GDPR Compliance Statement

Introduction

Incolprude is committed to protecting the privacy and personal data of individuals in accordance with the General Data Protection Regulation (GDPR). This statement outlines how we comply with GDPR requirements and respect the rights of data subjects.

Data Controller Information

Entity Name: Incolprude
Address: Level 14, 287 Collins Street, Melbourne VIC 3000, Australia
Contact Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you provide explicit consent for specific processing activities
• Contract Performance: Processing necessary to fulfill service agreements
• Legitimate Interests: Processing necessary for business operations, provided it does not override your rights
• Legal Obligations: Processing required to comply with applicable laws

Data Subject Rights

Under GDPR, you have the following rights:

Right to Access

You may request confirmation of whether we process your personal data and obtain a copy of that data. We will respond to access requests within 30 days.

Right to Rectification

You may request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure

You may request deletion of your personal data under certain circumstances, including when data is no longer necessary for the purposes collected or when you withdraw consent.

Right to Restrict Processing

You may request limitation of processing activities under specific conditions, such as when disputing data accuracy.

Right to Data Portability

You may request transfer of your personal data to another service provider in a structured, commonly used, machine-readable format.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significant impacts.

Exercising Your Rights

To exercise any of these rights, contact us at [email protected] with the following information:

• Your full name and contact information
• Description of the specific right you wish to exercise
• Any relevant details to help us locate your information

We will verify your identity before processing requests and respond within the timeframes required by GDPR.

Data Protection Measures

We implement appropriate technical and organizational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Regular security assessments and penetration testing
• Employee training on data protection principles
• Access controls and authentication mechanisms
• Incident response procedures for data breaches

Data Breach Notification

In the event of a personal data breach that poses risks to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Affected individuals will be informed without undue delay when the breach is likely to result in high risk to their rights.

International Data Transfers

When transferring personal data outside the European Economic Area, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions recognizing equivalent data protection levels
• Binding corporate rules for intra-organizational transfers

Data Retention

We retain personal data only as long as necessary for the purposes collected or as required by legal obligations. Retention periods vary based on data type and purpose:

• Service inquiry data: Retained for 3 years after last contact
• Contract-related data: Retained for duration of contract plus 7 years for legal purposes
• Marketing consent data: Retained until consent is withdrawn
• Website analytics data: Aggregated and anonymized after 26 months

Third-Party Processors

We engage third-party service providers who process personal data on our behalf. These processors are contractually bound to:

• Process data only according to our documented instructions
• Implement appropriate security measures
• Maintain confidentiality of personal data
• Assist with data subject rights requests
• Delete or return data upon termination of services

Children's Data

We do not knowingly process personal data of individuals under 16 years of age without parental consent. If we become aware of such processing, we will delete the data immediately.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR. The relevant authority depends on your location within the EU/EEA.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Updates will be posted with a revised date.

Contact for GDPR Matters

For questions regarding GDPR compliance or to exercise your rights, contact:
Email: [email protected]
Subject Line: GDPR Request