GDPR Information
General Data Protection Regulation Compliance
Introduction
This page provides specific information about how Wise-finch complies with the General Data Protection Regulation (GDPR), which governs the processing of personal data of individuals within the European Economic Area (EEA).
Even though our business operates primarily in Australia, we respect and comply with GDPR requirements for all visitors from the EEA who use our website or services.
Data Controller Information
Wise-finch acts as the data controller for personal information collected through our website and services.
Contact details:
Email: [email protected]
Address: 127 Macquarie Street, Sydney NSW 2000, Australia
Legal Basis for Processing
We process your personal data under the following legal grounds:
Consent
When you provide explicit consent for specific processing activities such as marketing communications or optional cookies.
Contract Performance
Processing necessary to fulfill our contractual obligations when you book a tour or service with us.
Legitimate Interests
Processing necessary for our legitimate business interests, such as improving services, preventing fraud, and ensuring security, provided these interests do not override your fundamental rights.
Legal Obligations
Processing required to comply with legal obligations, such as tax and accounting requirements.
Your GDPR Rights
Under GDPR, you have the following rights regarding your personal data:
Right to Access
You can request confirmation of whether we process your personal data and obtain a copy of that data.
Right to Rectification
You can request correction of inaccurate or incomplete personal data.
Right to Erasure ("Right to be Forgotten")
You can request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes it was collected, or you withdraw consent.
Right to Restriction of Processing
You can request limitation on how we use your data in specific situations, such as when you contest the accuracy of the data.
Right to Data Portability
You can request to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
Right to Object
You can object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making
You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects. We do not currently engage in such automated decision-making.
Right to Withdraw Consent
Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
How to Exercise Your Rights
To exercise any of your GDPR rights, contact us at [email protected] with the subject line "GDPR Rights Request."
Please include:
- Your full name and email address
- Specific right(s) you wish to exercise
- Any relevant details to help us locate your information
We will respond to your request within one month. In complex cases, this may be extended by two additional months, and we will inform you of such extension.
Data Protection Principles
We adhere to the following data protection principles:
- Lawfulness, fairness, and transparency: We process data lawfully, fairly, and in a transparent manner
- Purpose limitation: We collect data for specified, explicit, and legitimate purposes
- Data minimization: We collect only data that is adequate, relevant, and necessary
- Accuracy: We maintain accurate and up-to-date data
- Storage limitation: We retain data only as long as necessary
- Integrity and confidentiality: We implement appropriate security measures
- Accountability: We demonstrate compliance with these principles
International Data Transfers
Your data may be transferred to and processed in Australia and potentially other countries outside the EEA. When we transfer data internationally, we ensure appropriate safeguards are in place, such as:
- Standard contractual clauses approved by the European Commission
- Transfers to countries with adequacy decisions
- Other legally approved transfer mechanisms
Data Retention Periods
We retain personal data for different periods depending on the purpose:
- Booking information: Seven years (for accounting and legal compliance)
- Marketing consent: Until consent is withdrawn or after three years of inactivity
- Website analytics: 26 months
- Inquiry correspondence: Three years
Third-Party Data Processors
We work with the following categories of third-party processors:
- Payment processing services
- Email communication platforms
- Website hosting providers
- Analytics services
All processors are carefully selected and required to maintain GDPR-compliant data protection measures through written agreements.
Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk to you, we will also inform you directly without undue delay.
Children's Data
We do not knowingly collect or process personal data from children under 16 years of age without parental consent. If you believe we have collected such data, please contact us immediately.
Complaints and Supervisory Authority
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority in the EU member state of your residence, place of work, or place of the alleged infringement.
We encourage you to contact us first so we can attempt to resolve your concerns directly.
Updates to This Information
We may update this GDPR information periodically. Significant changes will be communicated through our website or direct notification to affected individuals.
Last updated: November 3, 2026