GDPR Compliance Statement

Last updated: September 10, 2026

Introduction

Although birch-crane is based in Australia and primarily serves Australian clients, we recognize that some users may be located in the European Union or European Economic Area. This statement outlines our commitment to compliance with the General Data Protection Regulation (GDPR) for those individuals.

Legal Basis for Processing

We process personal data under the following legal bases:

  • Contractual necessity: Processing is necessary to fulfill our service agreements with you
  • Legitimate interests: Processing is necessary for our legitimate business interests in providing historical research services, provided these interests do not override your fundamental rights
  • Consent: Where you have provided explicit consent for specific processing activities
  • Legal obligation: Where processing is required to comply with legal requirements

Data Subject Rights

If you are located in the EU/EEA, you have the following rights regarding your personal data:

  • Right to access: You can request copies of your personal data
  • Right to rectification: You can request correction of inaccurate or incomplete data
  • Right to erasure: You can request deletion of your personal data under certain circumstances
  • Right to restrict processing: You can request that we limit how we use your data
  • Right to data portability: You can request transfer of your data to another service provider
  • Right to object: You can object to certain types of processing, including processing based on legitimate interests
  • Right to withdraw consent: Where processing is based on consent, you can withdraw that consent at any time

Data Processing Activities

What data we collect

We collect the following categories of personal data:

  • Identity data: name, contact details
  • Contact data: email address, postal address
  • Service data: research requests, service selections, project details
  • Technical data: IP address, browser type, device information
  • Usage data: website navigation patterns, page interactions

How we use your data

We use personal data for the following purposes:

  • Providing historical research and heritage services
  • Communicating with you about your projects and inquiries
  • Improving our website and services
  • Complying with legal obligations
  • Protecting our rights and interests

Data Sharing and Transfers

We do not sell or rent personal data to third parties. We may share data with:

  • Research collaborators working on your specific project (with your consent)
  • Archival institutions necessary for fulfilling research requests
  • Legal authorities when required by law

If we transfer personal data outside the EU/EEA, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission.

Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected:

  • Active project data: Duration of the project plus 7 years for legal and archival purposes
  • Marketing consent: Until consent is withdrawn
  • Website usage data: Typically 12-24 months

After the retention period, personal data is securely deleted or anonymized.

Security Measures

We implement appropriate technical and organizational measures to protect personal data, including:

  • Encryption of data in transit and at rest
  • Access controls limiting who can view personal data
  • Regular security assessments and updates
  • Staff training on data protection practices

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects individuals.

Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate parental consent, we will take steps to delete that information.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at:

Email: privacy at birch-crane.com
Address: 127 Collins Street, Melbourne VIC 3000, Australia

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of any such extension.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with your local supervisory authority in the EU/EEA.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website or directly to affected individuals where appropriate.

Contact Information

For questions about GDPR compliance or to exercise your rights, contact:

Data Protection Contact: privacy at birch-crane.com
Address: 127 Collins Street, Melbourne VIC 3000, Australia