GDPR Compliance

Our Commitment to Data Protection

Storm-lumen recognises the importance of protecting personal data in accordance with the General Data Protection Regulation (GDPR) for individuals located within the European Economic Area (EEA). This page outlines how we comply with GDPR requirements when processing personal data of EEA residents.

Data Controller

Storm-lumen acts as the data controller for personal information collected through our website and consulting services. As the data controller, we determine the purposes and means of processing personal data and are responsible for ensuring compliance with applicable data protection laws.

Lawful Basis for Processing

We process personal data under one or more of the following lawful bases:

• Consent: Where you have provided explicit consent for processing, such as subscribing to communications
• Contractual necessity: Where processing is necessary to perform a contract with you or take pre-contractual steps at your request
• Legitimate interests: Where processing is necessary for our legitimate business interests, provided those interests do not override your fundamental rights
• Legal obligation: Where processing is necessary to comply with legal requirements

Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you
• Right to rectification: You may request correction of inaccurate or incomplete personal data
• Right to erasure: You may request deletion of your personal data in certain circumstances
• Right to restrict processing: You may request limitation of processing in certain circumstances
• Right to data portability: You may request transfer of your personal data to another organisation in a structured, commonly used format
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes
• Rights related to automated decision-making: You have rights concerning automated decision-making and profiling

How to Exercise Your Rights

To exercise any of these rights, please contact us using the details provided below. We will respond to your request within one month. In certain circumstances, we may extend this period by up to two additional months, in which case we will inform you of the extension and the reasons for it.

We may request verification of your identity before processing your request to ensure we are providing personal data to the correct individual.

International Data Transfers

As an Australian organisation, personal data collected from EEA residents may be transferred to and processed in Australia. When transferring personal data outside the EEA, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions where applicable
• Other legally recognised transfer mechanisms

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Retention periods vary depending on the nature of the data and the purpose of processing. When personal data is no longer required, it is securely deleted or anonymised.

Data Security Measures

We implement technical and organisational measures to protect personal data, including:

• Encryption of data in transit and at rest where appropriate
• Access controls limiting data access to authorised personnel
• Regular security assessments and updates
• Staff training on data protection requirements

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

Supervisory Authority

If you are located in the EEA and believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority. A list of supervisory authorities is available on the European Data Protection Board website.

Contact Information

For GDPR-related enquiries or to exercise your data protection rights, please contact us:

Email: [email protected]

Address: Level 14, 227 Elizabeth Street, Sydney NSW 2000, Australia