GDPR Compliance

Last updated: November 2024

Crisp-heath is committed to protecting the privacy and security of personal data in compliance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

Data Controller

For the purposes of the GDPR, Crisp-heath acts as the data controller for personal information collected through this website.

Contact details:
Crisp-heath
42 Soundwave Lane
Southbank VIC 3006
Australia
Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you submit a contact form or subscribe to communications
• Contract: When processing is necessary for service delivery
• Legitimate Interests: For improving our services and website functionality
• Legal Obligation: When required to comply with applicable laws

Your Rights Under GDPR

As a data subject, you have the following rights:

Right of Access

You have the right to request a copy of the personal data we hold about you.

Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purpose it was collected.

Right to Restrict Processing

You have the right to request that we limit the processing of your personal data in certain circumstances.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time.

Data Protection Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit
• Regular security assessments
• Access controls and authentication
• Staff training on data protection
• Data minimisation practices

International Data Transfers

When personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected. Retention periods are determined based on:

• The nature of the data
• The purpose of processing
• Legal and regulatory requirements
• Business necessity

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay.

Exercising Your Rights

To exercise any of your rights under GDPR, please contact us using the details provided above. We will respond to your request within one month. This period may be extended by two further months where necessary, taking into account the complexity and number of requests.

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In Australia, you may contact the Office of the Australian Information Commissioner (OAIC).

Updates to This Notice

We may update this GDPR compliance notice from time to time. Any changes will be posted on this page with an updated revision date.