GDPR Compliance Statement

Last Updated: November 3, 2026

Saga-falcon is committed to compliance with the General Data Protection Regulation (GDPR) for individuals located in the European Economic Area (EEA), United Kingdom, and Switzerland. This statement outlines how we protect the rights of data subjects and manage personal data in accordance with GDPR requirements.

1. Legal Basis for Processing

We process personal data only when we have a lawful basis under GDPR Article 6:

• Consent: You have given clear consent for us to process your personal data for specific purposes, such as receiving research services or marketing communications
• Contract Performance: Processing is necessary to fulfill our service agreement with you
• Legal Obligation: Processing is necessary to comply with applicable laws and regulations
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your fundamental rights and freedoms

2. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right to Access: Obtain confirmation of whether we process your personal data and receive a copy of that data
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Erasure (Right to be Forgotten): Request deletion of your personal data under certain conditions
• Right to Restriction of Processing: Request limitation of how we process your data in specific circumstances
• Right to Data Portability: Receive your personal data in a structured, commonly used format and transmit it to another controller
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Withdraw consent at any time when processing is based on consent, without affecting lawfulness of prior processing
• Rights Related to Automated Decision-Making: Not be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects

3. Data Protection Principles

We adhere to GDPR's core data protection principles:

• Lawfulness, Fairness, and Transparency: Processing data lawfully, fairly, and in a transparent manner
• Purpose Limitation: Collecting data for specified, explicit, and legitimate purposes only
• Data Minimization: Ensuring data collected is adequate, relevant, and limited to what is necessary
• Accuracy: Keeping personal data accurate and up to date
• Storage Limitation: Retaining data only as long as necessary for the purposes collected
• Integrity and Confidentiality: Implementing appropriate security measures to protect personal data
• Accountability: Demonstrating compliance with these principles

4. International Data Transfers

When transferring personal data from the EEA to countries outside the EEA (including Australia), we ensure appropriate safeguards are in place:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions recognizing the recipient country's data protection standards
• Binding corporate rules for intra-organizational transfers
• Specific derogations for particular situations as permitted under GDPR Article 49

5. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible
• Inform affected individuals without undue delay if the breach poses a high risk to their rights and freedoms
• Document all data breaches, including facts, effects, and remedial actions taken

6. Data Protection Officer

While Saga-falcon is not required to appoint a Data Protection Officer under GDPR Article 37, we have designated a privacy compliance coordinator responsible for:

• Monitoring compliance with GDPR and internal data protection policies
• Providing advice on data protection impact assessments
• Cooperating with supervisory authorities
• Acting as a contact point for data subjects exercising their rights

7. Cookies and Tracking

Our use of cookies and similar technologies complies with GDPR requirements. We obtain consent before placing non-essential cookies and provide clear information about cookie purposes. You can manage cookie preferences at any time. See our Cookies Policy for details.

8. Children's Data

We do not knowingly process personal data of children under 16 years of age without parental consent. If we become aware of such processing, we will delete the data promptly unless legally required to retain it.

9. Supervisory Authority

If you have concerns about our data processing practices that we have not adequately addressed, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of alleged infringement.

10. Updates to This Statement

We may update this GDPR Compliance Statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website or direct notification where appropriate.

11. Contact Information

For GDPR-related inquiries, data subject requests, or privacy concerns, contact:

Saga-falcon Privacy Team
Level 14, Heritage Tower
287 Collins Street
Melbourne VIC 3000
Australia
Email: [email protected]
Subject Line: GDPR Request