European Economic Area (EEA), you have the following rights:
Right of Access
You may request a copy of the personal data we hold about you. We will provide this information within one month of receiving your request.
Right to Rectification
You may request that we correct any inaccurate or incomplete personal data we hold about you.
Right to Erasure
You may request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for its original purpose.
Right to Restrict Processing
You may request that we limit how we use your personal data while we address a complaint or verify the accuracy of your data.
Right to Data Portability
You may request a copy of your personal data in a structured, commonly used, machine-readable format.
Right to Object
You may object to our processing of your personal data for direct marketing purposes or where we rely on legitimate interests.
Rights Related to Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
International Data Transfers
As we are based in Australia, your data may be transferred outside the EEA. When this occurs, we ensure appropriate safeguards are in place to protect your data, including standard contractual clauses approved by the European Commission.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our standard retention periods are:
- Enquiry data: 3 years from last contact
- Programme participation records: 7 years for legal compliance
- Marketing consent records: Duration of consent plus 2 years
- Website analytics: 26 months
Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit
- Access controls and authentication
- Regular security assessments
- Staff training on data protection
Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.
Exercising Your Rights
To exercise any of your rights under GDPR, please contact us at [email protected]. We may need to verify your identity before processing your request. We aim to respond to all requests within one month.
Complaints
If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with your local data protection authority. We encourage you to contact us first so we may address your concerns directly.
Updates to This Notice
We may update this GDPR notice periodically to reflect changes in our practices or legal requirements. We will post any changes on this page with an updated revision date.