Data Protection

This page outlines how opal-reef processes and protects personal data in accordance with applicable data protection regulations, including principles derived from international privacy standards.

Data Controller

opal-reef is the data controller responsible for your personal information. Our contact details are:

Email: [email protected]
Address: Level 14, 127 Creek Street, Brisbane QLD 4000, Australia

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: When you provide explicit consent for specific processing activities
• Contract Performance: When processing is necessary to fulfill our services
• Legal Obligation: When required to comply with applicable laws
• Legitimate Interests: When necessary for our business operations, balanced against your rights

Your Data Protection Rights

Under data protection regulations, you have the following rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data under certain conditions
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Request transfer of your data to another organization
• Right to Object: Object to processing based on legitimate interests or for marketing purposes
• Rights Related to Automated Decision-Making: We do not use automated decision-making or profiling

Exercising Your Rights

To exercise any of your data protection rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will notify you accordingly.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Service delivery and customer relationship management
• Compliance with legal, accounting, or reporting obligations
• Resolution of disputes and enforcement of agreements

When personal data is no longer required, we securely delete or anonymize it.

International Data Transfers

Your personal data is primarily processed within Australia. If we transfer data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection standards.

Data Security Measures

We implement technical and organizational security measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and updates
• Staff training on data protection practices

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals and relevant authorities in accordance with legal requirements.

Third-Party Data Processors

We may engage third-party service providers to process personal data on our behalf. These processors are contractually obligated to implement appropriate security measures and process data only according to our instructions.

Children's Privacy

Our services are not directed at individuals under the age of eighteen. We do not knowingly collect personal data from minors without parental consent.

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Office of the Australian Information Commissioner or the relevant supervisory authority in your jurisdiction.

Updates to This Notice

We may update this data protection notice periodically. Significant changes will be communicated through our website or direct notification.

Last updated: August 2026