Last Updated: September 2026
While willow-raven primarily operates in Australia and is governed by Australian privacy legislation, we recognize that some of our clients may be covered by the European Union's General Data Protection Regulation. This page outlines how we comply with GDPR principles when processing personal data of individuals in the European Economic Area.
We process personal data under the following legal bases:
If you are covered by GDPR, you have the following rights regarding your personal data:
You can request confirmation of whether we process your personal data and obtain a copy of that data along with information about how it is processed.
You can request correction of inaccurate personal data or completion of incomplete personal data we hold about you.
You can request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purposes it was collected or when you withdraw consent.
You can request that we limit how we use your personal data in certain situations, such as when you contest the accuracy of the data.
You can request to receive your personal data in a structured, commonly used, and machine-readable format and transmit it to another controller.
You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.
We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.
For questions about GDPR compliance or to exercise your rights, you may contact our data protection representative at [email protected].
Your personal data is primarily stored and processed in Australia. If we transfer data outside Australia to jurisdictions not covered by adequacy decisions, we implement appropriate safeguards such as standard contractual clauses.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and reporting requirements. Specific retention periods are outlined in our Privacy Policy.
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and relevant supervisory authorities without undue delay and within 72 hours of becoming aware of the breach, where feasible.
To exercise any of your GDPR rights, please contact us at [email protected] with your request. We will respond within one month, though this may be extended by two additional months for complex requests. We may request verification of your identity before processing your request.
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with your local supervisory authority in the European Economic Area.
We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website.