GDPR Compliance

Last updated: January 2026

Our Commitment to GDPR

Although lush-flow is an Australian company, we recognise the importance of the General Data Protection Regulation (GDPR) and extend its protections to all visitors to our website, including those located in the European Economic Area (EEA).

Data Controller

lush-flow acts as the data controller for personal information collected through this website. Our contact details are:

Email: [email protected]
Address: 142 Solar Drive, Brisbane, QLD 4000, Australia

Legal Basis for Processing

We process personal data under the following legal bases:

Consent: When you submit enquiry forms or opt in to marketing communications
Contract: When processing is necessary to fulfil a service agreement with you
Legitimate Interests: For website analytics and improving our services, where such interests are not overridden by your rights
Legal Obligation: When we are required to process data by law

Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

Right of Access: You can request a copy of the personal data we hold about you
Right to Rectification: You can request correction of inaccurate or incomplete data
Right to Erasure: You can request deletion of your personal data in certain circumstances
Right to Restrict Processing: You can request that we limit how we use your data
Right to Data Portability: You can request your data in a structured, machine-readable format
Right to Object: You can object to processing based on legitimate interests or for direct marketing
Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex, we may extend this period by a further two months, in which case we will inform you.

We will not charge a fee for responding to your request unless it is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee or refuse to act on the request.

International Data Transfers

As we are based in Australia, any personal data transferred to us from the EEA will be transferred outside the EEA. Australia is recognised by the European Commission as providing adequate data protection. We also implement appropriate safeguards to ensure your data is protected.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected. Criteria used to determine retention periods include:

The duration of our relationship with you
Legal obligations to retain data
Whether retention is advisable in light of our legal position

Data Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encryption, access controls, and regular security assessments.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

Complaints

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with a supervisory authority. For EEA residents, this would be the data protection authority in your country of residence.

Contact Our Data Protection Officer

For any questions regarding our GDPR compliance or to exercise your data protection rights, please contact:

Email: [email protected]
Subject Line: GDPR Enquiry