GDPR Compliance Statement

Last updated: September 2, 2026

Our Commitment to Data Protection

While reef-myth operates primarily in Australia, we recognize that some of our clients may be located in the European Union or European Economic Area. We are committed to respecting the data protection rights of all individuals, regardless of location.

Legal Basis for Processing

We process personal data under the following legal bases:

• Contractual necessity: Processing is necessary to perform our services under the agreement with you
• Legitimate interests: Processing is necessary for our legitimate business interests in providing card recovery services, provided these interests do not override your fundamental rights
• Legal obligation: Processing is required to comply with Australian financial services regulations and legal requirements
• Consent: Where we have obtained your explicit consent for specific processing activities

Your Rights Under GDPR

If you are located in the EU or EEA, you have the following rights:

• Right of access: Request copies of your personal data
• Right to rectification: Request correction of inaccurate personal data
• Right to erasure: Request deletion of your personal data in certain circumstances
• Right to restrict processing: Request limitation of how we process your data
• Right to data portability: Request transfer of your data to another service provider
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making: Request human review of automated decisions that significantly affect you

Data Transfers

Personal data submitted through our website is processed and stored in Australia. If you are located in the EU or EEA, this constitutes a transfer of your data outside the European Economic Area. We ensure such transfers comply with applicable data protection requirements.

Data Protection Officer

For GDPR-related inquiries or to exercise your rights, you may contact our data protection representative:

Email: [email protected]
Address: Level 12, 485 La Trobe Street, Melbourne VIC 3000, Australia

Supervisory Authority

If you are located in the EU or EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Service request data: Duration of service provision plus seven years
• Communications records: Seven years following last contact
• Website analytics data: 26 months from collection
• Cookie data: As specified in our Cookies Policy

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a minor without appropriate parental consent, we will delete it promptly.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website and, where appropriate, by email to affected individuals.