Information on this site is advertising in nature

GDPR Compliance Statement

Last Updated: September 2026

mauve-dune respects the data protection rights of individuals located in the European Economic Area (EEA) and the United Kingdom. This statement outlines how we comply with the General Data Protection Regulation (GDPR) when processing personal data of EEA and UK residents.

Data Controller

For the purposes of the GDPR, mauve-dune acts as the data controller for personal data we collect from you. Our contact details are:

mauve-dune
42 Heritage Lane
Melbourne VIC 3000
Australia
Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

  • Consent: Where you have given clear consent for us to process your personal data for specific purposes
  • Contract: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract
  • Legitimate Interests: Where processing is necessary for our legitimate business interests, provided these do not override your fundamental rights and freedoms
  • Legal Obligation: Where processing is necessary to comply with applicable laws and regulations

Your Rights Under GDPR

If you are located in the EEA or UK, you have the following rights regarding your personal data:

  • Right of Access: You may request a copy of the personal data we hold about you
  • Right to Rectification: You may request correction of inaccurate or incomplete personal data
  • Right to Erasure: You may request deletion of your personal data in certain circumstances
  • Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances
  • Right to Data Portability: You may request to receive your personal data in a structured, commonly used, machine-readable format
  • Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time

International Data Transfers

As an Australian business, we may transfer personal data from the EEA or UK to Australia. Australia has received an adequacy decision from the European Commission, meaning the European Commission has determined that Australia provides an adequate level of data protection.

Where we transfer data to countries without an adequacy decision, we implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, taking into account:

  • The nature of the consulting engagement and documentation requirements
  • Legal and regulatory retention obligations
  • Limitation periods for potential legal claims
  • The long-term nature of heritage conservation projects

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, including:

  • Encryption of personal data where appropriate
  • Access controls limiting data access to authorised personnel
  • Regular security assessments and updates
  • Staff training on data protection requirements

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.

Exercising Your Rights

To exercise any of your rights under the GDPR, please contact us using the details above. We will respond to your request within one month. In complex cases, this period may be extended by two further months, in which case we will inform you of the extension and the reasons for it.

We may request proof of identity before processing your request to ensure the security of your personal data.

Complaints

If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with a supervisory authority. For EEA residents, this is typically the data protection authority in your country of residence. For UK residents, this is the Information Commissioner's Office.

Updates to This Statement

We may update this GDPR compliance statement from time to time. Any changes will be posted on this page with an updated revision date.