GDPR Compliance

Last updated: June 4, 2026

Our Commitment to Data Protection

While orchard-spark operates primarily in Australia, we recognize and respect the data protection rights of all individuals, including those covered under the European Union's General Data Protection Regulation (GDPR).

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: You have explicitly agreed to our processing of your personal data for specific purposes
• Contract: Processing is necessary to fulfill service agreements
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as responding to inquiries

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You may request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You may request correction of inaccurate personal data we hold about you.

Right to Erasure

You may request deletion of your personal data under certain circumstances, including when data is no longer necessary for its original purpose.

Right to Restrict Processing

You may request that we limit how we use your personal data in specific situations.

Right to Data Portability

You may request to receive your personal data in a structured, commonly used format, or request that we transmit it directly to another controller.

Right to Object

You may object to processing of your personal data where we rely on legitimate interests as the legal basis.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Data Transfers

Your personal data is processed and stored in Australia. If data is transferred internationally, we ensure appropriate safeguards are in place to protect your information in accordance with GDPR requirements.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Client service records are retained for seven years following conclusion of services.

Data Protection Officer

For questions regarding data protection or to exercise your GDPR rights, contact us at:

[email protected]

Supervisory Authority

If you are located in the European Union and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

Automated Decision Making

We do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects individuals.

Children's Data

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children.