GDPR Compliance Information

Last Updated: September 2, 2026

Introduction

While elm-stag is based in Australia, we respect the privacy rights of European Union residents under the General Data Protection Regulation (GDPR). This page explains how we handle personal data of EU residents.

Legal Basis for Processing

We process personal data under the following legal bases:

• Contractual Necessity: Processing booking information to fulfill tour service agreements
• Legitimate Interest: Improving services and communicating about bookings
• Consent: For marketing communications and non-essential cookies

Data Controller

elm-stag is the data controller for personal information collected through our website and services.

Contact details:
Email: info@elm-stag.com
Address: 247 Collins Street, Melbourne VIC 3000, Australia

Your GDPR Rights

If you are an EU resident, you have the following rights:

Right to Access

You can request copies of your personal data we hold.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

You can request deletion of your personal data under certain circumstances.

Right to Restrict Processing

You can request limitation on how we process your data.

Right to Data Portability

You can request your data in a structured, commonly used format for transfer to another service.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects.

How to Exercise Your Rights

To exercise any of these rights, contact us at info@elm-stag.com with:

• Your full name and email address
• Description of your request
• Proof of identity (to prevent unauthorized access)

We will respond to verified requests within 30 days.

Data Retention

We retain personal data only as long as necessary for the purposes stated in our Privacy Policy:

• Booking information: Seven years for business record requirements
• Marketing consent records: Until consent is withdrawn
• Website analytics data: Aggregated and anonymized after 26 months

International Data Transfers

Your personal data is stored and processed in Australia. Australia has been recognized by the European Commission as providing adequate data protection.

If data is transferred to other jurisdictions, we ensure appropriate safeguards are in place through:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions for the destination country
• Other legally approved transfer mechanisms

Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction.

Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected individuals and relevant supervisory authorities as required by law, typically within 72 hours of becoming aware of the breach.

Children's Data

We do not knowingly collect or process personal data of individuals under 16 years of age without parental consent.

Marketing Communications

We will only send marketing communications with your explicit consent. You can withdraw consent at any time by:

• Clicking unsubscribe links in emails
• Contacting us directly at info@elm-stag.com

Right to Lodge a Complaint

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with:

• Your local EU supervisory authority
• The Australian Information Commissioner (as we are based in Australia)

Updates to This Information

We may update this GDPR compliance information to reflect changes in our practices or legal requirements. Updates will be posted with a revised date.

Contact for GDPR Matters

For questions or concerns about GDPR compliance or to exercise your rights, contact:

Email: info@elm-stag.com
Subject line: GDPR Data Request
Address: 247 Collins Street, Melbourne VIC 3000, Australia