GDPR Compliance

Last updated: June 4, 2026

Our Commitment to Data Protection

While blossom-lark operates primarily in Australia, we recognize the importance of data protection standards established by the General Data Protection Regulation (GDPR) and apply similar principles to all personal data we process.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you voluntarily provide information through our contact forms
• Contract Performance: To deliver services you have requested
• Legitimate Interest: To improve our services and communicate relevant information
• Legal Obligation: To comply with applicable laws and regulations

Your Data Protection Rights

You have the following rights regarding your personal data:

Right to Access

You can request copies of your personal data. We may charge a reasonable fee for multiple requests.

Right to Rectification

You can request correction of information you believe is inaccurate or incomplete.

Right to Erasure

You can request deletion of your personal data under certain conditions.

Right to Restrict Processing

You can request that we restrict processing of your personal data under certain conditions.

Right to Data Portability

You can request transfer of your data to another organization or directly to you in a structured, commonly used format.

Right to Object

You can object to our processing of your personal data under certain conditions.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Service delivery and customer relationship management
• Compliance with legal and accounting requirements
• Resolution of disputes and enforcement of agreements

Typically, customer data is retained for seven years following the completion of services, unless a longer retention period is required by law.

Data Security Measures

We implement appropriate technical and organizational measures including:

• Encryption of data in transit and at rest
• Access controls and authentication protocols
• Regular security assessments and updates
• Staff training on data protection practices

International Data Transfers

Your data is primarily stored and processed within Australia. If data is transferred internationally, we ensure appropriate safeguards are in place to protect your information.

Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals and relevant authorities within 72 hours of becoming aware of the breach.

Exercising Your Rights

To exercise any of these rights, contact us at:

Email: [email protected]
Address: 142 Lennox Street, Richmond VIC 3121, Australia

We will respond to your request within 30 days. If we need additional time, we will inform you of the reason for the delay.

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Australian Information Commissioner or your local data protection authority.