GDPR Compliance Statement

Last updated: September 2, 2026

1. Introduction

While quaint-thicket.com primarily operates within Australia, we recognize that the General Data Protection Regulation (GDPR) applies to the processing of personal data of individuals located in the European Economic Area (EEA). This document outlines our commitment to GDPR compliance when handling data of EEA residents.

2. Data Controller Information

For the purposes of GDPR, quaint-thicket.com acts as the data controller for personal information collected through our website and services.

Contact details:
Email: [email protected]
Address: Level 7, 142 Collins Street, Melbourne VIC 3000, Australia

3. Legal Basis for Processing

We process personal data under the following legal grounds:

• Consent: When you provide explicit consent for specific processing activities
• Contractual necessity: To fulfill photography service contracts and business agreements
• Legitimate interests: For business operations, fraud prevention, and service improvement, where such interests do not override your fundamental rights
• Legal obligations: To comply with applicable laws and regulations

4. Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

4.1 Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data.

4.2 Right to Rectification

You may request correction of inaccurate or incomplete personal data we hold about you.

4.3 Right to Erasure

You may request deletion of your personal data in certain circumstances, including when data is no longer necessary for the purposes for which it was collected.

4.4 Right to Restrict Processing

You may request that we limit the processing of your personal data in specific situations.

4.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

4.6 Right to Object

You may object to processing of your personal data based on legitimate interests or for direct marketing purposes.

4.7 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time.

4.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in the EEA, particularly in your country of residence, workplace, or where an alleged infringement occurred.

5. Data Processing and Transfers

Personal data collected from EEA residents may be transferred to and processed in Australia. We ensure appropriate safeguards are in place for such transfers, including:

• Implementing standard contractual clauses approved by the European Commission
• Ensuring adequate data protection measures are maintained
• Limiting data transfers to what is necessary for service provision

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to meet legal, accounting, or reporting requirements. Retention periods vary based on:

• The nature of the data and purpose of processing
• Legal and regulatory requirements
• Legitimate business needs

7. Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and updates
• Staff training on data protection practices

8. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

9. Data Breach Notification

In the event of a personal data breach affecting EEA residents, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible. If the breach poses a high risk to your rights and freedoms, we will also notify you directly.

10. Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with the subject line "GDPR Request." We will respond to your request within one month, though this period may be extended by two additional months for complex requests.

11. Updates to This Statement

We may update this GDPR Compliance Statement to reflect changes in our practices or legal requirements. Updates will be posted on this page with a revised date.