GDPR Information

Last Updated: November 2024

This page provides information about how Spire-tale complies with the General Data Protection Regulation (GDPR) for visitors from the European Union and European Economic Area.

Data Controller

Spire-tale acts as the data controller for personal information collected through our website and services.

Contact Details:
Spire-tale
42 Harbour Street
Sydney, NSW 2000
Australia
Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

• Contract: Processing necessary to perform our travel planning services that you have requested.
• Consent: Where you have given clear consent for us to process your personal data for specific purposes, such as receiving marketing communications.
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our services and website functionality, provided these do not override your rights.
• Legal Obligation: Processing necessary to comply with legal requirements.

Your Rights Under GDPR

As a data subject, you have the following rights:

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information within one month of your request.

Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure

You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose for which it was collected.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal effects concerning you. We do not currently use automated decision-making.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex or we receive numerous requests, we may extend this period by two months, but we will notify you of any extension within the first month.

International Data Transfers

As an Australian company, transferring data to us from the EU/EEA constitutes an international transfer. We ensure appropriate safeguards are in place through:

• Standard contractual clauses approved by the European Commission
• Ensuring third-party recipients provide adequate data protection
• Implementing technical and organisational security measures

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Specific retention periods are:

• Enquiry Data: 2 years from last contact
• Booking Records: 7 years as required by Australian tax law
• Marketing Preferences: Until you withdraw consent
• Website Analytics: 26 months (anonymised)

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. For EU residents, this would be the data protection authority in your country of residence.

Updates to This Information

We may update this GDPR information from time to time. Any changes will be posted on this page with an updated revision date.