GDPR Compliance

Last Updated: July 29, 2026

Lagoon-ridge is committed to protecting the privacy and personal data of all individuals, including those located in the European Union and European Economic Area. This page outlines our compliance with the General Data Protection Regulation (GDPR).

Your Rights Under GDPR

If you are a resident of the European Union or European Economic Area, you have the following rights regarding your personal data:

Right to Access

You have the right to request access to the personal data we hold about you. We will provide you with a copy of your personal data in a structured, commonly used, and machine-readable format.

Right to Rectification

You have the right to request correction of any inaccurate or incomplete personal data we hold about you. We will make reasonable efforts to update or correct such information promptly.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw your consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required to comply with a legal obligation

Right to Restriction of Processing

You have the right to request restriction of processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in your jurisdiction if you believe our processing of your personal data violates GDPR.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract
• Legal Obligation: Processing is necessary to comply with legal obligations
• Legitimate Interests: Processing is necessary for our legitimate interests or those of a third party, provided such interests are not overridden by your rights and interests

Data Protection Principles

We process personal data in accordance with the following GDPR principles:

• Lawfulness, Fairness, and Transparency: We process data lawfully, fairly, and in a transparent manner
• Purpose Limitation: We collect data for specified, explicit, and legitimate purposes and do not process it in a manner incompatible with those purposes
• Data Minimization: We collect only data that is adequate, relevant, and limited to what is necessary
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date
• Storage Limitation: We retain personal data only for as long as necessary for the purposes for which it was collected
• Integrity and Confidentiality: We implement appropriate security measures to protect personal data

International Data Transfers

As we are based in Australia, your personal data may be transferred to and processed in Australia. We ensure that such transfers comply with GDPR requirements through appropriate safeguards, including:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions recognizing equivalent data protection standards
• Other legally recognized transfer mechanisms

Data Security Measures

We implement technical and organizational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and updates
• Staff training on data protection and security
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

Exercising Your Rights

To exercise any of your GDPR rights or for questions about our data processing practices, please contact our Data Protection Officer:

Email: [email protected]

Address: Level 7, 142 Albert Street, Brisbane, QLD 4000, Australia

We will respond to your request within one month of receipt. In complex cases, we may extend this period by two additional months, in which case we will inform you of the extension and the reasons for the delay.

Updates to This Statement

We may update this GDPR compliance statement from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated through our website with an updated "Last Updated" date.