GDPR Compliance

Last updated: September 2026

Overview

keen-elm respects the privacy rights of individuals in the European Economic Area (EEA) and complies with the General Data Protection Regulation (GDPR) when processing personal data of EEA residents. This page provides additional information about your rights under GDPR.

Data Controller

keen-elm acts as the data controller for personal information collected through this website. For enquiries regarding data protection, contact us at:

keen-elm
Level 12, 180 Collins Street
Melbourne VIC 3000
Australia

Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you provide explicit consent for specific processing activities, such as subscribing to communications.
• Contractual Necessity: When processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
• Legitimate Interests: When processing is necessary for our legitimate business interests, provided these do not override your fundamental rights and freedoms.
• Legal Obligation: When processing is necessary to comply with legal requirements.

Your Rights Under GDPR

If you are an EEA resident, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data in certain circumstances.
• Right to Restriction: You may request that we limit how we use your data.
• Right to Data Portability: You may request to receive your data in a structured, commonly used format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes.
• Rights Related to Automated Decision-Making: You have rights concerning automated decisions that significantly affect you.

Exercising Your Rights

To exercise any of these rights, please contact us using the details provided above. We will respond to your request within one month. In complex cases, this period may be extended by two additional months, and we will inform you of any extension.

We may need to verify your identity before processing your request. There is generally no fee for exercising your rights, although we may charge a reasonable fee for manifestly unfounded or excessive requests.

International Data Transfers

As an Australian company, we may transfer personal data outside the EEA. When doing so, we implement appropriate safeguards to protect your data, which may include:

• Standard contractual clauses approved by the European Commission
• Ensuring the recipient country has an adequacy decision
• Other appropriate safeguards as permitted under GDPR

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Retention periods vary depending on the nature of the data and our legal obligations. When data is no longer required, it is securely deleted or anonymised.

Cookies and Tracking

Our website uses cookies and similar technologies. We obtain your consent before placing non-essential cookies. For detailed information, please see our Cookie Policy.

Supervisory Authority

If you believe that our processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority. You may do so in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

Changes to This Information

We may update this GDPR information from time to time. Any changes will be posted on this page with an updated revision date.