Data Protection

Last Updated: January 2024

fern-quest is committed to protecting your personal data and respecting your privacy rights. This page outlines our approach to data protection in accordance with applicable Australian privacy laws and international data protection standards.

Our Data Protection Principles

We adhere to the following principles when handling your personal data:

• Lawfulness and transparency: We process data lawfully, fairly, and transparently
• Purpose limitation: We collect data for specified, explicit, and legitimate purposes
• Data minimisation: We only collect data that is necessary for our stated purposes
• Accuracy: We take reasonable steps to ensure data is accurate and up to date
• Storage limitation: We retain data only for as long as necessary
• Security: We implement appropriate measures to protect data integrity and confidentiality

Your Data Rights

You have the following rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information within a reasonable timeframe and in a commonly used electronic format.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will address such requests promptly.

Right to Erasure

In certain circumstances, you may request that we delete your personal data. This right applies when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent (where consent was the basis for processing)
• The data was unlawfully processed

Please note that we may be required to retain certain data for legal or regulatory purposes.

Right to Restriction

You may request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

Where technically feasible, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

How to Exercise Your Rights

To exercise any of these rights, please contact us using the details below. We will respond to your request within 30 days. To protect your privacy, we may need to verify your identity before fulfilling your request.

Data Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit and at rest
• Access controls limiting who can view personal data
• Regular testing and evaluation of security measures
• Staff training on data protection responsibilities
• Incident response procedures for potential data breaches

Data Transfers

We primarily store and process data within Australia. If data is transferred to other jurisdictions, we ensure appropriate safeguards are in place to protect your data in accordance with applicable law.

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant authorities and affected individuals as required by applicable law.

Retention Periods

We retain personal data for different periods depending on its purpose:

• Consultation records: Retained for 7 years from the date of last service
• Marketing preferences: Retained until you withdraw consent
• Website analytics: Aggregated and anonymised after 26 months
• Contact enquiries: Retained for 2 years after resolution

Automated Decision Making

We do not use automated decision-making processes, including profiling, that produce legal effects or similarly significantly affect you.

Children's Data

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us immediately.

Updates to This Policy

We may update this data protection information from time to time. Significant changes will be communicated through our website or direct notification where appropriate.

Contact Our Data Protection Team

If you have questions about data protection or wish to exercise your rights, please contact us:

Data Protection Enquiries
fern-quest
Level 14, 227 Elizabeth Street
Sydney NSW 2000
Australia
Email: [email protected]

Complaints

If you are not satisfied with our response to a data protection concern, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992