GDPR Compliance

Last Updated: August 2026

1. Introduction

prairie-path is committed to complying with the General Data Protection Regulation (GDPR) when processing personal data of individuals located in the European Economic Area (EEA). This page outlines how we handle personal data in accordance with GDPR requirements.

2. Data Controller Information

For the purposes of GDPR, prairie-path acts as the data controller for personal data collected through our website and services.

Contact Details:
prairie-path
Level 14, 200 George Street
Sydney NSW 2000
Australia
Email: [email protected]

3. Categories of Personal Data

We may process the following categories of personal data:

• Identity Data: Name, job title, company name
• Contact Data: Email address, business address
• Technical Data: IP address, browser type, device information
• Usage Data: Information about how you use our website
• Communication Data: Correspondence and inquiry content

4. Lawful Basis for Processing

Under GDPR, we rely on the following lawful bases for processing personal data:

• Consent (Article 6(1)(a)): Where you have given clear consent for us to process your personal data for a specific purpose
• Contract (Article 6(1)(b)): Where processing is necessary for the performance of a contract or to take steps prior to entering into a contract
• Legitimate Interests (Article 6(1)(f)): Where processing is necessary for our legitimate interests or the legitimate interests of a third party, provided these interests are not overridden by your rights
• Legal Obligation (Article 6(1)(c)): Where processing is necessary to comply with legal obligations

5. Your Rights Under GDPR

If you are located in the EEA, you have the following rights under GDPR:

5.1 Right of Access (Article 15)

You have the right to request access to the personal data we hold about you and receive a copy of that data.

5.2 Right to Rectification (Article 16)

You have the right to request correction of inaccurate personal data and completion of incomplete data.

5.3 Right to Erasure (Article 17)

You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected.

5.4 Right to Restriction of Processing (Article 18)

You have the right to request restriction of processing of your personal data in certain circumstances.

5.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

5.6 Right to Object (Article 21)

You have the right to object to processing of your personal data based on legitimate interests, including profiling based on those grounds.

5.7 Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

6. Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month of receipt. This period may be extended by two further months where necessary, considering the complexity and number of requests.

We may request specific information from you to help confirm your identity and ensure your right to access your personal data or exercise any other rights.

7. International Data Transfers

As we are based in Australia, personal data collected from EEA residents may be transferred outside the EEA. When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, which may include:

• Standard Contractual Clauses approved by the European Commission
• Binding Corporate Rules
• Other appropriate safeguards as required by GDPR

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. The specific retention period depends on the nature of the data and the purposes for processing.

9. Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Regular testing and evaluation of security measures
• Access controls and authentication mechanisms
• Staff training on data protection

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

11. Right to Lodge a Complaint

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with a supervisory authority. You may contact the supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

12. Updates to This Information

We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated revision date.