GDPR Compliance

Introduction

Although Lagoon Reach is an Australian-based company, we recognize the importance of the General Data Protection Regulation (GDPR) for individuals in the European Economic Area (EEA). This page outlines our commitment to GDPR compliance and explains your rights under this regulation.

Legal Basis for Processing

We process personal data only when we have a legal basis to do so under GDPR Article 6:

Consent (Article 6(1)(a))

When you voluntarily provide information through forms, subscriptions, or communications, you give us consent to process that data for the stated purposes.

Contract Performance (Article 6(1)(b))

Processing is necessary to fulfill service contracts for ecological restoration, environmental assessments, or related consulting services.

Legal Obligation (Article 6(1)(c))

We may process data to comply with Australian environmental regulations, tax obligations, or other legal requirements.

Legitimate Interests (Article 6(1)(f))

We process data for legitimate business interests such as fraud prevention, website security, and business communications, provided this does not override your fundamental rights.

Your Rights Under GDPR

If you are located in the EEA, you have the following rights:

Right to Access (Article 15)

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data.

Right to Erasure (Article 17)

You can request deletion of your personal data when it is no longer necessary for the purposes collected, when you withdraw consent, or when you object to processing.

Limitations: We may retain data when required by legal obligations, for establishment of legal claims, or for archiving purposes in the public interest.

Right to Restriction (Article 18)

You can request we limit processing of your data in certain circumstances, such as when contesting accuracy or objecting to processing.

Right to Data Portability (Article 20)

You can request your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.

Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.

Right Not to Be Subject to Automated Decision-Making (Article 22)

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Exercising Your Rights

To exercise any GDPR rights, contact us at:

Email: [email protected]
Subject line: "GDPR Request"

Please include:

• Your full name and contact information
• Description of the right you wish to exercise
• Relevant dates or reference numbers if applicable
• Proof of identity (to prevent unauthorized disclosure)

We will respond within one month of receiving your request. If the request is complex or we receive multiple requests, we may extend this by two additional months and will inform you of the extension.

Data Protection Officer

For GDPR-related inquiries, you may contact our designated data protection contact:

Email: [email protected]
Subject: "Data Protection Officer"

Data Collection and Processing

What We Collect

We collect personal data you provide directly:

• Contact information (name, email, address)
• Property and project details
• Communication records
• Payment information

We also collect data automatically through website use:

• IP address and device information
• Browsing behavior via cookies (see Cookies Policy)

How We Use It

• Providing ecological restoration and environmental services
• Communication about projects and proposals
• Website improvement and security
• Legal and regulatory compliance

Who We Share It With

We share data only when necessary:

• Service providers (hosting, payment processing, subcontractors)
• Regulatory authorities when legally required
• Professional advisors bound by confidentiality

We do not sell personal data to third parties.

International Data Transfers

Your data is primarily stored in Australia. If we transfer data outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions recognizing comparable data protection
• Other mechanisms compliant with GDPR Chapter V

Data Retention

We retain personal data only as long as necessary:

• Active project duration plus monitoring periods (typically 2-5 years)
• Legal retention requirements (7 years for business records under Australian law)
• Resolution of disputes or claims

After retention periods expire, we securely delete or anonymize data.

Data Security

We implement technical and organizational measures appropriate to the risk:

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security assessments
• Staff training on data protection
• Incident response procedures

Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours of becoming aware
• We will notify affected individuals without undue delay if the breach poses a high risk
• Notifications will include the nature of the breach, likely consequences, and measures taken

Children's Data

We do not knowingly collect data from children under 16 without parental consent. Our services are directed at adults. If we discover we have inadvertently collected data from a child, we will delete it promptly.

Cookies and Tracking

We use cookies and similar technologies. You can control cookie preferences through our cookie banner or browser settings. For detailed information, see our Cookies Policy.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your habitual residence, place of work, or place of alleged infringement.

European Data Protection Board maintains a list of supervisory authorities: https://edpb.europa.eu/about-edpb/board/members_en

Updates to This Policy

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated through website notice or direct communication where appropriate.

Contact Information

For questions about GDPR compliance or to exercise your rights:

Lagoon Reach
Suite 7, 142 Riverside Parkway
Byron Bay, NSW 2481
Australia
Email: [email protected]