GDPR Compliance Statement

Last updated: September 9, 2026

Our Commitment to Data Protection

While sepia-spire operates primarily in Australia, we recognise that individuals from the European Economic Area may access our website or enquire about our services. We are committed to protecting personal data in accordance with GDPR principles.

Legal Basis for Processing

We process personal data under the following lawful bases:

  • Consent: When you submit an enquiry form, you provide explicit consent for us to process your information to respond to your request.
  • Legitimate interests: We process technical data to maintain website security and improve user experience.
  • Legal obligation: We may process data to comply with legal requirements or respond to lawful requests.

Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

  • Right of access: Request copies of your personal data.
  • Right to rectification: Request correction of inaccurate or incomplete data.
  • Right to erasure: Request deletion of your personal data under certain circumstances.
  • Right to restrict processing: Request limitation on how we use your data.
  • Right to data portability: Request transfer of your data to another organisation or directly to you.
  • Right to object: Object to processing of your personal data in certain situations.
  • Rights related to automated decision-making: We do not use automated decision-making or profiling.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, typically no longer than two years after your last interaction with us, unless a longer retention period is required by law.

International Data Transfers

Personal data collected through our website is stored on servers located in Australia. Australia is not covered by an adequacy decision under GDPR, however we implement appropriate safeguards to protect your data in accordance with GDPR standards.

Data Security Measures

We implement technical and organisational security measures including encryption, access controls, and regular security assessments to protect personal data from unauthorised access, alteration, disclosure, or destruction.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals within 72 hours of becoming aware of the breach, in accordance with GDPR requirements.

Exercising Your Rights

To exercise any of your GDPR rights, contact us at [email protected]. We will respond to your request within one month. If your request is complex or we receive multiple requests, this period may be extended by two additional months, and we will inform you of any such extension.

Complaints

If you are located in the EEA and believe we have not handled your personal data appropriately, you have the right to lodge a complaint with your national data protection authority.

Contact

For questions about GDPR compliance or to exercise your rights, contact us at [email protected].