GDPR Information

Last Updated: November 2024

Our Commitment to Data Protection

Myth-pebble is committed to protecting the privacy and personal data of all individuals who interact with our website and services. While we are an Australian company, we recognise the importance of international data protection standards and have aligned our practices with the principles of the General Data Protection Regulation (GDPR).

Data Controller

Myth-pebble acts as the data controller for personal information collected through our website and services. We determine the purposes and means of processing personal data and are responsible for ensuring compliance with applicable data protection laws.

Contact details:

Myth-pebble
Level 12, 180 George Street
Sydney NSW 2000
Australia

Email: [email protected]

Lawful Bases for Processing

We process personal data only where we have a lawful basis to do so. The legal bases we rely upon include:

• Consent: Where you have given clear consent for us to process your personal data for specific purposes, such as marketing communications.
• Contract: Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract, such as providing our analysis services.
• Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. This includes improving our services and website functionality.
• Legal Obligation: Where processing is necessary to comply with a legal obligation to which we are subject.

Your Data Protection Rights

Under data protection legislation, you have the following rights:

• Right of Access: You have the right to request copies of your personal data. We may charge a small fee for this service in certain circumstances.
• Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Right to Erasure: You have the right to request that we erase your personal data under certain conditions.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data under certain conditions.
• Right to Object: You have the right to object to our processing of your personal data under certain conditions.
• Right to Data Portability: You have the right to request that we transfer the data we have collected to another organisation, or directly to you, under certain conditions.

Exercising Your Rights

To exercise any of these rights, please contact us using the details provided above. We will respond to your request within one month of receiving it. If your request is complex or you have made multiple requests, we may extend this period by up to two additional months, and we will inform you of any extension within one month of your initial request.

We may ask you to verify your identity before processing your request to ensure the security of your personal data.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are determined based on:

• The nature and sensitivity of the data
• The purposes for which we process the data
• Legal and regulatory requirements
• Business operational needs

When personal data is no longer required, we securely delete or anonymise it.

International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by relevant authorities
• Binding corporate rules
• Transfers to countries with adequate data protection laws

Data Security

We have implemented appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Access controls and authentication procedures
• Regular security assessments and updates
• Staff training on data protection practices

Data Breach Procedures

In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to individuals' rights and freedoms, we will also notify affected individuals directly.

Complaints

If you are dissatisfied with how we have handled your personal data or any privacy query, you have the right to lodge a complaint with a supervisory authority. In Australia, this is the Office of the Australian Information Commissioner (OAIC).

However, we would appreciate the opportunity to address your concerns before you approach the supervisory authority, so please contact us in the first instance.

Updates to This Information

We may update this GDPR information from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically for the latest information on our data protection practices.