GDPR Policy.

1. Scope of This Policy

This policy applies where the GDPR applies to personal data processed by Swift Productions.

The GDPR may apply to our activities where we:

• Process personal data in connection with an establishment in the European Economic Area.
• Offer goods or services to individuals located in the European Economic Area.
• Monitor the behaviour of individuals located in the European Economic Area, where that behaviour takes place within the European Economic Area.

This policy may apply to personal data belonging to:

• Website visitors.
• People who submit an enquiry or request a quote.
• Current, former and prospective clients.
• Client employees, representatives and billing contacts.
• Newsletter and marketing subscribers.
• Suppliers, contractors and business contacts.
• People who communicate with us through email, telephone, social media or another platform.

2. Data Controller

Swift Productions is generally the Data Controller for personal data we collect directly through our website, enquiries, client relationships, billing systems and marketing activities.

As a Data Controller, we determine why and how that personal data is processed.

In some circumstances, Swift Productions may act as a Data Processor when we handle personal data on behalf of a client, such as when providing website development, website hosting, digital marketing, analytics, customer database or technical support services.

Where Swift Productions acts as a Data Processor, the client remains responsible for determining the lawful basis and purpose of the processing. The applicable project agreement, service agreement or data processing agreement may contain additional terms.

3. Personal Data We Collect

The personal data we collect depends on how you interact with Swift Productions and which services you use.

Personal data we may collect includes:

Identity and Contact Information

• Your name.
• Your business or organisation name.
• Your job title or role.
• Your email address.
• Your telephone number.
• Your business or postal address.

Account and Client Information

• Account usernames and account identifiers.
• Project details and service requirements.
• Support requests and communication history.
• Website, domain, hosting and platform information.
• Authorised account contacts.
• Client preferences and instructions.

Billing and Transaction Information

• Billing names and addresses.
• Invoice and payment records.
• Transaction details.
• Payment status and account balances.
• Limited payment information supplied by a payment processor.

We do not ordinarily store complete credit card numbers. Card payments are generally processed by third-party payment providers.

Website and Technical Information

• Internet Protocol addresses.
• Browser and device information.
• Operating system information.
• Referring and exit pages.
• Website activity and page interactions.
• Cookie and analytics identifiers.
• Date, time and approximate location information.
• Website performance, security and error logs.

Marketing Information

• Newsletter subscription details.
• Marketing preferences.
• Campaign interactions.
• Email opens and link clicks, where supported and permitted.
• Advertising and audience identifiers.

Communications

• Emails and enquiry form submissions.
• Support tickets.
• Telephone call notes.
• Social media messages.
• Feedback, reviews and testimonials.
• Documents or files you provide to us.

4. How We Collect Personal Data

We may collect personal data directly from you when you:

• Visit or interact with our website.
• Submit an enquiry or request a quote.
• Purchase or enquire about a service.
• Enter into a contract with Swift Productions.
• Communicate with us by email, telephone, social media or another platform.
• Subscribe to a newsletter or marketing communication.
• Provide access to a website, platform, account or technical system.
• Submit feedback, a review or testimonial.

We may also receive personal data from:

• Your employer, business or authorised representative.
• A client who engages us to provide services.
• Publicly available business directories and websites.
• Analytics and advertising platforms.
• Payment processors.
• Website hosting and infrastructure providers.
• Business partners, contractors or service providers.

5. Why We Process Personal Data

Swift Productions may process personal data to:

• Respond to enquiries and prepare quotes.
• Enter into and perform contracts.
• Provide website, hosting, design, development, SEO, advertising and related services.
• Manage client accounts and projects.
• Provide technical support and training.
• Issue invoices and process payments.
• Maintain accounting, taxation and transaction records.
• Operate, maintain and secure our website and systems.
• Measure website traffic and service performance.
• Improve our website, services and client experience.
• Send operational and service-related communications.
• Send marketing communications where permitted.
• Prevent fraud, misuse, spam and security incidents.
• Establish, exercise or defend legal claims.
• Comply with legal and regulatory obligations.

6. Lawful Bases for Processing

Where the GDPR applies, we will only process personal data where we have a lawful basis to do so.

Contract

We may process personal data where it is necessary to enter into or perform a contract with you.

This may include processing required to:

• Prepare and provide a quote.
• Create and manage a client account.
• Deliver a project or service.
• Provide support.
• Issue an invoice or process a payment.

Consent

We may rely on your consent where you have freely given specific and informed permission for us to process your personal data.

This may apply to:

• Optional marketing communications.
• Non-essential cookies.
• Certain testimonials or promotional uses.
• Other optional processing activities presented to you.

You may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing performed before your consent was withdrawn.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• Operating and improving our business.
• Responding to business enquiries.
• Managing client relationships.
• Maintaining website and network security.
• Preventing fraud and misuse.
• Keeping appropriate business records.
• Understanding the effectiveness of our services and website.
• Promoting relevant business services to existing business contacts where permitted.

Legal Obligation

We may process personal data where necessary to comply with a legal or regulatory obligation, including accounting, taxation, fraud prevention and lawful government requests.

Vital Interests

In limited circumstances, we may process personal data where necessary to protect the vital interests of an individual.

7. Special Category and Sensitive Data

Swift Productions does not ordinarily seek to collect special category personal data.

Special category data may include information about:

• Racial or ethnic origin.
• Political opinions.
• Religious or philosophical beliefs.
• Trade union membership.
• Genetic or biometric identification.
• Health.
• Sex life or sexual orientation.

Please do not provide special category or other sensitive personal data unless it is reasonably necessary for an agreed service and we have an appropriate lawful basis to process it.

If we receive sensitive data that is not required, we may delete or restrict access to it.

8. Personal Data Processed for Clients

Swift Productions may process personal data on behalf of clients while providing services such as:

• Website and eCommerce development.
• Website hosting and maintenance.
• Database migration.
• Analytics and conversion tracking.
• SEO and AI Search Optimisation.
• Google Ads and Meta Ads management.
• Email or website integrations.
• Technical support and troubleshooting.

This data may include information belonging to a client’s customers, users, employees, contractors or subscribers.

Where we act as a Data Processor, we will:

• Process personal data only on documented instructions from the client, unless otherwise required by law.
• Take reasonable steps to ensure authorised personnel maintain confidentiality.
• Apply reasonable technical and organisational security measures.
• Assist the client with data subject requests where reasonably required.
• Assist with relevant security and data breach obligations where reasonably required.
• Use subprocessors where necessary to provide the services.
• Delete or return personal data at the end of the services where required, subject to legal and technical limitations.

Clients are responsible for ensuring that they have a lawful basis to collect and provide personal data to Swift Productions.

9. Service Providers and Third Parties

Swift Productions uses third-party providers to help operate our business and deliver services.

These providers may process personal data on our behalf or independently under their own privacy terms.

Categories of recipients may include:

• Website hosting and cloud infrastructure providers.
• Domain registration providers.
• Website and eCommerce platforms.
• Content delivery and website security providers.
• Analytics and reporting platforms.
• Search engines and advertising platforms.
• Email, messaging and communication providers.
• Customer relationship and project management systems.
• Payment processors and financial institutions.
• Accounting and invoicing providers.
• IT, development and technical contractors.
• Professional advisers, including accountants and legal advisers.
• Government, regulatory and law enforcement authorities where legally required.

We only provide third parties with personal data reasonably necessary for them to perform the relevant service or meet a legal requirement.

Where required, we use contractual or other safeguards intended to protect personal data processed by service providers.

10. International Data Transfers

Swift Productions is based in Australia. Personal data collected from individuals in the European Economic Area may therefore be transferred to and processed in Australia.

Our service providers may also process or store personal data in Australia, the United States, the European Economic Area or other countries.

Where the GDPR requires safeguards for an international transfer, we may rely on:

• An adequacy decision issued by the European Commission.
• European Commission Standard Contractual Clauses.
• Binding corporate rules.
• An approved certification mechanism or code of conduct.
• A lawful exception or derogation permitted by the GDPR.
• Another transfer mechanism recognised under applicable law.

Where appropriate, we may also assess technical, contractual and organisational measures used to protect personal data following an international transfer.

You may contact us for further information about the safeguards relevant to your personal data.

11. Data Retention

Swift Productions retains personal data only for as long as reasonably necessary for the purpose for which it was collected.

When determining an appropriate retention period, we may consider:

• The nature and sensitivity of the personal data.
• The purpose for which the data was collected.
• The length of the client or business relationship.
• Contractual obligations.
• Accounting, taxation and legal requirements.
• Security, fraud prevention and dispute resolution requirements.
• The need to establish, exercise or defend legal claims.
• Technical backup and archival cycles.

Typical retention categories may include:

• Enquiry information: retained for as long as reasonably necessary to respond, follow up and maintain appropriate business records.
• Client and project information: retained during the client relationship and for a reasonable period afterwards.
• Financial and invoice records: retained for the period required under applicable accounting and taxation laws.
• Marketing information: retained until consent is withdrawn, an objection is received or the information is no longer required.
• Technical logs: retained for a limited period appropriate to security, troubleshooting and performance monitoring.
• Backups: retained according to applicable backup and deletion cycles.

When personal data is no longer required, we may delete, anonymise or securely archive it.

12. Your GDPR Rights

Where the GDPR applies, you may have the following rights, subject to applicable conditions and exceptions.

Right of Access

You may request confirmation of whether we process your personal data and request access to that data and certain information about the processing.

Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete personal data.

Right to Erasure

You may request deletion of your personal data in certain circumstances. This right is not absolute and may not apply where processing remains necessary for legal, contractual or other permitted reasons.

Right to Restrict Processing

You may request that we restrict the processing of your personal data in certain circumstances.

Right to Object

You may object to processing based on legitimate interests or the performance of a task carried out in the public interest.

You may object at any time to the processing of your personal data for direct marketing purposes.

Right to Data Portability

Where processing is based on consent or contract and performed by automated means, you may have the right to receive personal data you provided in a structured, commonly used and machine-readable format.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Automated Decision-Making Rights

You may have the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal or similarly significant effects.

Swift Productions does not ordinarily make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

Right to Complain

You may lodge a complaint with a competent European data protection supervisory authority, particularly in the country where you live, work or believe an infringement occurred.

13. Exercising Your Rights

To exercise a GDPR right, contact our Policy Officer at [email protected].

Please include:

• Your full name.
• Your email address.
• Your relationship with Swift Productions.
• The right you wish to exercise.
• Enough information for us to locate the relevant personal data.

We may need to request additional information to verify your identity before responding. This helps prevent personal data from being disclosed to an unauthorised person.

We will respond without undue delay and generally within one month after receiving a valid request.

Where a request is complex or multiple requests are received, the response period may be extended where permitted by the GDPR. We will advise you if an extension is required.

There is generally no fee for exercising your GDPR rights. However, a reasonable fee may be charged, or a request may be refused, where a request is manifestly unfounded or excessive, particularly because it is repetitive.

14. Direct Marketing

Swift Productions may send marketing communications where:

• You have provided consent.
• Marketing is otherwise permitted by applicable law.
• We have a legitimate interest in communicating relevant services to an existing business contact and your rights do not override that interest.

You can opt out of marketing communications at any time by:

• Using the unsubscribe link included in an email.
• Replying to the communication and asking to unsubscribe.
• Contacting our Policy Officer.

Opting out of marketing will not prevent us from sending necessary service, account, invoice, security or project-related communications.

15. Cookies and Tracking Technologies

Our website may use cookies, pixels, tags, local storage and similar technologies.

These technologies may be used to:

• Operate essential website functions.
• Maintain website security.
• Remember preferences.
• Measure website traffic and performance.
• Understand how visitors use our website.
• Measure marketing and advertising activity.
• Deliver more relevant content or advertising.

Where required by law, non-essential cookies will only be used after you have provided consent.

You may manage cookies through our cookie controls, where available, or through your browser settings. Disabling some cookies may affect website functionality.

16. Data Security

Swift Productions takes reasonable technical and organisational measures intended to protect personal data against:

• Unauthorised access.
• Accidental loss.
• Unlawful use or disclosure.
• Alteration or destruction.
• Malware, fraud and other security threats.

Measures may include:

• Access controls and authentication.
• Password management.
• Encryption where appropriate.
• Secure hosting and infrastructure.
• Software updates and security maintenance.
• Logging and monitoring.
• Backups and recovery procedures.
• Confidentiality requirements.
• Limiting access to authorised personnel and providers.

No internet transmission, website or electronic storage system can be guaranteed to be completely secure. We cannot guarantee absolute security.

17. Personal Data Breaches

Swift Productions maintains procedures for identifying, assessing and responding to suspected personal data breaches.

Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority where required by the GDPR.

Where a breach is likely to result in a high risk to affected individuals, we will also notify those individuals where required.

Where Swift Productions processes personal data on behalf of a client, we will notify the client without undue delay after becoming aware of a relevant personal data breach.

Notifications may include:

• The nature of the breach.
• The categories of information affected.
• The likely consequences.
• The measures taken or proposed in response.
• Contact information for further enquiries.

18. Children’s Data

Swift Productions provides business and professional services and does not knowingly target its services to children.

We do not knowingly collect personal data directly from children for marketing or client account purposes.

If you believe that a child has provided personal data to us without appropriate authorisation, please contact our Policy Officer. We will review the matter and take reasonable steps to delete the information where appropriate.

19. European Representative

Swift Productions is established in Australia.

If our processing activities require the appointment of a representative in the European Union or European Economic Area under applicable data protection law, we will appoint an appropriate representative and publish their contact details on this page or otherwise make those details available to affected individuals.

The absence of representative details on this page should not be interpreted as limiting your right to contact Swift Productions or lodge a complaint with an appropriate supervisory authority.

20. Data Protection Officer

Swift Productions has not appointed a formal Data Protection Officer unless required by applicable law or identified in a separate written notice.

Privacy and GDPR enquiries are handled by our Policy Officer.

You may contact the Policy Officer at [email protected].

21. Changes to This GDPR Policy

We may update this GDPR Policy to reflect:

• Changes to our business or services.
• Changes to the personal data we process.
• Changes to our providers or processing systems.
• Changes to applicable laws or regulatory guidance.
• Improvements to our privacy and security practices.

The updated version will be published on this page with a revised update date.

Where a change materially affects how we process personal data, we may provide additional notice where reasonably appropriate or legally required.

22. Contact and GDPR Requests

For questions about this GDPR Policy, to exercise a data protection right or to raise a concern about our handling of personal data, contact our Policy Officer.