Information presented on this website is advertising in nature

GDPR Information

Home / GDPR

Last Updated: January 2024

About GDPR

The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy. While onyx-heath is based in Australia, we are committed to protecting the privacy of all our customers, including those from the European Economic Area (EEA). This page outlines your rights under GDPR and how we comply with its requirements.

Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal information we hold about you. We will provide this information free of charge within one month of receiving your request.

Right to Rectification

If you believe that any information we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. We will respond to such requests within one month.

Right to Erasure

Also known as the "right to be forgotten," you can request that we delete your personal data in certain circumstances, such as:

  • The data is no longer necessary for the purpose it was collected
  • You withdraw consent and there is no other legal basis for processing
  • You object to the processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.

Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes or when processing is based on legitimate interests.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

Legal Basis for Processing

We process personal data on the following legal bases:

  • Contract: Processing necessary for the performance of a rental agreement or to take steps at your request before entering into a contract
  • Legal Obligation: Processing necessary to comply with our legal obligations
  • Legitimate Interests: Processing necessary for our legitimate business interests, provided these are not overridden by your rights
  • Consent: Where you have given explicit consent for specific processing activities

Data Transfers

As an Australian company, any data transferred outside the EEA is protected by appropriate safeguards, including standard contractual clauses approved by the European Commission.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Retention periods vary depending on the type of data and our legal obligations. When data is no longer needed, it is securely deleted or anonymised.

Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

  • Encryption of data in transit and at rest
  • Access controls and authentication
  • Regular security assessments
  • Staff training on data protection

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights, we will also notify you directly.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us using the details below. We may need to verify your identity before processing your request. We will respond to all legitimate requests within one month.

Complaints

If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with your local data protection supervisory authority.

Contact Us

For any questions regarding GDPR or to exercise your rights, please contact us at:

onyx-heath
42 Harbour Street
Sydney NSW 2000
Australia
Email: [email protected]