storm-saga

Our Commitment to Data Protection

storm-saga.com is committed to protecting your personal data and respecting your privacy rights under the General Data Protection Regulation (GDPR) and applicable Australian privacy laws. This page outlines how we comply with these regulations and your rights regarding your personal information.

Data Controller

For the purposes of GDPR, the data controller is:

storm-saga
147 Industrial Avenue
Collingwood, Melbourne VIC 3066
Australia
Email: [email protected]

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: You have given explicit consent for processing your personal data for specific purposes
• Contract: Processing is necessary for performing a contract with you or taking steps at your request before entering into a contract
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as improving our services
• Legal Obligation: Processing is required to comply with legal obligations

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure

You can request deletion of your personal data in certain circumstances, including when data is no longer necessary for the purposes it was collected.

Right to Restriction

You can request restriction of processing your personal data in specific situations.

Right to Data Portability

You can request to receive your personal data in a structured, commonly used, and machine-readable format and have it transferred to another controller.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.

Data Categories We Process

We may process the following categories of personal data:

• Identity data (name, title)
• Contact data (email address, postal address)
• Technical data (IP address, browser type, device information)
• Usage data (website interaction, pages visited)
• Communications data (project inquiries, correspondence)

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Inquiry data: Retained for 3 years from last contact
• Client project data: Retained for 7 years after project completion for legal and warranty purposes
• Website analytics data: Retained for 26 months
• Cookie data: See our Cookies Policy for specific retention periods

After retention periods expire, data is securely deleted or anonymized.

Data Security Measures

We implement appropriate technical and organizational security measures to protect your personal data:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and updates
• Staff training on data protection requirements
• Secure backup and disaster recovery procedures

International Data Transfers

When transferring personal data outside the European Economic Area or Australia, we ensure adequate safeguards are in place, including:

• Standard contractual clauses approved by relevant authorities
• Privacy Shield certification (where applicable)
• Binding corporate rules
• Adequacy decisions by relevant authorities

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the appropriate supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk to you, we will also notify you directly without undue delay.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Third-Party Processors

We work with carefully selected third-party service providers who process personal data on our behalf. All processors are bound by data processing agreements that ensure GDPR compliance and appropriate security measures.

Exercising Your Rights

To exercise any of your data protection rights, contact us at:

Email: [email protected]
Subject line: Data Protection Request

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of the extension.

We may need to verify your identity before processing your request. No fee is typically required, though we may charge a reasonable fee for excessive or manifestly unfounded requests.

Updates to This Information

We may update this GDPR compliance information to reflect changes in our practices or legal requirements. Please review this page periodically for the latest information.

Contact and Questions

If you have questions about our GDPR compliance or data protection practices, contact us at [email protected]