GDPR Compliance

While Tranquil Sky Cultural Institution is based in Australia, we recognize that some of our website visitors may be located in the European Union. We are committed to respecting the privacy rights of all individuals, including those protected under the General Data Protection Regulation (GDPR).

1. Data Controller

For the purposes of GDPR, Tranquil Sky Cultural Institution acts as the data controller for personal information collected through this website.

Tranquil Sky Cultural Institution
147 Heritage Boulevard
Paddington, Queensland 4064
Australia
Email: [email protected]

2. Legal Basis for Processing

We process personal data under the following legal bases as defined by GDPR:

2.1 Consent (Article 6(1)(a))

When you voluntarily provide information through our booking forms or subscribe to communications, you give explicit consent for us to process that data for the stated purposes.

2.2 Contract Performance (Article 6(1)(b))

Processing is necessary to fulfill service bookings, memberships, or other contractual arrangements you enter into with our institution.

2.3 Legitimate Interests (Article 6(1)(f))

We may process data based on legitimate interests, such as improving website functionality, preventing fraud, and ensuring security, provided these interests do not override your fundamental rights and freedoms.

3. Your Rights Under GDPR

If you are an EU resident, you have the following rights regarding your personal data:

3.1 Right of Access (Article 15)

You can request confirmation of whether we process your personal data and obtain a copy of that data.

3.2 Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data.

3.3 Right to Erasure (Article 17)

You can request deletion of your personal data in certain circumstances, such as when data is no longer necessary for the purposes collected or when you withdraw consent.

3.4 Right to Restriction of Processing (Article 18)

You can request that we limit how we use your data in specific situations, such as when you contest the accuracy of the data.

3.5 Right to Data Portability (Article 20)

You can request a copy of your personal data in a structured, commonly used, machine-readable format.

3.6 Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes.

3.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

3.8 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority if you believe we have not complied with GDPR requirements.

4. Exercising Your Rights

To exercise any of these rights, please contact us at [email protected] with "GDPR Request" in the subject line. We will respond to your request within one month, as required by GDPR. In complex cases, this period may be extended by an additional two months, and we will inform you of any such extension.

When submitting a request, please provide:

• Your full name
• Email address used when interacting with our services
• Description of the specific right you wish to exercise
• Any relevant details to help us locate your information

We may request additional information to verify your identity before processing your request.

5. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods are outlined in our Privacy Policy.

6. International Data Transfers

Your personal data is primarily stored and processed in Australia, which does not have an adequacy decision from the European Commission. When we transfer data from the EU to Australia, we implement appropriate safeguards to ensure your data receives adequate protection, including:

• Contractual commitments with service providers based on standard contractual clauses approved by the European Commission
• Technical and organizational security measures
• Limited data collection to only what is necessary

7. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

8. Data Security

We implement technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting who can view personal data
• Staff training on data protection principles

9. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 of GDPR. If the breach poses a high risk to you, we will also communicate the breach directly to you without undue delay.

10. Children's Data

We do not knowingly collect or process personal data from children under 16 years of age without parental consent, in accordance with Article 8 of GDPR. If we become aware that we have collected such data without proper consent, we will delete it promptly.

11. Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website, and the effective date will be updated accordingly.

12. Contact and Supervisory Authority

For GDPR-related questions or to exercise your rights, contact us at:

Email: [email protected]
Subject Line: GDPR Request

If you are unsatisfied with our response, you have the right to lodge a complaint with the supervisory authority in your EU member state.