GDPR Compliance Statement

Last Updated: September 2026

Introduction

While Violet-crag operates primarily in Australia, we recognize that some of our website visitors may be located in the European Union. This page explains how we comply with the General Data Protection Regulation (GDPR) principles when processing data of EU residents.

Data Controller

For the purposes of GDPR, the data controller is:

Violet-crag
127 Heritage Lane
Sydney NSW 2000
Australia
Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

  • Contractual Necessity: Processing is necessary to fulfill booking requests and provide heritage tourism services
  • Legitimate Interest: We process data to improve our services, ensure website security, and communicate about our offerings
  • Consent: For marketing communications and certain cookies, we obtain explicit consent
  • Legal Obligation: Some processing is required to comply with legal requirements

Your Rights Under GDPR

If you are an EU resident, you have the following rights regarding your personal data:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate personal data we hold about you.

Right to Erasure

You can request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the purposes it was collected or when you withdraw consent.

Right to Restriction of Processing

You can request that we limit how we use your data in certain situations, such as when you contest the accuracy of the data.

Right to Data Portability

You can request that we provide your data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in your country of residence if you believe we have not complied with GDPR requirements.

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: [email protected]
Subject line: GDPR Data Request

We will respond to your request within one month. In complex cases, this period may be extended by two additional months, and we will inform you of such extension.

Data We Collect

We collect and process the following categories of personal data:

  • Identity data: name
  • Contact data: email address
  • Booking data: selected services, preferences, communications
  • Technical data: IP address, browser type, device information
  • Usage data: how you interact with our website

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Booking and customer service data: 7 years for business records and legal compliance
  • Marketing consent data: until consent is withdrawn
  • Website analytics data: typically 26 months
  • Essential cookies: deleted when browser session ends

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of data in transit and at rest
  • Access controls limiting data access to authorized personnel
  • Regular security assessments and updates
  • Staff training on data protection principles

International Data Transfers

Your data is primarily processed and stored in Australia. If we transfer data outside the EU, we ensure appropriate safeguards are in place, such as:

  • Standard contractual clauses approved by the European Commission
  • Adequacy decisions recognizing equivalent data protection standards
  • Other legally recognized transfer mechanisms

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay, in accordance with GDPR requirements.

Children's Data

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If we become aware that we have collected such data, we will delete it promptly.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website.

Contact Information

For questions about GDPR compliance or to exercise your rights:

Email: [email protected]
Address: 127 Heritage Lane, Sydney NSW 2000, Australia