GDPR Rights & Data Protection

1. Introduction

If you are a resident of the European Union (EU), the General Data Protection Regulation (GDPR) gives you specific rights regarding your personal data. Heritage Chronicles is committed to respecting these rights and providing you with control over your personal information.

This page explains your GDPR rights and how to exercise them when using our services.

2. Data Controller Information

3. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

4. Detailed Rights Explanation

4.1 Right to Access (Article 15)

You can request:

• Confirmation that we are processing your personal data
• A copy of your personal data
• Information about how we process your data
• Details about data recipients
• Information about data retention periods
• Details about your other GDPR rights

4.2 Right to Rectification (Article 16)

You can request correction of:

• Inaccurate personal data
• Incomplete personal data
• Out-of-date information

We will respond within one month and notify third parties of corrections where applicable.

4.3 Right to Erasure - "Right to be Forgotten" (Article 17)

You can request deletion when:

• Personal data is no longer necessary for the original purpose
• You withdraw consent and there's no other legal basis
• Data has been unlawfully processed
• Deletion is required for legal compliance
• Data was collected from a child without proper consent

4.4 Right to Restrict Processing (Article 18)

You can request restricted processing when:

• You contest the accuracy of personal data
• Processing is unlawful but you don't want deletion
• We no longer need the data but you need it for legal claims
• You've objected to processing pending verification

4.5 Right to Data Portability (Article 20)

This right applies when:

• Processing is based on consent or contract
• Processing is carried out by automated means
• Data is provided directly by you

We will provide data in a structured, commonly used, machine-readable format.

4.6 Right to Object (Article 21)

You can object to processing based on:

• Legitimate interests (including profiling)
• Direct marketing (absolute right)
• Scientific or historical research
• Statistical purposes

5. Withdrawal of Consent

Where we process your personal data based on consent, you have the right to withdraw that consent at any time. This includes:

• Marketing communications
• Cookie consent
• Optional data collection
• Research participation

To withdraw consent:

• Use unsubscribe links in emails
• Adjust cookie settings on our website
• Contact us directly using the form below

6. How to Exercise Your Rights

To exercise any of your GDPR rights, you can:

• Email us at privacy@trewdoms.com
• Use the contact form below
• Write to us at the address provided above
• Call us on +61 7 3184 6295

7. Response Timeframes

We will respond to your GDPR requests within the following timeframes:

• Standard Requests: Within 1 month of receipt
• Complex Requests: Up to 3 months (we will inform you of any extension)
• Urgent Requests: We will prioritize requests involving data breaches or immediate harm

8. Identity Verification

To protect your privacy and prevent unauthorized access to your personal data, we may need to verify your identity before processing your request. This may involve:

• Confirming your email address
• Asking for additional identifying information
• Requesting proof of identity for sensitive requests

9. Fees

Generally, we do not charge fees for GDPR requests. However, we may charge a reasonable fee if:

• Requests are clearly unfounded or excessive
• You request multiple copies of the same information
• Administrative costs are significant

We will inform you of any fees before processing your request.

10. Limitations to Your Rights

Your GDPR rights are not absolute. We may refuse or limit your request if:

• It would adversely affect others' rights and freedoms
• It would prevent us from fulfilling legal obligations
• It relates to legal proceedings or potential legal claims
• It involves confidential business information
• It requires disproportionate effort or cost

11. Data Protection Officer

While we are not required to appoint a Data Protection Officer (DPO) under GDPR, our Privacy Team handles all data protection matters. You can contact them at:

Email: privacy@trewdoms.com

12. Supervisory Authority

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. You can contact:

• The supervisory authority in your EU country of residence
• The supervisory authority in your place of work
• The supervisory authority where the alleged infringement occurred

A list of EU Data Protection Authorities is available at: European Data Protection Board

13. International Transfers

As we are based in Australia, your personal data may be transferred outside the EU. We ensure appropriate safeguards through:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where applicable
• Binding Corporate Rules
• Certification schemes

14. Cookie Management

You can manage cookies and tracking technologies through:

• Our cookie consent banner on first visit
• Browser settings for cookie preferences
• Third-party opt-out tools
• Contacting us to update your preferences

15. Children's Data

We do not knowingly collect personal data from children under 16 without parental consent. If you believe we have collected such data, please contact us immediately for deletion.