GDPR Compliance

Our Commitment to GDPR

Bright Shaft is committed to ensuring the security and protection of the personal information that we process. We have implemented robust policies, procedures, and technologies to maintain the security of all personal data from the point of collection to the point of destruction.

Data Controller

Bright Shaft acts as the Data Controller for the personal information we collect. Our contact details are:

Bright Shaft
47 Bushland Avenue
Katoomba NSW 2780
Australia
Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Contract: Processing necessary for the performance of a contract (e.g., tour bookings)
• Consent: Where you have given clear consent for us to process your personal data (e.g., marketing communications)
• Legitimate Interest: Where processing is necessary for our legitimate business interests
• Legal Obligation: Where processing is necessary for compliance with legal obligations

Your Rights Under GDPR

If you are a resident of the European Economic Area (EEA), you have the following data protection rights:

Right of Access

You have the right to request copies of your personal data. We may charge a small fee for this service.

Right to Rectification

You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.

Right to Erasure

You have the right to request that we erase your personal data, under certain conditions.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data, under certain conditions.

Right to Object to Processing

You have the right to object to our processing of your personal data, under certain conditions.

Right to Data Portability

You have the right to request that we transfer the data we have collected to another organisation, or directly to you, under certain conditions.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Booking records are retained for 7 years for accounting and legal purposes. Marketing preferences are retained until you withdraw consent.

International Transfers

Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. We ensure appropriate safeguards are in place for any such transfers.

Data Protection Officer

For any questions regarding our GDPR compliance or to exercise your rights, please contact us at [email protected] with "GDPR Request" in the subject line.

Complaints

You have the right to lodge a complaint with a supervisory authority if you believe that we have not complied with the requirements of the GDPR.

Updates to This Notice

We may update this GDPR compliance notice from time to time. Any changes will be posted on this page with an updated revision date.