Privacy Policy

Our approach to privacy

We respect your privacy and use personal information for the purposes explained here. We comply with privacy laws that apply to our activities, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles where applicable. This policy does not limit any rights you have under Australian law.

In Victoria, the Privacy and Data Protection Act 2014 (Vic) principally covers the Victorian public sector and certain contracted service providers. Additional Victorian legal or contractual privacy obligations may apply when we perform relevant work. This website policy does not replace any privacy arrangements agreed for a client project.

What we collect

When you send an enquiry, we collect your name, email address, organisation if you choose to provide it, and the contents of your message. We may also keep related correspondence when we respond.

Our servers and service providers may process technical information such as your IP address, browser and device information, request times, pages requested and security events to deliver and protect the website. The form service uses a protected, derived identifier for temporary rate limiting rather than keeping your raw IP address in its rate-limit records.

We collect enquiry details directly from you. Please provide only information relevant to your enquiry and only share another person’s details if you are authorised to do so. Do not send passwords, payment-card details, health information or other sensitive information through this form.

How we use your information

• To respond to enquiries and discuss, quote for or provide the services you request.
• To manage our business correspondence and service relationships.
• To operate the website, prevent spam and misuse, and investigate technical or security issues.
• To meet legal obligations and establish, exercise or defend legal rights.

We do not sell your personal information. Sending an enquiry does not subscribe you to a mailing list. We do not use enquiry details for unrelated marketing without your permission.

Your choices

You can browse the website without giving us your name. You may use a pseudonym where practicable, but we need a working email address to reply to an enquiry. Your organisation is optional. If you do not provide the required form details or complete the security check, the form cannot send your enquiry.

Security checks, cookies and analytics

We use Cloudflare Turnstile to help distinguish people from automated spam. It loads when the contact form comes into view or you interact with it. Cloudflare processes technical signals, including your IP address, browser information and the website origin, to provide and improve its bot protection. Our verification request does not send Cloudflare the contents of your enquiry.

Read the Cloudflare Turnstile Privacy Addendum and Cloudflare Privacy Policy for its handling of these signals.

We do not use advertising trackers or audience analytics on this website. Our own website code does not set cookies or save enquiry details to browser storage. Third-party security features may use browser technologies as described in their policies. Browser settings or extensions that block those features may prevent the form from working.

Who may receive information

Enquiries are delivered through our email relay to our Microsoft 365 business mailbox. Authorised people handling your enquiry, and providers supporting our hosting, email, security and IT services, may process information as needed for those purposes. Cloudflare provides the form’s security check; it is not the delivery service for your message.

We may also disclose information to professional advisers, with your consent, or where disclosure is required or authorised by law. External websites linked from our website have their own privacy practices.

Overseas processing

Cloudflare and Microsoft operate internationally. Personal information may be stored, processed or accessed outside Australia, including in the United States. Other locations depend on the relevant service, its configuration and provider infrastructure; we cannot specify every potential processing location in advance.

Further information is available in Cloudflare’s privacy documents above and the Microsoft Privacy Statement. You can ask us for current information about the providers used for your enquiry. Where applicable law requires safeguards for overseas disclosure, we take reasonable steps to meet those requirements.

Storage, security and retention

We take reasonable steps to protect personal information against misuse, loss and unauthorised access, alteration or disclosure. Measures include encrypted website connections, authenticated and encrypted submission to our email relay, restricted access and form abuse controls. No internet transmission or storage system is completely secure.

The contact application does not maintain an enquiry database or write message contents to its application logs. Messages and related information can remain in email systems, delivery queues, operational logs and backups.

We retain personal information for as long as reasonably needed to respond to your enquiry, manage any resulting business relationship, meet legal record-keeping obligations or resolve disputes. When it is no longer needed, we take reasonable steps to delete or de-identify it, subject to applicable law and backup retention cycles. Retention varies with the type and purpose of the record.

Access, corrections and complaints

To ask a privacy question, request access to or correction of your personal information, ask about deletion, or make a complaint, use our contact form and begin your message with “Privacy request”. Please describe what you need without including unnecessary sensitive information. You can also use an existing BCAT Connect business correspondence channel.

We may need to verify your identity before releasing or changing information. We aim to respond within 30 days. If a request takes longer, or we cannot fulfil it, we will explain why and any available review options. Deletion is subject to legal and legitimate record-keeping requirements.

If you are dissatisfied with our response, you can contact the Office of the Australian Information Commissioner, which can consider complaints within its jurisdiction. For relevant Victorian public-sector or contracted-service matters, the Office of the Victorian Information Commissioner provides information about its jurisdiction and complaint options.

Changes to this policy

We may update this policy as our website, services or legal obligations change. The current version will be available on this page with its last-updated date. You can request a copy through our contact form.