GDPR Information

Last Updated: January 2024

Introduction

pine-rhythm is committed to protecting the privacy and personal data of all individuals, including those residing in the European Economic Area (EEA) and the United Kingdom. This page provides information about your rights under the General Data Protection Regulation (GDPR) and how we comply with this regulation.

Data Controller

pine-rhythm acts as the data controller for personal information collected through our website and services. As the data controller, we determine the purposes and means of processing your personal data.

Contact:
pine-rhythm
Level 12, 180 George Street
Sydney NSW 2000
Australia
Email: [email protected]

Legal Basis for Processing

Under GDPR, we must have a valid legal basis for processing your personal data. We rely on the following legal bases:

• Consent: Where you have given clear consent for us to process your personal data for specific purposes, such as sending marketing communications.
• Contract: Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
• Legitimate Interests: Where processing is necessary for our legitimate business interests, provided these interests do not override your rights and freedoms.
• Legal Obligation: Where processing is necessary to comply with a legal obligation.

Your Rights Under GDPR

If you are located in the EEA or UK, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this information free of charge within one month of receiving your request.

Right to Rectification

You have the right to request that we correct any inaccurate personal data or complete any incomplete data we hold about you.

Right to Erasure

You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected, or you withdraw your consent.

Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. We do not currently engage in such automated decision making.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, we may extend this period by two months, but we will inform you of any extension and the reasons for it.

To protect your privacy, we may need to verify your identity before processing your request. We will not charge a fee for fulfilling your request unless it is manifestly unfounded or excessive.

International Data Transfers

As an Australian company, we may transfer personal data from the EEA or UK to Australia. Australia has not received an adequacy decision from the European Commission. To ensure adequate protection, we implement appropriate safeguards including:

• Standard Contractual Clauses approved by the European Commission
• Appropriate technical and organisational security measures

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. When determining retention periods, we consider:

• The nature and sensitivity of the data
• Potential risks from unauthorised use or disclosure
• Purposes for processing and whether we can achieve them through other means
• Applicable legal requirements

Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security assessments
• Staff training on data protection

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk to you, we will also notify you directly.

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. For individuals in the EEA, this would be the data protection authority in your country of residence. For UK residents, this is the Information Commissioner's Office (ICO).

However, we encourage you to contact us first so we can address your concerns directly: [email protected]

Updates to This Notice

We may update this GDPR information from time to time. We will post any changes on this page and update the "Last Updated" date.

Contact

For any questions about this GDPR notice or how we handle your personal data, please contact:

pine-rhythm Data Protection
Email: [email protected]