GDPR Policy

Last updated: 12 September 2026.

This policy supplements our Privacy Policy for people located in the United Kingdom or the European Economic Area. Where you access our services from those places, the General Data Protection Regulation (GDPR) and the UK GDPR apply in addition to Australian law. Centre for Neurodivergence [legal entity name and ABN to be confirmed] is the controller of your personal data.

Lawful bases for processing

  • Contract: to create your account, deliver the courses you enrol in and process payments.
  • Legitimate interests: to keep the service secure, prevent fraud, respond to enquiries and understand how the platform is used. We balance these interests against your rights.
  • Consent: to send you news about courses. You can withdraw consent at any time.
  • Legal obligation: to keep financial records and respond to lawful requests.

International transfers

We are based in Australia, and our service providers are located in Australia, the United States and the European Union. Where personal data is transferred outside the UK or EEA we rely on appropriate safeguards, including standard contractual clauses approved by the European Commission and the UK International Data Transfer Addendum.

Your rights under the GDPR

  • The right to be informed about how your data is used.
  • The right of access to the personal data we hold about you.
  • The right to rectification of inaccurate or incomplete data.
  • The right to erasure, where there is no overriding legal reason to keep the data.
  • The right to restrict processing while a dispute about accuracy or use is resolved.
  • The right to data portability, to receive your account data in a common machine-readable format.
  • The right to object to processing based on legitimate interests or to direct marketing.
  • Rights relating to automated decision-making. We do not make decisions about you based solely on automated processing.

We respond to requests within one month. We may ask you to confirm your identity first. There is no charge unless a request is clearly unfounded or excessive.

Complaints

You can complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the data protection authority in the country where you live or work. We would appreciate the chance to resolve your concern first, using the contact details below.

Data retention

Retention periods are set out in our Privacy Policy. Personal data is deleted or anonymised when it is no longer needed for the purpose it was collected.

Contact

Contact: [privacy contact email to be confirmed], or by post to [postal address].