GDPR Compliance
Last updated: June 16, 2026
Our Commitment to Data Protection
While merry-meadow operates primarily in Australia, we recognize that some of our participants may be residents of the European Union. We are committed to protecting personal data in accordance with the General Data Protection Regulation (GDPR) principles.
Lawful Basis for Processing
We process your personal data under the following lawful bases:
- Contract performance: to deliver the culinary services you have booked
- Legitimate interest: to communicate about programs and improve our educational offerings
- Consent: for any marketing communications you have opted into
Your GDPR Rights
If you are an EU resident, you have the following rights regarding your personal data:
Right to Access
You may request a copy of all personal information we hold about you. We will provide this in a structured, commonly used format within 30 days of your request.
Right to Rectification
You may request correction of any inaccurate or incomplete personal data we maintain about you.
Right to Erasure
You may request deletion of your personal data when it is no longer necessary for the purposes we collected it, or if you withdraw consent. This right is subject to our legal obligations to retain certain records.
Right to Restrict Processing
You may request that we limit how we use your data in certain circumstances, such as while we verify data accuracy or assess legitimate grounds for processing.
Right to Data Portability
You may request transfer of your data to another service provider in a machine-readable format, where technically feasible.
Right to Object
You may object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.
Data Transfers
Your personal information is stored on servers located in Australia. If you are located in the EU, this constitutes a transfer of data outside the European Economic Area. We ensure appropriate safeguards are in place for such transfers.
Automated Decision Making
We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.
Data Breach Notification
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by GDPR.
Exercising Your Rights
To exercise any of these rights, contact us at [email protected] with your specific request. We will respond within 30 days and may request verification of your identity before processing certain requests.
Supervisory Authority
If you are unsatisfied with how we handle your personal data, you have the right to lodge a complaint with your local data protection supervisory authority in the EU.