GDPR Compliance Statement

Last Updated: January 1, 2026

1. Our Commitment to Data Protection

Peak-node is committed to protecting the privacy and security of personal data in accordance with the General Data Protection Regulation (GDPR) and the Australian Privacy Principles (APPs). This statement outlines our approach to data protection and your rights as a data subject.

2. Legal Basis for Processing

We process personal data based on one or more of the following legal grounds:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary for the performance of a contract with you
• Legal Obligation: Processing is necessary to comply with legal requirements
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your fundamental rights

3. Data Controller Information

Peak-node acts as the data controller for personal information collected through our website and business operations.

Contact Details:
Peak-node
Level 14, Civic Tower
66-68 Goulburn Street
Sydney NSW 2000, Australia
Email: [email protected]

4. Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data in certain circumstances
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Request transfer of your data to another organization
• Right to Object: Object to processing based on legitimate interests
• Rights Related to Automated Decision-Making: Rights regarding profiling and automated decisions

5. How to Exercise Your Rights

To exercise any of these rights, please contact us using the details provided above. We will respond to your request within one month, though this may be extended by up to two months for complex requests.

We may need to verify your identity before processing requests to protect your personal information from unauthorized access.

6. Data Security Measures

We implement appropriate technical and organizational security measures including:

• Encryption of data in transit and at rest
• Access controls and authentication systems
• Regular security assessments and audits
• Staff training on data protection principles
• Incident response procedures

7. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.

8. International Data Transfers

When transferring personal data outside Australia or the European Economic Area, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions confirming equivalent data protection
• Binding corporate rules for intra-group transfers

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Duration of business relationship plus statutory retention periods
• Legal, accounting, or reporting requirements
• Resolution of disputes or enforcement of agreements

10. Third-Party Processors

We may engage third-party service providers to process data on our behalf. All processors are carefully selected and bound by data processing agreements ensuring GDPR compliance.

11. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

12. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

• Office of the Australian Information Commissioner (OAIC)
• Your local supervisory authority in the EU/EEA

13. Updates to This Statement

We may update this GDPR compliance statement periodically to reflect changes in our practices or legal requirements. Material changes will be communicated through our website or direct notification where appropriate.

14. Contact for Data Protection Matters

For questions about data protection or to exercise your rights, please contact us at [email protected] with "Data Protection Request" in the subject line.