GDPR Compliance Statement

Our Commitment to Data Protection

While timid-spiral operates primarily in Australia, we recognize the importance of the General Data Protection Regulation (GDPR) for European Union residents and anyone whose data may be processed under EU law. We are committed to maintaining compliance with GDPR principles.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you provide explicit consent for specific processing activities
• Contract: When processing is necessary to fulfill our service agreement with you
• Legal Obligation: When we must process data to comply with legal requirements
• Legitimate Interests: When processing serves our legitimate business interests without overriding your rights

Your GDPR Rights

Under GDPR, EU residents have the following rights:

Right to Access

You have the right to request copies of your personal data. We will provide this information in a commonly used electronic format.

Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

Right to Restrict Processing

You have the right to request that we restrict processing of your personal data in certain situations.

Right to Data Portability

You have the right to receive your personal data in a structured, machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing that produces legal or similarly significant effects.

Data Processing Activities

We process personal data for the following purposes:

• Providing pet care services as requested
• Maintaining medical and behavioural records for continuity of care
• Communicating about appointments and care recommendations
• Processing payments and managing accounts
• Improving our services through analysis and feedback
• Complying with legal and regulatory obligations

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. Veterinary records are retained in accordance with Australian veterinary practice standards.

International Data Transfers

As we operate primarily in Australia, most data processing occurs locally. Should we transfer data internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission.

Data Security Measures

We implement robust technical and organizational measures to protect personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and updates
• Staff training on data protection practices
• Incident response procedures

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by GDPR.

Third-Party Processors

When we engage third-party service providers who process data on our behalf, we ensure they provide sufficient guarantees of GDPR compliance through contractual agreements.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us using the details below. We will respond to your request within one month, though this may be extended by two additional months for complex requests.

There is no fee for exercising your rights, though we may charge a reasonable fee for manifestly unfounded or excessive requests.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe we have not complied with GDPR requirements. In Australia, the relevant authority is the Office of the Australian Information Commissioner (OAIC).

Contact Our Data Protection Officer

For questions about GDPR compliance or to exercise your rights, contact:

Email: [email protected]
Address: 142 Brunswick Street, Fortitude Valley, QLD 4006, Australia

Updates to This Statement

We may update this GDPR compliance statement periodically to reflect changes in our practices or legal requirements. We will notify you of significant changes through our website or direct communication.