Data Protection Notice

Our Commitment to Data Protection

khaki-reef is committed to protecting the privacy and security of personal data in accordance with the Australian Privacy Principles and, where applicable, the General Data Protection Regulation for individuals located in the European Economic Area.

Legal Basis for Processing

We process personal data only when we have a lawful basis to do so:

• Contractual necessity: Processing is required to fulfill service agreements or respond to service inquiries
• Legitimate interests: Processing supports our business operations while respecting your rights and freedoms
• Legal obligation: Processing is required to comply with Australian law or regulatory requirements
• Consent: You have provided explicit permission for specific processing activities

Data Subject Rights

Individuals whose personal data we process have the following rights:

• Right of access: Request confirmation of what personal data we hold and obtain a copy
• Right to rectification: Request correction of inaccurate or incomplete information
• Right to erasure: Request deletion of personal data under certain circumstances
• Right to restrict processing: Request limitation of how we use your data
• Right to data portability: Receive your data in a structured, commonly used format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Revoke previously given consent at any time

Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. Specific retention periods include:

• Inquiry and consultation records: retained for 2 years after last contact
• Client project files: retained for 7 years to meet professional liability requirements
• Financial records: retained in accordance with Australian taxation law
• Website analytics: aggregated data retained indefinitely, individual session data for 14 months

International Data Transfers

Personal data is primarily stored and processed within Australia. If data is transferred internationally, we ensure appropriate safeguards are in place through standard contractual clauses or other approved mechanisms to protect your information.

Security Measures

We implement technical and organizational security measures to protect personal data against unauthorized access, loss, or destruction:

• Encryption of data in transit and at rest
• Access controls limiting data availability to authorized personnel only
• Regular security assessments and updates to protective systems
• Staff training on data protection obligations
• Incident response procedures for potential data breaches

Breach Notification

In the event of a data breach that poses a risk to individual rights and freedoms, we will notify affected individuals and relevant supervisory authorities in accordance with applicable law, typically within 72 hours of becoming aware of the breach.

Exercising Your Rights

To exercise any of the rights described above or to raise questions about how we handle your personal data, please contact us at [email protected]. We will respond to verified requests within one month. If your request is complex or we receive multiple requests, we may extend this period by two additional months and will inform you of the extension.

Supervisory Authority

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with:

Office of the Australian Information Commissioner
GPO Box 5218, Sydney NSW 2001, Australia
Phone: 1300 363 992
Website: www.oaic.gov.au

Contact Information

For data protection inquiries, contact:

Email: [email protected]
Address: Level 12, 485 La Trobe Street, Melbourne VIC 3000, Australia