GDPR Compliance Statement

Our Commitment

We are committed to protecting the privacy and security of personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Australian privacy laws. This statement outlines how we handle data for individuals within the European Economic Area.

Legal Basis for Processing

We process personal data based on the following legal grounds:

• Consent: When you provide explicit consent for specific processing activities
• Contract Performance: To fulfill service agreements and deliver requested consultations
• Legitimate Interests: To improve our services and communicate relevant business information
• Legal Obligations: To comply with applicable laws and regulations

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data under certain circumstances
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to certain types of processing, including direct marketing
• Rights Related to Automated Decision-Making: Not be subject to decisions based solely on automated processing

Data Controller

The data controller responsible for your personal information is neo-grove, located at Level 14, 287 Collins Street, Melbourne VIC 3000, Australia. For GDPR-related inquiries, contact us at [email protected].

International Data Transfers

Your personal data may be transferred to and processed in Australia. We ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements, including standard contractual clauses where applicable.

Data Processing Activities

We process personal data for the following purposes:

• Responding to service inquiries and consultation requests
• Delivering contracted business process consulting services
• Analyzing website usage to improve user experience
• Communicating updates and information relevant to your interests
• Maintaining records for legal and regulatory compliance

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods vary based on data type and applicable legal requirements.

Security Measures

We implement technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or damage. These measures include encryption, access controls, and regular security assessments.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

Third-Party Processors

We may engage third-party service providers to process personal data on our behalf. All processors are carefully selected and contractually bound to handle data in compliance with GDPR requirements.

Exercising Your Rights

To exercise any of your GDPR rights, submit a request to [email protected]. We will respond to verified requests within one month. In complex cases, this period may be extended by an additional two months with notification.

Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority in the European Economic Area.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant updates will be communicated through our website or direct notification.