Privacy Policy

1. Information We Collect

1.1 Personal Information

We may collect the following types of personal information:

• Identity information: name, job title, company name
• Contact information: email address, phone number, business address
• Account information: username, password (encrypted), account preferences
• Transaction information: services purchased, payment details (processed by third-party providers)
• Communication records: correspondence with us, feedback, enquiries

1.2 Technical Information

When you use our website, we automatically collect:

• IP address and general location (country/region)
• Browser type and version
• Operating system
• Pages visited and time spent on our website
• Referring website or source

1.3 Sensitive Information

We generally do not collect sensitive information (as defined under the Privacy Act) unless it is necessary for providing our cybersecurity services and you have provided explicit consent. If collected, sensitive information is handled with additional safeguards.

2. How We Collect Information

We collect personal information through:

• Direct interactions: when you contact us, request a demo, subscribe to newsletters, or use our services
• Website usage: through cookies and analytics tools (see Section 7)
• Third parties: from business partners, referrals, or publicly available sources
• Service delivery: information provided during cybersecurity assessments or consultations

Where practicable, we will collect personal information directly from you. If we collect information from third parties, we will take reasonable steps to ensure you are aware of this collection.

3. How We Use Your Information

We use your personal information for the following purposes:

• Service delivery: providing cybersecurity services, assessments, and products
• Communication: responding to enquiries, sending service updates, and providing support
• Marketing: sending newsletters and information about our services (with your consent)
• Improvement: analysing website usage to improve our services and user experience
• Legal compliance: meeting our legal and regulatory obligations
• Security: protecting against fraud, unauthorised access, and other security threats

We will only use your personal information for the purpose for which it was collected, or for a related purpose you would reasonably expect, unless you have consented to another use or it is required or authorised by law.

4. Disclosure of Personal Information

We may disclose your personal information to:

• Service providers: IT providers, cloud hosting services, payment processors, and analytics providers who assist in delivering our services
• Professional advisers: lawyers, accountants, and auditors as necessary
• Regulatory bodies: government agencies or regulators where required by law
• Business transfers: in connection with a merger, acquisition, or sale of assets

We require all third parties to respect the security of your personal information and to treat it in accordance with the law. We do not sell your personal information to third parties.

5. Cross-Border Disclosure

Some of our service providers may be located overseas, including in the United States. Before disclosing personal information to an overseas recipient, we will take reasonable steps to ensure that the recipient:

• Complies with the APPs or a substantially similar privacy regime
• Is bound by contractual obligations to protect your information
• Is subject to a law or binding scheme substantially similar to the APPs

By providing your personal information, you consent to this cross-border disclosure where necessary for service delivery, provided we have taken the above steps.

6. Data Security

As a cybersecurity company, we take the protection of your personal information seriously. We implement appropriate technical and organisational measures including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and monitoring
• Staff training on privacy and security obligations
• Incident response procedures

While we take reasonable precautions, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

7. Cookies and Analytics

Our website uses cookies and similar technologies to:

• Enable essential website functionality
• Remember your preferences
• Analyse website usage through Google Analytics
• Improve our services and user experience

Google Analytics: We use Google Analytics to understand how visitors interact with our website. Google Analytics collects information such as pages visited, time on site, and general location. This information is aggregated and anonymised. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our website.

8. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. The retention period depends on the nature of the information and the purpose of collection. When personal information is no longer required, we will securely destroy or de-identify it.

9. Your Rights Under the Privacy Act

Under the Australian Privacy Principles, you have the right to:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate, incomplete, or out-of-date information
• Complaints: Lodge a complaint about our handling of your personal information
• Anonymity: Deal with us anonymously or using a pseudonym where practicable
• Opt-out: Opt out of receiving marketing communications at any time

To exercise these rights, please contact us using the details in Section 12. We will respond to your request within a reasonable timeframe (generally within 30 days). We may need to verify your identity before processing your request.

10. Notifiable Data Breaches

In accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act, if we experience an eligible data breach that is likely to result in serious harm to individuals, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post any changes on this page and update the “Last updated” date. We encourage you to review this policy periodically. Continued use of our Services after any changes constitutes acceptance of the updated policy.

12. Contact Us and Complaints

If you have any questions about this Privacy Policy, wish to exercise your rights, or want to make a complaint about how we have handled your personal information, please contact us:

We will investigate any complaint and respond to you within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):