GDPR Compliance

Last Updated: July 29, 2026

Introduction

While sprout-path is based in Australia, we respect the privacy rights of all individuals, including those in the European Union. This page outlines how we comply with the General Data Protection Regulation (GDPR) principles.

Legal Basis for Processing

We process personal data under the following legal bases:

Contract Performance: To provide language learning services you've enrolled in
Consent: For marketing communications and optional services
Legitimate Interest: To improve our services and prevent fraud
Legal Obligation: To comply with applicable laws and regulations

Your GDPR Rights

If you are located in the European Economic Area, you have the following rights:

Right to Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure: Request deletion of your personal data
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in a structured format
Right to Object: Object to certain types of processing
Right to Withdraw Consent: Withdraw consent at any time

Data Transfers

Your personal data may be transferred to and processed in Australia. We ensure appropriate safeguards are in place to protect your data in accordance with GDPR standards.

Data Protection Officer

For GDPR-related inquiries, you can contact us at [email protected] with "GDPR Request" in the subject line.

Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes outlined in our Privacy Policy or as required by law. Typical retention periods include:

Active student records: Duration of enrollment plus 3 years
Financial records: 7 years from transaction date
Marketing consent: Until consent is withdrawn

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

Data Breach Notification

In the event of a data breach that may result in a risk to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours of becoming aware of the breach.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within 30 days.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority in the EU member state of your residence, place of work, or where an alleged infringement occurred.