Privacy Policy (Australia)

This Privacy Policy explains how we collect, use, disclose and protect personal information when you use our services. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy is intended for Australian users and customers.

1. Scope & who must comply

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). This policy covers our software‑as‑a‑service platform, websites, support channels and related services.

2. Information we collect

• Account & billing: name, business name, role/title, email, phone, business address, login ID, billing address, payment method tokens (we do not store full card numbers).
• Service & telemetry data: IP addresses, device/browser details, event logs, authentication events, scan metadata and vulnerability finding identifiers associated with your environment.
• Support interactions: content of tickets, chat or email communications, attachments you provide.
• Marketing preferences: newsletter subscription status and unsubscribe choices, and, where you told us in person that you would like our newsletter, a note of when and where you said so.
• Office IT Security Check responses: if you complete our free Office IT Security Check, your answers are scored in your browser and are not sent to us at all unless you choose to have the result emailed to you. If you do, we receive your answers along with your name and email so we can prepare for a conversation about your result. We do not share these responses with anyone else, and you can ask us to delete them at any time.
• Microsoft 365 information: if you connect your Microsoft 365 to our portal, we read its security configuration (Secure Score and security settings, user and licence counts, multi-factor authentication figures), not your email or files. If you engage our Microsoft 365 Managed Security Service, our staff administer your Microsoft 365 with access you approve, and may see personal information held there (for example staff names, email addresses and account details) while doing the work you have asked for.
• Partner-delivered services: if you engage penetration testing, dark web monitoring, or social engineering assessment and training, our partner handles details of the systems in scope, any leaked credential records found for your domains, and staff names and email addresses used in phishing simulations.
• Sensitive information: we do not intentionally collect sensitive information. If sensitive data appears incidentally within datasets you provide for testing, we apply heightened safeguards and delete or de‑identify it as soon as practicable.

We collect information directly from you (sign‑up, orders, support) and automatically via our services (logs and security telemetry). We collect only what is reasonably necessary for our functions or activities.

3. How we use personal information

• To provide, operate and improve our services, including account provisioning, authentication, scanning and reporting.
• To bill for services and manage accounts, including via PCI‑compliant payment processors.
• To secure our platform (fraud prevention, monitoring, incident response) consistent with APP 11.
• To provide support and resolve issues.
• To send service and transactional communications (not marketing).

We may use de‑identified and aggregated information to improve our services and produce insights. De‑identified data is not personal information.

4. Anonymity and pseudonymity (APP 2)

Where practicable (e.g., browsing our website or downloading resources), you may interact anonymously or use a pseudonym. For subscriptions, billing and security, a verified identity is generally required.

5. Disclosures to third parties and overseas recipients (APP 6 & APP 8)

We may disclose personal information to:

• Cloud infrastructure, hosting and security providers (primary hosting region: Australia).
• Payment processors (tokenised payments).
• Our delivery partner, for penetration testing, dark web monitoring, and social engineering assessment and training, where you engage those services.
• Microsoft, to manage delegated admin access to your Microsoft 365 where you approve it.
• Professional advisers (legal, accounting) under confidentiality.
• Regulators or law enforcement when required or authorised by law.

Some of these recipients are outside Australia. It is likely that personal information will be disclosed to recipients in the United States (payments, transactional email, website analytics, and the AI service that writes parts of our reports) and, for partner-delivered services, in South Africa, where the Protection of Personal Information Act 2013 (POPIA) also applies. Content delivery networks may process request data in other countries where they operate. Our Sub-Processor List names each provider, what it handles and where.

If we disclose personal information to organisations outside Australia, we will take reasonable steps to ensure the recipient will not breach the APPs and we remain accountable for their handling unless an exception applies (APP 8 / s16C). Our standard approach includes data protection addenda, audit rights and technical/organisational measures. Our default hosting region is Australia.

6. Data security (APP 11)

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Measures include:

• Encryption in transit and at rest
• Least‑privilege access controls and multi‑factor authentication
• Logging and monitoring of access to customer data
• Secure software development lifecycle and vulnerability management
• Vendor and sub‑processor due diligence
• Staff privacy and security training
• Tested incident response and business continuity

We only collect strictly necessary telemetry required to operate and secure the service. We do not use product analytics or tracking for behavioural profiling.

7. Cookies and website analytics

We use cookies and similar technologies on our website to help us understand how visitors use it and to improve the browsing experience. Tools we use include Google Analytics for website analytics and Cloudflare for security and performance. Non-essential cookies are only set with your consent via our cookie banner, and you can change your preferences at any time using the cookie settings link in our footer. For full details, see our Cookie Policy.

8. Direct marketing and electronic communications

We send our newsletter and other marketing emails only to:

• people who subscribe through our newsletter sign‑up form;
• people who tick the box to receive our marketing emails when they create a portal account;
• people who tell us, for example in person at an event, that they would like to receive it, which we record; and
• people we have an ongoing business relationship with, where the email relates to that relationship.

Every message identifies Biz Secure Online, includes our contact details and has a working unsubscribe link. Unsubscribing takes effect promptly, and in any case within 5 business days, and we will not add you back to the list afterwards. We do not buy email lists or use address‑harvesting software.

Marketing consent is not bundled with creating a portal account. Emails about your account and service are not marketing.

9. Access and correction (APP 12 & 13)

You may request access to the personal information we hold about you and request corrections if it is inaccurate, out‑of‑date, incomplete, irrelevant or misleading. We will respond within a reasonable period and may ask you to verify your identity. If we refuse a request, we will explain why and how to complain.

10. Data retention and deletion

We retain personal information only for as long as needed for the purposes described above or as required by law. When no longer needed, we take reasonable steps to delete or de‑identify it, unless an exception applies.

11. Notifiable Data Breaches (NDB) scheme

If a data breach is likely to result in serious harm and remedial actions cannot prevent the risk, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable and include recommendations for steps you can take. We assess suspected breaches promptly and generally within 30 days as required by the scheme.

12. Children

Our services are intended for business users and are not directed to children.

13. Contacting us and complaints

We will acknowledge your complaint and aim to resolve it within 30 days. If you are not satisfied, you can contact the OAIC at oaic.gov.au.

14. Changes to this policy

We may update this policy to reflect changes to our practices or the law. Material changes will be notified via our service or email and the "Last updated" date will change.