GDPR Compliance

Last Updated: July 2026

Harbor Owl is committed to complying with the General Data Protection Regulation (GDPR) and ensuring that all personal data belonging to individuals in the European Economic Area (EEA) is processed lawfully, fairly, and transparently.

Our Role

For the purposes of the GDPR, Harbor Owl acts as the data controller for personal information collected through our website and services. We determine the purposes and means of processing personal data and are responsible for ensuring compliance with applicable data protection laws.

Legal Basis for Processing

We process personal data under the following legal bases:

• Contractual Necessity: Processing necessary for the performance of a contract, such as providing course services to enrolled students.
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our services and communicating with prospective students, where such interests are not overridden by your rights.
• Consent: Processing based on your explicit consent, such as sending marketing communications.
• Legal Obligation: Processing necessary to comply with legal requirements.

Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this information within one month of receiving your request, unless the request is complex or numerous.

Right to Rectification

You have the right to request that we correct any inaccurate personal data we hold about you without undue delay.

Right to Erasure

You have the right to request that we delete your personal data in certain circumstances, including when the data is no longer necessary for the purpose for which it was collected, or when you withdraw consent.

Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes or where we are relying on legitimate interests as our legal basis.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal effects concerning you. We do not engage in automated decision-making that significantly affects our users.

Data Transfers

When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or transfers to countries with an adequacy decision.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Retention periods are determined based on the nature of the data, legal requirements, and legitimate business needs.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

Exercising Your Rights

To exercise any of your rights under the GDPR, please contact us using the details below. We may need to verify your identity before processing your request. We will respond to all legitimate requests within one month.

Complaints

If you are not satisfied with how we have handled your personal data or your request, you have the right to lodge a complaint with a supervisory authority. For individuals in the EEA, this would be the data protection authority in your country of residence.

Contact Information

For GDPR-related enquiries or to exercise your data protection rights, please contact:

Email: [email protected]
Address: Level 8, 100 George Street, Sydney NSW 2000, Australia