GDPR Compliance

Last Updated: August 7, 2026

General Data Protection Regulation

This page outlines how plum-sprout complies with the General Data Protection Regulation (GDPR) and your rights regarding the personal data we process.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: When you provide explicit consent for us to process your data
• Contract: When processing is necessary to fulfill a contract with you
• Legitimate interests: When we have a legitimate business interest that does not override your rights
• Legal obligation: When we are required by law to process your data

Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used format.

Right to Rectification

If you believe any information we hold about you is incorrect or incomplete, you have the right to request that we correct or complete it.

Right to Erasure

You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purposes it was collected.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain situations, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, machine-readable format and to transmit it to another controller.

Right to Object

You have the right to object to the processing of your personal data in certain circumstances, particularly when we process data based on legitimate interests.

Right to Withdraw Consent

Where we process your data based on your consent, you have the right to withdraw that consent at any time.

Data Protection Officer

For any questions regarding our GDPR compliance or to exercise your rights, please contact us at [email protected].

International Data Transfers

We do not transfer your personal data outside of Australia. If this changes in the future, we will ensure appropriate safeguards are in place to protect your data.

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay.

Automated Decision Making

We do not use automated decision-making or profiling that would have legal or similarly significant effects on you.

Complaints

If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with the relevant supervisory authority.