Your rights and how we protect your personal information
Last Updated: 30 September 2026
At crag-puffin, we are committed to protecting and respecting your personal data. We comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), as well as applicable international data protection standards including the European General Data Protection Regulation (GDPR) where relevant to our international visitors.
crag-puffin is the data controller responsible for your personal information. Our contact details are:
Address: Level 14, 225 George Street, Sydney NSW 2000, Australia
Email: [email protected]
Under applicable data protection laws, you have the following rights:
Right of Access: You have the right to request a copy of the personal information we hold about you. We will provide this information free of charge within 30 days of receiving your request.
Right to Rectification: If you believe that any personal information we hold about you is inaccurate or incomplete, you have the right to request correction. We will respond to your request within 30 days.
Right to Erasure: In certain circumstances, you have the right to request that we delete your personal information. This right applies when the data is no longer necessary for the purpose it was collected, when you withdraw consent, or when there is no overriding legitimate interest for continued processing.
Right to Restrict Processing: You may request that we limit the processing of your personal information in specific circumstances, such as when you contest the accuracy of the data or when processing is unlawful but you do not want erasure.
Right to Data Portability: Where technically feasible, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to Object: You have the right to object to processing of your personal information for direct marketing purposes or where we rely on legitimate interests as the legal basis for processing.
Rights Related to Automated Decision Making: You have the right not to be subject to decisions based solely on automated processing that significantly affect you, unless such processing is necessary for a contract or based on your explicit consent.
We process personal information under the following legal bases:
As an Australian organisation, your data is primarily stored and processed within Australia. If we transfer personal data internationally, we ensure appropriate safeguards are in place to protect your information, including:
We implement appropriate technical and organisational security measures to protect your personal data, including:
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are:
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required under the Notifiable Data Breaches scheme.
To exercise any of your data protection rights, please contact us using the details below. We may need to verify your identity before processing your request. We aim to respond to all legitimate requests within 30 days.
Email: [email protected]
Post: Data Protection Officer, Level 14, 225 George Street, Sydney NSW 2000, Australia
If you believe we have not handled your personal information appropriately, you have the right to lodge a complaint with the Office of the Australian Information Commissioner:
Website: www.oaic.gov.au
Phone: 1300 363 992
We encourage you to contact us first so we have the opportunity to address your concerns directly.
We may update this data protection information from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically to stay informed about how we protect your data.