GDPR Compliance

Last Updated: November 2024

About GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that governs the collection, processing, and storage of personal data for individuals within the European Union and European Economic Area. Although Brook-den operates from Australia, we recognise our obligations under GDPR when processing data of EU residents.

Our Commitment

Brook-den is committed to ensuring that our data processing activities comply with GDPR requirements. We implement appropriate technical and organisational measures to protect personal data and respect the rights of individuals under GDPR.

Lawful Basis for Processing

We process personal data only where we have a lawful basis to do so, including:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose
• Contract: Where processing is necessary for the performance of a contract with you
• Legal obligation: Where processing is necessary for compliance with a legal obligation
• Legitimate interests: Where processing is necessary for our legitimate interests, provided these are not overridden by your rights and interests

Your Rights Under GDPR

If you are an EU resident, you have the following rights regarding your personal data:

• Right of access: You have the right to request a copy of the personal data we hold about you
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data
• Right to erasure: You have the right to request deletion of your personal data in certain circumstances
• Right to restrict processing: You have the right to request restriction of processing of your personal data
• Right to data portability: You have the right to receive your personal data in a structured, commonly used format
• Right to object: You have the right to object to processing of your personal data in certain circumstances
• Rights related to automated decision-making: You have the right not to be subject to decisions based solely on automated processing

Data Transfers

When we transfer personal data from the EU to Australia or other countries, we ensure that appropriate safeguards are in place, including:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions where applicable
• Other transfer mechanisms recognised under GDPR

Data Protection Measures

We implement comprehensive security measures to protect personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and audits
• Staff training on data protection practices
• Incident response procedures

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws. We regularly review our data retention practices and securely delete data that is no longer needed.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us using the details below. We will respond to your request within one month, as required by GDPR. In some cases, we may need to verify your identity before processing your request.

Supervisory Authority

If you are an EU resident and believe that your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in the EU member state where you reside, work, or where the alleged infringement occurred.

Contact Us

For questions regarding GDPR compliance or to exercise your rights, please contact us at:

Email: [email protected]
Address: Level 18, 100 Collins Street, Melbourne VIC 3000, Australia