Privacy Policy & Data Breach Response

1. Who we are

The Eden Residence (“we”, “us”, “our”) is a Melbourne-based short-stay property management business. We are the entity responsible for the personal information collected through theedenresidence.com.au. We are committed to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What personal information we collect

We only collect information you choose to give us, and only what we need to help you:

• Owner enquiries (free-estimate form): your name, property address, suburb, property type, email address and phone number.
• Guest booking requests (Book a Stay): your name, email address, and the property, dates and guest count for the stay you request.
• Technical information your browser sends automatically (e.g. IP address, device and browser type) when you visit — used for security and to keep the site running.

We do not collect payment card details on this website. Where a booking or an ebook purchase proceeds to payment, that is handled by our payment providers (Guesty for stays, Gumroad for ebooks) on their own secure, PCI-compliant systems (see section 4).

3. How we use your information

• To prepare and send you a rental estimate or respond to your enquiry.
• To arrange, confirm and manage a stay you request.
• To contact you about your enquiry or booking.
• To protect, secure and maintain the website.

We do not sell your personal information, and we do not use it for unrelated marketing without your consent.

4. Who we share it with

We share information only with the service providers that make this site work, and only as far as needed:

• Formspree — securely delivers form submissions to our team inbox.
• Guesty — our booking engine and property management system; where a booking proceeds, Guesty processes availability, payment and guest data on its own encrypted, access-controlled, PCI-compliant platform, and becomes the system of record for that booking.
• Netlify — hosts the website and serves it over encrypted HTTPS.
• Gumroad — our ebook checkout and fulfilment provider; when you buy a guide, Gumroad securely processes your payment and card details on its own PCI-compliant platform and delivers your download. We never see or store your card number.
• Google Fonts — delivers the site’s typefaces.

These providers may store data on servers outside Australia. We choose reputable providers with their own security and privacy safeguards.

5. How we store and protect it

We take reasonable technical and organisational steps to protect your information from misuse, loss, unauthorised access, modification and disclosure:

• Encryption in transit. The whole site is served over HTTPS, enforced by HTTP Strict Transport Security (HSTS) so data can’t be sent over an insecure connection.
• Hardened HTTP security headers. A Content-Security-Policy, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are applied to every response to defend against script injection, clickjacking, MIME-sniffing and referrer leakage.
• Encrypted system of record. Booking and payment data lives in our provider’s encrypted, access-controlled platform (Guesty) — not in your browser. This website itself does not retain payment or address data for bookings.
• Access control. Access to enquiry and booking data is limited to authorised members of the Eden team who need it to do their job.

6. How long we keep it

We keep personal information only as long as we need it for the purpose it was collected, or as required by law, and then delete or de-identify it. Any minimal booking details stored temporarily in your own browser (to let you view a demo booking) are automatically cleared after 30 days and are never shared across devices.

7. Your rights

Under the Australian Privacy Principles you can:

• Ask what personal information we hold about you and request access to it.
• Ask us to correct information that is inaccurate or out of date.
• Ask us to delete information we no longer need to hold.
• Withdraw consent or ask us to stop contacting you.

To make a request, contact us using the details in section 10. We’ll respond within a reasonable time and may need to verify your identity first.

8. Data breach response (Notifiable Data Breaches)

We comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. If we become aware of a suspected or actual data breach, we act quickly:

• Contain — immediately limit the breach and secure the affected systems or accounts.
• Assess — investigate what happened, what information was involved and who is affected, and whether the breach is likely to result in serious harm. We aim to complete this assessment within 30 days.
• Notify — if a breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, explaining what happened, what information was involved, and the steps you can take to protect yourself.
• Review — take remedial action and improve our safeguards to prevent recurrence.

If you believe your information may have been compromised, please contact us immediately (section 10) so we can help.

9. Cookies & local storage

This site does not use tracking or advertising cookies. It may store small amounts of data in your browser’s local storage purely to make features work (for example, remembering a demo booking so you can view it). That data stays on your device, is not sent to us, and can be cleared any time from your browser settings.

This policy is provided for transparency and general information. It is not legal advice; please seek professional advice for your specific circumstances.