GDPR Compliance

Last updated: November 3, 2026

Overview

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to organizations processing personal data of individuals in the European Union. While Bloom-crag operates primarily in Australia, we respect GDPR principles and extend similar protections to all users of our services.

Lawful Basis for Processing

We process personal data based on the following legal grounds:

• Consent: When you provide explicit consent through form submissions or cookie acceptance
• Contractual necessity: To provide consulting services you have requested
• Legitimate interests: To improve our services and communicate relevant information
• Legal obligations: To comply with applicable laws and regulations

Your Rights Under GDPR

If you are located in the European Union or if GDPR applies to you, you have the following rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data under certain conditions
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interests
• Rights Related to Automated Decision-Making: Not be subject to decisions based solely on automated processing

Data Processing Activities

We process personal data for the following purposes:

• Responding to consultation requests and providing professional services
• Maintaining records of business communications
• Website analytics and performance improvement
• Compliance with legal and regulatory requirements

Data Sharing and Transfers

We do not sell your personal data to third parties. Data may be shared with:

• Service providers who assist in website operation and service delivery
• Professional advisors when necessary for business operations
• Law enforcement or regulatory authorities when legally required

Any international data transfers are conducted with appropriate safeguards in place, such as standard contractual clauses approved by the European Commission.

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting data access to authorized personnel
• Staff training on data protection principles

Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. Specific retention periods depend on the nature of the data and legal requirements.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with your request. We will respond within one month of receiving your request, though this period may be extended in complex cases.

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website.