GDPR Compliance

Last updated: November 3, 2026

While Node-frost operates primarily within Australia, we recognize that some of our clients and website visitors may be located within the European Union. This page outlines our commitment to compliance with the General Data Protection Regulation.

Legal Basis for Processing

When we process personal data of individuals in the EU, we do so based on one or more of the following legal bases:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary for a contract we have with you
• Legal obligation: Processing is necessary for us to comply with the law
• Legitimate interests: Processing is necessary for our legitimate interests or those of a third party

Your Rights Under GDPR

If you are an EU resident, you have the following rights regarding your personal data:

• Right of access: You can request copies of your personal data
• Right to rectification: You can request correction of inaccurate or incomplete data
• Right to erasure: You can request deletion of your personal data
• Right to restrict processing: You can request limitation of how we use your data
• Right to data portability: You can request transfer of your data to another organization
• Right to object: You can object to processing of your personal data
• Rights related to automated decision-making: You have protections against solely automated decision-making

Data Processing Activities

We process personal data for the following purposes:

• Responding to service inquiries and quote requests
• Executing photography service contracts
• Maintaining client relationships and project archives
• Website analytics and improvement
• Compliance with legal and regulatory obligations

Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Inquiry data: Retained for 12 months if no contract is established
• Project data: Retained for 3 years following project completion
• Financial records: Retained for 7 years in accordance with tax regulations
• Marketing communications: Retained until consent is withdrawn

International Data Transfers

As an Australian-based business, personal data of EU residents may be transferred outside the European Economic Area. We ensure appropriate safeguards are in place for such transfers, including:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions recognizing comparable data protection standards
• Explicit consent for specific transfers where applicable

Data Security Measures

We implement technical and organizational measures to protect personal data, including:

• Encryption of data in transit and at rest
• Access controls limiting who can view personal data
• Regular security assessments and updates
• Staff training on data protection principles
• Secure deletion protocols for data no longer required

Data Breach Notification

In the event of a data breach that poses a risk to individuals' rights and freedoms, we will notify affected individuals and relevant supervisory authorities within 72 hours of becoming aware of the breach, in accordance with GDPR requirements.

Third-Party Processing

When we engage third-party service providers who process personal data on our behalf, we ensure they:

• Process data only according to our documented instructions
• Maintain appropriate security measures
• Assist us in meeting our GDPR obligations
• Delete or return personal data after services are completed

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with your request. We will respond within one month of receiving your request.

You also have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.

Contact Information

For questions about our GDPR compliance or to exercise your rights:

Email: [email protected]
Address: 147 Bourke Street, Melbourne VIC 3000, Australia