GDPR Compliance

Last Updated: January 2024

About GDPR

The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. Although Ember-egret is based in South Africa, we are committed to protecting the privacy rights of visitors from the EU in accordance with GDPR requirements.

Data Controller

For the purposes of GDPR, the data controller for information collected through this website is:

Ember-egret
42 Weaver's Lane
Stellenbosch, Western Cape, 7600
South Africa
Email: [email protected]

Lawful Basis for Processing

We process personal data of EU residents based on the following lawful bases:

Consent

When you submit an enquiry through our contact form, you provide explicit consent for us to process your personal data for the purpose of responding to your enquiry. You may withdraw this consent at any time by contacting us.

Contractual Performance

If you commission work from us, we process your data as necessary to fulfil our contractual obligations, including order processing, delivery, and communication regarding your commission.

Legitimate Interests

We may process certain data based on our legitimate business interests, such as website analytics and security, provided these interests do not override your fundamental rights and freedoms.

Your Rights Under GDPR

As an EU resident, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this information free of charge within one month of your request.

Right to Rectification

If any personal data we hold is inaccurate or incomplete, you have the right to request correction. We will update the information promptly upon verification.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purpose it was collected, or when you withdraw consent.

Right to Restrict Processing

You may request that we restrict processing of your personal data in specific situations, such as when you contest the accuracy of the data or object to processing based on legitimate interests.

Right to Data Portability

Where processing is based on consent or contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling in relation to your personal data.

International Data Transfers

As we are based in South Africa, personal data collected from EU residents will be transferred to and processed in South Africa. South Africa has been recognised by the European Commission as providing an adequate level of data protection. We also implement additional safeguards including:

• Secure data transmission protocols
• Access controls limiting who can view personal data
• Contractual obligations with any third-party service providers

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Specifically:

• Enquiry data: Up to three years from last interaction
• Commission records: Seven years for financial and legal compliance
• Analytics data: Aggregated and anonymised within 26 months

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit using SSL/TLS
• Regular security assessments
• Access controls and authentication measures
• Staff training on data protection

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, we may extend this period by up to two additional months, and we will inform you of any such extension.

We may request verification of your identity before processing your request to ensure we are releasing information to the correct person.

Complaints

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with a supervisory authority. For EU residents, this would typically be the data protection authority in your country of residence.

Updates to This Notice

We may update this GDPR notice periodically. Any changes will be posted on this page with an updated revision date. We encourage you to review this notice regularly.