GDPR Compliance Statement

Last updated: September 2026

Basin-magpie is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Australian privacy laws.

Legal Basis for Processing

We process personal data based on the following legal grounds:

• Consent: When you provide explicit consent for specific processing activities
• Contract Performance: When processing is necessary to fulfill our service agreements
• Legitimate Interests: For business operations, subject to your rights and interests
• Legal Obligations: When required by law or regulation

Your GDPR Rights

If you are located in the European Economic Area or otherwise covered by GDPR, you have the following rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data under certain conditions
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

Data Protection Officer

For questions about data protection or to exercise your GDPR rights, contact our Data Protection Officer:

Email: [email protected]
Address: Level 7, 142 Edward Street, Brisbane QLD 4000, Australia

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Service delivery and customer support
• Legal and regulatory compliance
• Dispute resolution

After the retention period expires, personal data is securely deleted or anonymized.

International Data Transfers

As an Australian-based company, your data is primarily processed within Australia. If we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions recognizing equivalent data protection standards
• Other legally approved transfer mechanisms

Data Security Measures

We implement technical and organizational security measures including:

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security assessments
• Staff training on data protection
• Incident response procedures

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR. In Australia, the relevant authority is the Office of the Australian Information Commissioner (OAIC).

Updates to This Statement

We may update this GDPR Compliance Statement periodically. Changes will be posted on this page with an updated revision date.