GDPR Compliance Statement

Our Commitment to Data Protection

While mist-wave operates primarily within Australia, we recognize that some of our clients may reside in the European Union or European Economic Area. We commit to handling personal data in accordance with the General Data Protection Regulation (GDPR) principles for all clients, regardless of location.

Legal Basis for Processing

We process personal data under the following legal bases:

• Contractual Necessity: Processing required to perform our advisory services under engagement agreements
• Legitimate Interest: Processing necessary for our business operations, including consultation scheduling and market opportunity communication
• Consent: Processing based on explicit consent you provide when submitting inquiries or subscribing to communications
• Legal Obligation: Processing required to comply with Australian financial services regulations and professional practice standards

Data Subject Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of Access: Request copies of your personal data we hold
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data under certain circumstances
• Right to Restrict Processing: Request limitation on how we use your data
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Rights Related to Automated Decision-Making: Not be subject to decisions based solely on automated processing

To exercise any of these rights, contact us at [email protected]. We will respond within one month of receiving your request.

Data Transfers

Your personal data is primarily stored on servers located in Australia. When we engage service providers who may access your data, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the European Commission where applicable.

Data Protection Officer

For GDPR-related inquiries or to exercise your data subject rights, you may contact our data protection representative at [email protected]. We will coordinate with appropriate personnel to address your concerns.

Supervisory Authority

If you believe we have not adequately addressed your concerns regarding data processing, you have the right to lodge a complaint with your local data protection supervisory authority in the EU or EEA.

Data Retention Periods

We retain personal data for the following periods:

• Inquiry submissions: Three years from last contact
• Client engagement records: Seven years following service completion
• Marketing communications: Until you withdraw consent
• Website analytics: Anonymized after 26 months

Retention periods reflect legal obligations under Australian professional practice standards and reasonable business needs for dispute resolution and service quality improvement.

Security Measures

We implement technical and organizational measures to ensure appropriate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage. These measures include encrypted data transmission, access controls, regular security assessments, and staff training on data protection principles.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website with an updated effective date.

Contact Information

For questions regarding GDPR compliance or to exercise your data subject rights:

Email: [email protected]
Address: mist-wave, Level 14, Aurora Place, 88 Phillip Street, Sydney NSW 2000, Australia