GDPR Compliance

1. General Data Protection Regulation (GDPR)

While wind-stoat primarily operates in Australia, we recognize that some of our website visitors and customers may be residents of the European Union. This page explains how we comply with the General Data Protection Regulation when processing personal data of EU residents.

2. Data Controller

wind-stoat acts as the data controller for personal information collected through our website and booking services.

Contact: [email protected]
Address: 127 Macquarie Street, Sydney NSW 2000, Australia

3. Legal Basis for Processing

We process personal data under the following legal bases:

• Contractual Necessity: Processing necessary to fulfill tour bookings and provide services you request
• Legitimate Interests: Website analytics and service improvement, provided these do not override your rights
• Consent: Marketing communications and non-essential cookies (where required)
• Legal Obligation: Compliance with accounting, tax, and other legal requirements

4. Your Rights Under GDPR

If you are an EU resident, you have the following rights:

4.1 Right to Access

You may request a copy of the personal data we hold about you, along with information about how we use it.

4.2 Right to Rectification

You may request correction of inaccurate or incomplete personal data.

4.3 Right to Erasure

You may request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.

4.4 Right to Restriction

You may request that we restrict processing of your personal data in certain situations.

4.5 Right to Data Portability

You may request to receive your personal data in a structured, commonly used, and machine-readable format, or have it transmitted directly to another controller.

4.6 Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes.

4.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

4.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in your EU country of residence or where an alleged infringement occurred.

5. Exercising Your Rights

To exercise any of these rights, contact us at [email protected] with the subject line "GDPR Rights Request." Please include:

• Your full name and email address
• Description of the right you wish to exercise
• Any relevant details to help us locate your information

We will respond to verified requests within one month. In complex cases, we may extend this by two additional months and will notify you.

6. Data Transfers

As we operate in Australia, personal data of EU residents is transferred outside the European Economic Area. We ensure appropriate safeguards are in place for such transfers, including:

• Implementing appropriate technical and organizational security measures
• Processing data only for the specific purposes for which it was provided
• Complying with applicable data protection principles

7. Data Retention

We retain personal data only as long as necessary for the purposes outlined in our Privacy Policy, typically:

• Booking information: 7 years (accounting and legal compliance)
• Marketing communications: until consent is withdrawn
• Website analytics: 26 months

8. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects individuals.

9. Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit
• Access controls limiting who can view personal data
• Regular security assessments
• Staff training on data protection

10. Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify affected individuals within 72 hours of becoming aware of the breach, as required by GDPR.

11. Third-Party Processors

We ensure that any third-party service providers who process personal data on our behalf are bound by contractual obligations to implement appropriate security measures and process data only as instructed by us.

12. Children's Data

We do not knowingly collect or process personal data of individuals under 16 years of age without parental consent. If we become aware of such collection, we will delete the data promptly.

13. Updates to This Policy

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website.