Data Protection

Last updated: June 2026

Data Controller

Tundra-Mink operates as the data controller for personal information collected through this website and in connection with our vehicle hire services. We are responsible for deciding how we hold and use personal information about you.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract Performance: Processing necessary for the performance of a contract with you, including vehicle hire agreements and booking management.
• Legal Obligation: Processing necessary for compliance with legal obligations, including record-keeping requirements and regulatory compliance.
• Legitimate Interests: Processing necessary for our legitimate interests, including improving our services, fraud prevention, and business operations.
• Consent: Processing based on your explicit consent, which you may withdraw at any time.

Categories of Personal Data

We may process the following categories of personal data:

• Identity Data: Name, title, date of birth, driver's licence details
• Contact Data: Email address, postal address
• Financial Data: Payment card details, billing information
• Transaction Data: Booking history, service records, payment history
• Technical Data: IP address, browser type, device information, website usage data
• Communications Data: Correspondence and enquiries with our team

Your Data Protection Rights

Under applicable data protection legislation, you have the following rights:

Right of Access

You have the right to request a copy of the personal information we hold about you. We will provide this information within 30 days of receiving a valid request.

Right to Rectification

You have the right to request correction of any inaccurate or incomplete personal information we hold about you.

Right to Erasure

You have the right to request deletion of your personal information in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

Right to Restrict Processing

You have the right to request restriction of processing of your personal information in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal information based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning you.

International Data Transfers

We primarily store and process data within Australia. Where data is transferred internationally, we ensure appropriate safeguards are in place to protect your personal information in accordance with applicable data protection laws.

Data Retention Periods

We retain personal data for the following periods:

• Booking and transaction records: 7 years (taxation requirements)
• Driver verification documents: Duration of business relationship plus 3 years
• Marketing communications: Until consent is withdrawn
• Website analytics data: 26 months

Data Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Access controls and authentication measures
• Regular security assessments and updates
• Staff training on data protection
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay. Where required, we will also notify affected individuals directly.

Exercising Your Rights

To exercise any of your data protection rights, please contact us at:

Email: [email protected]

Address: Level 12, 345 Queen Street, Brisbane QLD 4000, Australia

We will respond to your request within 30 days. There is no fee for making a request, although we may charge a reasonable fee for repetitive or manifestly unfounded requests.

Complaints

If you are not satisfied with our response to your data protection concerns, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Website: www.oaic.gov.au