Last Updated: October 2026
The General Data Protection Regulation (GDPR) is a European Union regulation that governs the processing of personal data of individuals within the EU and EEA. Although Moss-echo is an Australian company, we are committed to protecting the privacy rights of all individuals, including those covered by the GDPR.
This page provides additional information for EU and EEA residents about how we handle personal data in compliance with GDPR requirements.
For the purposes of the GDPR, Moss-echo acts as a data controller for personal data collected through this website and our services. Our contact details are:
Moss-echo
Level 14, 201 Elizabeth Street
Sydney NSW 2000
Australia
Email: [email protected]
We process personal data under the following legal bases:
If you are a resident of the EU or EEA, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you and information about how we process it.
You have the right to request correction of inaccurate personal data and completion of incomplete personal data.
In certain circumstances, you have the right to request deletion of your personal data. This right is not absolute and may be subject to legal exceptions.
You have the right to request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
You have the right to receive personal data you provided to us in a structured, commonly used, machine-readable format and to transmit that data to another controller.
You have the right to object to processing of your personal data for direct marketing purposes and, in certain circumstances, to processing based on legitimate interests.
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, unless certain exceptions apply.
To exercise any of these rights, please contact us using the details provided above. We will respond to your request within one month. In complex cases or where we receive multiple requests, we may extend this period by up to two additional months, in which case we will notify you.
We may ask you to verify your identity before processing your request. We will not charge a fee for handling your request unless it is manifestly unfounded or excessive.
As an Australian company, personal data collected from EU and EEA residents may be transferred to and processed in Australia. When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, which may include:
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. For recruitment services, we typically retain candidate data for seven years following the last interaction. You may request earlier deletion subject to any legal retention obligations.
If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.
We may update this GDPR information page periodically. Any changes will be posted on this page with an updated revision date.