GDPR Compliance

Last Updated: September 2024

Our Commitment to GDPR

Pebble Voyage is committed to ensuring compliance with the General Data Protection Regulation (GDPR) for all users located within the European Economic Area (EEA). This page outlines how we protect your rights under GDPR when you interact with our services.

Data Controller

For the purposes of the GDPR, Pebble Voyage acts as the data controller for personal information collected through our website and services. Our contact details are:

Pebble Voyage
Level 12, 180 George Street
Sydney NSW 2000
Australia

Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you have given explicit consent for specific processing activities
• Contract: When processing is necessary to perform a contract with you
• Legal Obligation: When processing is required to comply with legal requirements
• Legitimate Interests: When processing is necessary for our legitimate business interests, provided these do not override your rights

Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal information we hold about you. We will provide this information within one month of receiving your request.

Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.

Right to Erasure

You have the right to request that we delete your personal information in certain circumstances, such as when the data is no longer necessary for the purpose it was collected.

Right to Restrict Processing

You have the right to request that we limit the processing of your personal information in certain circumstances.

Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal information for direct marketing purposes or when processing is based on legitimate interests.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such automated decision-making.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex or we receive numerous requests, we may extend this period by two additional months, but we will inform you of any extension.

International Data Transfers

As an Australian company, we may transfer your personal data outside the EEA. When we do so, we ensure that appropriate safeguards are in place to protect your data, such as:

• Standard Contractual Clauses approved by the European Commission
• Binding Corporate Rules where applicable
• Transfers to countries with an adequacy decision from the European Commission

Data Protection Officer

While we are not required to appoint a Data Protection Officer under GDPR, we have designated a privacy contact who can address your concerns:

Email: [email protected]

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

Complaints

If you believe that your GDPR rights have been violated, you have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

Changes to This Notice

We may update this GDPR compliance notice from time to time. Any changes will be posted on this page with an updated revision date.