GDPR Compliance Statement

Last Updated: November 13, 2026

1. Our Commitment

While Stuberipra primarily operates in Australia, we recognize that the General Data Protection Regulation (GDPR) applies to European Union residents whose data we may process. We are committed to protecting the personal data of all individuals, regardless of location.

2. Legal Basis for Processing

We process personal data under the following legal bases:

• Contractual necessity: To provide payment processing services you have requested
• Legitimate interests: To improve our services, prevent fraud, and maintain system security
• Legal obligation: To comply with financial regulations and legal requirements
• Consent: For marketing communications and optional data processing activities

3. Data Subject Rights

If you are an EU resident, you have the following rights:

• Right to access: Request copies of your personal data
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your data in certain circumstances
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Request transfer of your data to another service
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw previously given consent at any time

4. Data Processing Activities

We process the following categories of personal data:

• Identity data (name, business name)
• Contact data (email address, business address)
• Transaction data (payment records, amounts, dates)
• Technical data (IP addresses, browser information, device data)
• Usage data (how you interact with our services)

5. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Standard retention periods include:

• Transaction records: 7 years (regulatory requirement)
• Customer account data: Duration of relationship plus 2 years
• Marketing consent records: Until consent is withdrawn
• Website analytics: 26 months

6. International Data Transfers

When we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions for countries with equivalent data protection laws
• Binding corporate rules for intra-group transfers

7. Data Security

We implement technical and organizational measures to protect personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security audits and penetration testing
• Employee training on data protection
• Incident response procedures

8. Data Protection Officer

For GDPR-related inquiries, you may contact our Data Protection Officer at:

Email: [email protected]
Address: Level 14, 207 Kent Street, Sydney NSW 2000, Australia

9. Supervisory Authority

If you are an EU resident, you have the right to lodge a complaint with your local supervisory authority. A list of EU data protection authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en

10. Automated Decision Making

We use automated fraud detection systems to assess transaction risk. These systems may flag transactions for manual review but do not make final decisions without human oversight. You have the right to request human review of automated decisions that significantly affect you.

11. Third-Party Processors

We work with third-party service providers who process data on our behalf. All processors are contractually bound to GDPR requirements and are selected based on their data protection capabilities.

12. Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month, though complex requests may require up to three months with notification of the extension.