Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data. These rights are fundamental to data protection and we are committed to facilitating their exercise.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us using the information below. We will respond to your request within one month, though this may be extended by two months for complex requests.

What We Need From You

To process your request efficiently and securely, please provide:

• Clear identification of which right you wish to exercise
• Sufficient information to verify your identity
• Specific details about your request where applicable
• Any relevant account information or reference numbers

Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR:

Processing Purpose	Legal Basis	Description
Service Delivery	Contract Performance	Processing necessary to perform our resume writing services
Payment Processing	Contract Performance	Processing necessary to complete financial transactions
Customer Support	Legitimate Interest	Providing assistance and resolving service issues
Marketing Communications	Consent	Sending promotional materials with your explicit consent
Website Analytics	Legitimate Interest	Improving website functionality and user experience
Legal Compliance	Legal Obligation	Meeting regulatory and legal requirements

Data Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Active Client Data: Duration of service relationship plus 2 years
• Financial Records: 7 years as required by New Zealand tax law
• Marketing Data: Until consent is withdrawn or 3 years of inactivity
• Website Analytics: 26 months maximum
• Support Communications: 3 years for quality and training purposes
• Legal Documentation: As required by applicable law

International Data Transfers

When we transfer your personal data outside the European Economic Area (EEA), we ensure adequate protection through:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules where applicable
• Certification schemes and codes of conduct

Transfer Safeguards

All international transfers include appropriate technical and organizational measures to protect your data, including encryption, access controls, and contractual obligations.

Data Processing Activities

Categories of Personal Data We Process

• Identity Data: Name, title, professional credentials
• Contact Data: Email address, phone number, postal address
• Professional Data: Work history, education, skills, achievements
• Financial Data: Payment information, billing details
• Technical Data: IP address, browser type, device information
• Usage Data: Website interactions, service usage patterns
• Communication Data: Email correspondence, support tickets

Data Sources

We collect personal data from:

• Information you provide directly through forms and communications
• Automated technologies such as cookies and analytics tools
• Third-party payment processors and service providers
• Public sources such as LinkedIn profiles (with your permission)

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities to ensure appropriate safeguards are in place. These assessments consider:

• The nature, scope, context, and purposes of processing
• Risks to the rights and freedoms of data subjects
• Measures to address identified risks
• Consultation with data protection authorities where required

Data Breach Procedures

In the unlikely event of a data breach, we will:

1. Assess the breach within 24 hours of discovery
2. Notify relevant supervisory authorities within 72 hours if required
3. Inform affected individuals without undue delay if high risk is involved
4. Take immediate steps to contain and remedy the breach
5. Document the incident and our response measures

Supervisory Authority Information

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with: