GDPR Compliance

Our Commitment to Data Protection

maple cypress respects the privacy of individuals located in the European Economic Area (EEA) and is committed to compliance with the General Data Protection Regulation (GDPR). This page explains how we process personal data in accordance with GDPR requirements and outlines your rights as a data subject.

Data Controller

maple cypress acts as the data controller for personal information collected through our website and services. Our contact details are:

maple cypress
42 Harbour Street
Sydney NSW 2000
Australia

Email: [email protected]

Legal Basis for Processing

We process personal data based on the following legal grounds:

• Contractual necessity: Processing required to perform our tutoring services as agreed with you
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving our services and maintaining security, where such interests are not overridden by your rights
• Consent: Where you have given explicit consent for specific processing activities, such as receiving marketing communications
• Legal obligation: Processing required to comply with applicable laws

Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you
• Right to rectification: You may request correction of inaccurate or incomplete data
• Right to erasure: You may request deletion of your personal data in certain circumstances
• Right to restrict processing: You may request that we limit how we use your data
• Right to data portability: You may request your data in a structured, machine-readable format
• Right to object: You may object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making: You have rights concerning automated processing, including profiling

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, as required by GDPR. In complex cases, we may extend this period by up to two additional months, in which case we will inform you of the extension and the reasons for it.

We may need to verify your identity before processing your request. If your request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on it.

International Data Transfers

As we are based in Australia, personal data collected from individuals in the EEA may be transferred to and processed in Australia. Australia is not subject to an adequacy decision by the European Commission. We ensure appropriate safeguards are in place to protect your data, including standard contractual clauses approved by the European Commission where applicable.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. The retention period depends on the nature of the data and the purposes for processing.

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including protection against unauthorised or unlawful processing and accidental loss, destruction, or damage.

Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, as required by GDPR Article 34.

Complaints

If you believe that our processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority in the EU member state where you reside, work, or where the alleged infringement occurred.

Updates to This Information

We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated date.

Last updated: June 2026