Our Commitment to Data Protection

vibrant-sprout.com is committed to protecting your personal data and respecting your privacy rights. While we are based in Australia and primarily operate under Australian Privacy Principles, we extend GDPR-level protections to all individuals whose data we process.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you provide explicit consent through form submissions or service bookings
• Contract performance: When processing is necessary to fulfil services you have requested
• Legitimate interests: For business operations, improving services, and responding to enquiries
• Legal obligations: When required to comply with applicable laws and regulations

Data We Collect and Why

We collect only the personal data necessary to provide our services effectively:

• Contact information: Name and email address for communication and service delivery
• Service preferences: Selected services and specific requirements to tailor our offerings
• Dietary information: Voluntarily provided details to ensure safe and appropriate service delivery
• Communication records: Email correspondence to maintain service quality and continuity

Your Rights Under Data Protection Laws

You have comprehensive rights regarding your personal data:

Right to Access

You may request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate or incomplete personal information we hold about you.

Right to Erasure

You may request deletion of your personal data when it is no longer necessary for the purposes collected, you withdraw consent, or you object to processing.

Right to Restrict Processing

You can request limitation on how we use your data under certain circumstances, such as when you contest accuracy or object to processing.

Right to Data Portability

You may request your personal data in a structured, commonly used format for transfer to another service provider.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts.

How to Exercise Your Rights

To exercise any of these rights, please send a detailed request to [email protected]. We will respond within 30 days and may request additional information to verify your identity before processing the request.

Data Retention

We retain personal data only as long as necessary to fulfil the purposes outlined or as required by law. Typical retention periods include:

• Active client records: Duration of service relationship plus two years
• Enquiry records: Up to one year from last contact
• Financial records: Seven years as required by Australian tax law
• Marketing consent records: Until consent is withdrawn

Data Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encrypted data transmission and storage
• Access controls limiting data access to authorised personnel only
• Regular security assessments and updates
• Staff training on data protection principles

International Data Transfers

Personal data is primarily stored and processed within Australia. If transfers to other jurisdictions occur, we ensure appropriate safeguards are in place to protect your information in accordance with data protection standards.

Third-Party Data Sharing

We do not sell or rent personal data. Limited sharing occurs only with:

• Service providers who assist with business operations under strict confidentiality agreements
• Legal authorities when required by law or to protect our rights
• Successors in the event of business transfer, with advance notice to affected individuals

Data Breach Notification

In the event of a data breach that poses risk to your rights and freedoms, we will notify you and relevant authorities within 72 hours of becoming aware of the breach, providing details of the incident and steps being taken.

Complaints and Concerns

If you have concerns about how we handle your personal data, please contact us first at [email protected]. If you remain unsatisfied, you have the right to lodge a complaint with:

• The Office of the Australian Information Commissioner (OAIC)
• Your local data protection authority if you reside in the EU/EEA

Updates to This Policy

We review and update this data protection policy regularly to reflect changes in legal requirements or our practices. Material changes will be prominently communicated via our website.

Contact Our Data Protection Officer

For specific data protection enquiries or to exercise your rights, contact:

[email protected]