Last updated: June 23, 2026
For the purposes of the General Data Protection Regulation (GDPR), the data controller is our business operating under the name crag flow, located at 247 Industrial Avenue, Port Melbourne VIC 3207, Australia.
We process personal data under the following legal bases:
Under GDPR, you have the following rights regarding your personal data:
You may request confirmation of whether we process your personal data and obtain a copy of that data in a structured, commonly used format.
You can request correction of inaccurate personal data or completion of incomplete data we hold about you.
You may request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when you object to processing.
You can request restriction of processing when you contest data accuracy, when processing is unlawful but you prefer restriction over deletion, or when you need the data for legal claims.
Where technically feasible, you may request transfer of your data to another controller in a structured, machine-readable format.
You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
To exercise any of these rights, contact us via the email address provided on our contact page. Include sufficient details to identify your data and specify which right you wish to exercise.
We will respond within one month of receiving a valid request. In complex cases, we may extend this period by two additional months and will notify you of any extension.
We do not charge fees for processing rights requests unless they are manifestly unfounded, excessive, or repetitive, in which case we may charge reasonable administrative costs.
Our website is hosted within Australia. Personal data collected through our site is stored on servers located in Australia and is not transferred outside the country except where necessary for core website functionality such as image content delivery from third-party CDN services.
We retain personal data for as long as necessary to fulfill the purposes for which it was collected:
We do not use automated decision-making processes or profiling that would produce legal effects or similarly significant impacts on individuals.
Given the scale and nature of our data processing activities, we have not appointed a dedicated Data Protection Officer. Inquiries regarding data protection should be directed to the contact email provided on our contact page.
You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR. In Australia, the relevant authority is the Office of the Australian Information Commissioner (OAIC).
We may update this GDPR compliance information to reflect changes in our practices or legal requirements. Material changes will be communicated through prominent notice on our website.