GDPR Compliance

Last updated: September 2026

1. Introduction

The General Data Protection Regulation (GDPR) is a European Union regulation that governs the collection, processing, and storage of personal data of individuals within the European Economic Area (EEA). Although ivory-dune is based in Australia, we are committed to protecting the privacy of all our website visitors and clients, including those from the EEA.

This page outlines how we comply with GDPR requirements for any personal data we may process relating to EEA residents.

2. Data Controller

For the purposes of the GDPR, ivory-dune acts as the data controller for personal data we collect directly from individuals. Our contact details are:

ivory-dune
42 Collins Street, Level 8
Melbourne VIC 3000
Australia
Email: [email protected]

3. Legal Basis for Processing

We process personal data based on the following legal grounds:

Consent: Where you have given clear consent for us to process your personal data for specific purposes, such as receiving marketing communications.
Contract: Where processing is necessary to perform a contract with you or to take steps at your request prior to entering into a contract.
Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided your fundamental rights do not override those interests.
Legal Obligation: Where processing is necessary to comply with a legal obligation to which we are subject.

4. Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

Right of Access: You have the right to request a copy of the personal data we hold about you.
Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
Right to Erasure: You have the right to request that we delete your personal data in certain circumstances.
Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
Right to Object: You have the right to object to our processing of your personal data in certain circumstances.
Right to Withdraw Consent: Where we rely on consent to process your data, you have the right to withdraw that consent at any time.
Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority if you believe your rights have been violated.

5. Exercising Your Rights

To exercise any of your rights under the GDPR, please contact us at [email protected]. We will respond to your request within one month. In certain circumstances, we may extend this period by two months, in which case we will inform you of the extension and the reasons for it.

We may need to verify your identity before processing your request. If your request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on the request.

6. Data Transfers

As an Australian organisation, any personal data we collect may be transferred to and stored in Australia. When transferring data from the EEA to Australia, we ensure appropriate safeguards are in place to protect your personal data in accordance with GDPR requirements.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws. When determining the retention period, we consider the nature and sensitivity of the data, potential risks, and applicable legal requirements.

8. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, access controls, and regular security assessments.

9. Children's Data

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us so we can take appropriate action.

10. Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects individuals.

11. Updates to This Policy

We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated revision date.

12. Contact and Complaints

For any questions about our GDPR compliance or to exercise your rights, please contact us:

ivory-dune
42 Collins Street, Level 8
Melbourne VIC 3000
Australia
Email: [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.