GDPR Compliance

Last updated: September 22, 2026

Introduction

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that grants individuals in the European Union extensive rights over their personal data. While Deft Sparrow primarily operates in Australia, we respect the data protection rights of all individuals who interact with our website and services.

This page outlines your rights under GDPR and explains how we comply with data protection principles.

Legal Basis for Processing

We process personal data based on the following legal grounds:

• Consent: When you voluntarily provide information through forms or communications
• Contractual Necessity: When processing is necessary to fulfill our service obligations
• Legitimate Interests: When we have a legitimate business interest that does not override your rights
• Legal Obligation: When processing is required to comply with applicable laws

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. We will provide this information in a commonly used electronic format.

Right to Rectification

You have the right to request correction of inaccurate personal data and to have incomplete data completed. We will update your information promptly upon receiving your request.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when you object to processing.

Right to Restriction of Processing

You can request that we limit the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds.

Right to Withdraw Consent

Where we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates data protection laws.

Data Protection Principles

We adhere to the following GDPR principles when processing personal data:

• Lawfulness, Fairness, and Transparency: We process data lawfully, fairly, and in a transparent manner
• Purpose Limitation: We collect data for specified, explicit, and legitimate purposes
• Data Minimization: We collect only data that is adequate, relevant, and necessary
• Accuracy: We take reasonable steps to ensure data accuracy and keep it up to date
• Storage Limitation: We retain data only as long as necessary for the stated purposes
• Integrity and Confidentiality: We implement appropriate security measures to protect data
• Accountability: We take responsibility for compliance and can demonstrate adherence to principles

Data Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Secure data transmission protocols
• Access controls and authentication mechanisms
• Regular security assessments and updates
• Staff training on data protection practices
• Incident response procedures

Data Transfers

If we transfer your personal data outside the European Economic Area, we ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us using the following information:

Email: [email protected]
Address: Level 3, 142 Collins Street, Melbourne VIC 3000, Australia

We will respond to your request within one month of receipt. In complex cases, we may extend this period by an additional two months and will inform you of any such extension.

Verification Process

To protect your privacy and security, we may require verification of your identity before processing requests related to your personal data. We will request only the minimum information necessary to confirm your identity.

Updates to This Policy

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website or directly to affected individuals when appropriate.