Lucid Geyser

Overview

While our primary operations are based in New Zealand, we recognize the rights of individuals in the European Economic Area under the General Data Protection Regulation. This page outlines how we comply with GDPR principles.

Legal Basis for Processing

We process personal data based on the following legal grounds:

Contract performance: Processing necessary to fulfill delivery services you have requested
Consent: Where you have explicitly agreed to specific processing activities
Legitimate interests: For business operations, fraud prevention, and service improvement
Legal obligations: When required by applicable laws

Your GDPR Rights

Under GDPR, you have the following rights:

Right to access: Request a copy of personal data we hold about you
Right to rectification: Correct inaccurate or incomplete data
Right to erasure: Request deletion of your personal data
Right to restrict processing: Limit how we use your data
Right to data portability: Receive your data in a structured format
Right to object: Object to certain types of processing
Right to withdraw consent: Withdraw previously given consent at any time

Data Protection Officer

For GDPR-related inquiries, you may contact our data protection representative at [email protected] with the subject line "GDPR Inquiry".

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in our privacy policy or as required by law. Order information is typically retained for seven years for accounting and legal compliance purposes.

International Data Transfers

Personal data collected through this website is stored and processed in New Zealand. We implement appropriate safeguards to protect data transferred outside the European Economic Area.

Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you and relevant supervisory authorities within 72 hours as required by GDPR.

Exercising Your Rights

To exercise any of your GDPR rights, contact us at [email protected]. We will respond to requests within one month. If your request is complex, we may extend this period by two additional months and will inform you of the extension.

Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal data violates GDPR.