Data Protection

Our Commitment to Data Protection

Base-osprey is committed to protecting your personal data in accordance with the Australian Privacy Act 1988, the Australian Privacy Principles (APPs), and where applicable, the European Union General Data Protection Regulation (GDPR). This page outlines your rights and our obligations regarding personal data.

Data Controller

For the purposes of data protection legislation, Base-osprey is the data controller responsible for your personal data:

Legal Basis for Processing

We process your personal data based on one or more of the following legal grounds:

• Contractual necessity: Processing necessary to fulfil a contract with you, such as providing booked services
• Legitimate interests: Processing necessary for our legitimate business interests, provided these do not override your fundamental rights
• Consent: Where you have given explicit consent for specific processing activities, such as marketing communications
• Legal obligations: Processing necessary to comply with legal requirements

Your Data Protection Rights

Under applicable data protection laws, you have the following rights:

Right of Access

You have the right to request copies of your personal data held by us. We will provide this information within 30 days of a verified request.

Right to Rectification

You have the right to request correction of any inaccurate personal data or completion of incomplete data we hold about you.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, including:

• When the data is no longer necessary for its original purpose
• When you withdraw consent (where processing is based on consent)
• When you object to processing and no overriding legitimate grounds exist

This right does not apply where retention is necessary for legal compliance, establishment of legal claims, or archiving in the public interest.

Right to Restriction of Processing

You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of data or object to processing.

Right to Data Portability

Where processing is based on consent or contractual necessity and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently employ such automated decision-making processes.

Exercising Your Rights

To exercise any of these rights, please contact us using the details provided above. We may request specific information to verify your identity before processing your request. We respond to all legitimate requests within 30 days, though complex requests may require additional time.

There is no fee for exercising your rights in most circumstances. However, we may charge a reasonable fee for manifestly unfounded, repetitive, or excessive requests.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Booking records: 7 years (for tax and legal compliance)
• Marketing consent records: Duration of consent plus 3 years
• Website analytics: 26 months
• Correspondence: 3 years from last communication

International Data Transfers

Your personal data may be transferred to and processed in countries outside Australia. When transferring data internationally, we ensure appropriate safeguards are in place:

• Standard contractual clauses approved by relevant authorities
• Transfers to countries with adequate data protection frameworks
• Binding corporate rules where applicable

Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures are regularly reviewed and updated as necessary.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in high risk, we will also notify affected individuals without undue delay.

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority:

• Australia: Office of the Australian Information Commissioner (OAIC)
• European Union: Your local Data Protection Authority

We encourage you to contact us first so we may address your concerns directly.

Updates to This Notice

This Data Protection notice may be updated periodically to reflect changes in our practices or legal requirements. Material changes will be communicated through our website or directly to affected individuals where appropriate.