GDPR Compliance Statement

Our Commitment to GDPR

Velvet Mesa is committed to full compliance with the General Data Protection Regulation (GDPR) as it applies to the processing of personal data of individuals within the European Economic Area (EEA), the United Kingdom, and Switzerland.

We recognize the importance of protecting your personal data and upholding your privacy rights under GDPR, regardless of where you are located.

Legal Basis for Processing

We process personal data only when we have a lawful basis to do so. Our legal bases include:

• Consent: When you voluntarily provide information through forms or communications
• Contract: When processing is necessary to fulfill a booking or service agreement
• Legitimate Interests: When necessary for operational purposes that do not override your rights
• Legal Obligation: When required to comply with applicable laws and regulations

Your Rights Under GDPR

As a data subject, you have the following rights:

Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

You have the right to request deletion of your personal data under certain circumstances, including when the data is no longer necessary for the purposes for which it was collected.

Right to Restriction of Processing

You can request that we limit how we use your personal data in specific situations.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used format and to transmit that data to another controller.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your habitual residence, place of work, or place of alleged infringement.

Data Processing Activities

What Data We Process

• Contact information (name, email address)
• Reservation and service preference data
• Communication records
• Website usage data and analytics

How Long We Retain Data

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, including:

• Active reservation and booking data: Duration of service plus 2 years
• Correspondence records: 3 years from last contact
• Website analytics: Anonymized after 14 months
• Legal and tax records: As required by applicable law (typically 7 years)

Data Transfers

Velvet Mesa operates primarily in Australia. When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions recognizing equivalent data protection standards
• Binding corporate rules or certification mechanisms where applicable

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and audits
• Staff training on data protection principles
• Incident response and breach notification procedures

Third-Party Processors

We work with carefully selected third-party service providers who process personal data on our behalf. All processors are required to:

• Process data only according to our documented instructions
• Maintain appropriate security measures
• Assist us in responding to data subject requests
• Delete or return data upon termination of services

Automated Decision-Making

Velvet Mesa does not engage in automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

Exercising Your Rights

To exercise any of your GDPR rights or if you have questions about our data processing activities, please contact us:

Email: [email protected]
Subject Line: GDPR Request
Address: 142 Flinders Lane, Melbourne VIC 3000, Australia

We will respond to your request within one month of receipt. In complex cases, we may extend this period by two additional months and will inform you of any such extension.

Updates to This Statement

We may update this GDPR Compliance Statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website or directly to affected individuals where appropriate.