Soulldispa

Our Commitment to Data Protection

Soulldispa is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Australian privacy laws, including the Privacy Act 1988 and the Australian Privacy Principles (APPs).

This document outlines how we comply with these regulations and explains your rights regarding your personal data.

Data Controller Information

For the purposes of data protection legislation, the data controller is:

Soulldispa
Level 3, 142 Collins Street
Melbourne VIC 3000
Australia
Email: [email protected]

Legal Basis for Processing

We process your personal data under the following legal bases:

Consent: You have given clear consent for us to process your personal data for specific purposes (e.g., submitting enquiry forms, subscribing to communications)
Contract: Processing is necessary for the performance of a contract to which you are a party (e.g., delivering educational programmes)
Legitimate Interests: Processing is necessary for our legitimate interests, such as improving our services and ensuring website security
Legal Obligation: Processing is necessary to comply with legal obligations

Your Rights Under GDPR and Australian Privacy Law

You have the following rights regarding your personal data:

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee for multiple copies or manifestly unfounded or excessive requests.

Right to Rectification

You have the right to request correction of any information you believe is inaccurate or incomplete.

Right to Erasure

You have the right to request deletion of your personal data under certain conditions, such as when the data is no longer necessary for the purposes for which it was collected.

Right to Restrict Processing

You have the right to request restriction of processing your personal data under certain conditions.

Right to Data Portability

You have the right to request transfer of your data to another organisation or directly to you under certain conditions.

Right to Object

You have the right to object to our processing of your personal data under certain conditions, particularly for processing based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where we rely on consent to process your personal data, you have the right to withdraw that consent at any time.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected] with the subject line "Data Protection Request".

We will respond to your request within one month of receipt. If your request is complex or we receive multiple requests from you, we may extend this period by two further months, in which case we will notify you and explain the reasons for the delay.

We may need to verify your identity before processing your request to ensure the security of your personal data.

Data Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

Encryption of data in transit and at rest
Regular security assessments and updates
Access controls and authentication procedures
Staff training on data protection principles
Incident response procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, providing information about the nature of the breach and the measures we have taken or propose to take.

International Data Transfers

When we transfer your personal data outside of Australia or the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

Standard contractual clauses approved by the European Commission
Transfers to countries with adequacy decisions
Binding corporate rules where applicable

Data Retention Periods

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

Enquiry information: Two years from last contact
Programme participant records: Seven years for educational records compliance
Marketing consent: Until consent is withdrawn or three years of inactivity
Website analytics: 26 months

Children's Data

Our services are not directed at children under 16 years of age. We do not knowingly collect or process personal data from children. If we become aware that we have collected data from a child without appropriate parental consent, we will take steps to delete that information.

Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Right to Lodge a Complaint

If you believe we have not complied with data protection laws, you have the right to lodge a complaint with the relevant supervisory authority:

In Australia:
Office of the Australian Information Commissioner (OAIC)
Website: www.oaic.gov.au
Phone: 1300 363 992

In the EU:
You may contact your local data protection authority. A list of authorities is available at:
https://edpb.europa.eu/about-edpb/board/members_en

Updates to This Notice

We may update this data protection notice from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated notice on our website and updating the "Last updated" date.

Contact Us

If you have questions about our data protection practices or wish to exercise your rights, please contact us:

Email: [email protected]
Subject: Data Protection Enquiry