Information for individuals in the European Economic Area
Last Updated: November 2024
This page provides additional information for individuals located in the European Economic Area (EEA) regarding our data processing practices under the General Data Protection Regulation (GDPR). This information supplements our main Privacy Policy.
Sepia-atoll acts as the data controller for personal data collected through this website. Our contact details are:
Sepia-atoll
Level 12, 340 Collins Street
Melbourne VIC 3000
Australia
Email: [email protected]
We process personal data on the following legal bases:
When you submit an enquiry through our website or subscribe to communications, you provide consent for us to process your data for the purposes described. You may withdraw consent at any time by contacting us.
When you engage our services, we process data necessary to fulfil our contractual obligations to you.
We may process data based on our legitimate business interests, including improving our services, maintaining security, and communicating relevant information. We balance these interests against your rights and freedoms.
We process data where necessary to comply with legal requirements applicable to our business.
If you are located in the EEA, you have the following rights regarding your personal data:
You may request confirmation of whether we process your personal data and obtain a copy of that data.
You may request correction of inaccurate personal data or completion of incomplete data.
You may request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes collected.
You may request that we limit how we use your data in certain circumstances.
You may request to receive your personal data in a structured, commonly used format and transmit it to another controller.
You may object to processing based on legitimate interests or for direct marketing purposes.
You have rights regarding automated decision-making and profiling. We do not currently engage in automated decision-making that produces legal effects.
As our business operates from Australia, personal data collected from EEA individuals may be transferred to and stored in Australia. Australia is not subject to an adequacy decision by the European Commission. We implement appropriate safeguards for such transfers, including standard contractual clauses where applicable.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods depend on the nature of the data and processing purposes.
To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month, as required by GDPR. This period may be extended by two months for complex requests, in which case we will inform you of the extension and reasons.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in the EU member state of your residence, place of work, or where the alleged infringement occurred.
We may update this GDPR information periodically. Changes will be posted on this page with an updated revision date.