Information for individuals covered by the General Data Protection Regulation
Last updated: January 2024
Although Verdant-grove is based in Australia, we are committed to protecting the privacy rights of all our users, including those who are residents of the European Economic Area (EEA) or the United Kingdom. This page outlines how we comply with the General Data Protection Regulation (GDPR) for applicable individuals.
Verdant-grove Pty Ltd acts as the data controller for personal information collected through our website and services. Our contact details are:
Verdant-grove Pty Ltd
Level 12, 188 George Street
Sydney NSW 2000
Australia
Data Protection Contact: [email protected]
We process personal data on the following legal bases:
If you are covered by the GDPR, you have the following rights:
You have the right to request a copy of the personal data we hold about you and information about how we process it.
You have the right to request correction of inaccurate personal data or completion of incomplete data.
You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected.
You have the right to request that we restrict the processing of your data in certain circumstances, such as while we verify the accuracy of data you have contested.
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
You have the right to object to processing based on legitimate interests or for direct marketing purposes.
You have the right not to be subject to decisions based solely on automated processing that significantly affect you, and to request human intervention.
As an Australian company, we store and process data in Australia. When transferring data from the EEA or UK to Australia, we rely on the following safeguards:
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Retention periods vary based on:
Upon request, we can provide specific information about retention periods applicable to your data.
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and inform the relevant supervisory authority within 72 hours of becoming aware of the breach.
To exercise any of your GDPR rights, please contact us at:
We will respond to your request within one month. If your request is complex or we receive numerous requests, we may extend this period by a further two months, in which case we will inform you.
We may need to verify your identity before processing your request. There is no fee for exercising your rights, although we may charge a reasonable fee for manifestly unfounded or excessive requests.
If you are unsatisfied with how we have handled your personal data or responded to your rights request, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.