Our commitment to data protection for European visitors
Last Updated: September 2026
grove-puma respects the privacy rights of all individuals, including those protected under the General Data Protection Regulation (GDPR). This page outlines how we comply with GDPR requirements for visitors from the European Economic Area (EEA) and the United Kingdom.
When we collect and process your personal data, grove-puma acts as the data controller. This means we determine the purposes and means of processing your personal information and are responsible for ensuring such processing complies with applicable data protection laws.
Under GDPR, we must have a valid legal basis for processing your personal data. We rely on the following bases:
Where you have given clear consent for us to process your personal data for specific purposes, such as receiving marketing communications or using non-essential cookies.
Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
Where processing is necessary for us to comply with legal requirements, such as financial regulations or tax obligations.
Where processing is necessary for our legitimate interests or those of a third party, provided those interests do not override your fundamental rights. Our legitimate interests include operating and improving our website and services.
If you are located in the EEA or UK, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you, along with information about how we process it.
You have the right to request correction of inaccurate or incomplete personal data we hold about you.
You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
You have the right to request that we limit the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
To exercise any of these rights, please contact us using the details provided below. We will respond to your request within one month of receiving it. In some cases, we may need to extend this period by up to two months, in which case we will inform you.
We may request specific information from you to help us confirm your identity and ensure your right to access the information or exercise other rights. This is a security measure to ensure personal data is not disclosed to anyone who has no right to receive it.
As grove-puma is based in Australia, personal data collected from EEA or UK visitors may be transferred to and processed in Australia. Australia has been recognised by the European Commission as providing an adequate level of data protection.
Where we engage third-party service providers who may access your data from countries without an adequacy decision, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. When determining retention periods, we consider the amount, nature, and sensitivity of the data, potential risks from unauthorised use or disclosure, and applicable legal requirements.
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These measures include:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.
If you believe that our processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority. For EEA residents, this is typically the data protection authority in your country of residence. For UK residents, you may contact the Information Commissioner's Office.
For questions about GDPR compliance or to exercise your data protection rights, please contact:
Email: [email protected]
Address: Level 12, 45 Collins Street, Melbourne VIC 3000, Australia
We may update this GDPR compliance notice from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this notice periodically.