Privacy Policy

1. Who we are

Paul Healy, a sole trader operating under the registered business name Cybervisory (ABN 26 960 585 195), provides IT and cybersecurity consulting services from Queensland, Australia.

This policy explains how we handle personal information in connection with our website, enquiries, business relationships and consulting services. It applies to information we handle in our own business. When we handle personal information for a client as part of a consulting engagement, the client’s privacy policy and our contract may also apply.

2. The information we collect

Depending on how you interact with us, we may collect:

• your name, work email address, company, role and other contact details;
• business and service information, including proposals, contracts, invoices, correspondence, support requests and feedback;
• technical information, such as IP address, device and browser details, website activity, authentication and system logs; and
• information relevant to an IT or cybersecurity engagement, such as user accounts, access records, network or system configurations, security alerts, incident details and audit findings.

We do not routinely seek to collect sensitive information, such as health information. In the course of a consulting engagement, we may encounter personal information held in a client’s systems. We handle that information as authorised by the client, our contract and applicable law.

Please do not send us passwords, authentication secrets or sensitive personal information unless it is necessary for an agreed service and we have provided a secure method to do so.

3. How we collect information

We usually collect personal information directly from you, for example when you contact us, use our website, enter into a contract, attend a meeting or receive our services.

We may also receive information from a client, your employer, a supplier, a business referral or a publicly available source where relevant to an engagement or our business relationship. Our website and business systems may collect technical or usage information when you interact with them.

We use Microsoft 365 for email, file storage and office productivity. Our Microsoft 365 tenant is located in Australia. We use HubSpot CRM for marketing; personal information in HubSpot is hosted, accessed and processed only in Australia. We may also use other AI and cloud services, some of which may be hosted in the United States. See section 6.

If you do not provide information we reasonably need, we may be unable to respond to you, provide a service or perform an engagement.

4. Why we collect, use and disclose information

We may collect, hold, use and disclose personal information to:

• respond to enquiries and provide proposals, IT and cybersecurity consulting, support, assessments and related services;
• manage client and supplier relationships, contracts, payments and business records;
• secure, monitor, maintain and improve our systems and website;
• investigate and respond to security events, complaints or suspected unlawful activity;
• meet legal, regulatory, insurance and contractual obligations; and
• market our services where permitted by law.

You can ask us to stop sending you marketing communications by contacting us or using the unsubscribe method in the message.

We may disclose personal information to our staff and contractors, professional advisers, insurers, and service providers that support our business, including providers of hosting, email, customer-management, accounting, security monitoring, remote support, AI or cloud services. We may also disclose information when required or authorised by law, or with your consent.

5. Client information handled during consulting work

A client may give us access to information about its staff, customers or other individuals so we can perform an engagement. In those circumstances, we handle that information only as authorised by the client, our contract and applicable law. The client is generally responsible for providing any required notices or obtaining any required permissions.

We do not use client information for our own marketing. We may use or disclose it as needed to perform the engagement, protect systems, comply with law, or as otherwise agreed with the client. If you have a question about information held in a client’s systems, please contact that client in the first instance. You may also contact us using the details in section 1.

6. Overseas storage and disclosure

Our Microsoft 365 tenant and HubSpot CRM are located in Australia. Personal information in HubSpot is accessed and processed only in Australia.

Some other AI and cloud services we use may be hosted in the United States or may handle information there. The particular service and information involved will depend on the work being performed. Before disclosing personal information to an overseas recipient, we take steps required by applicable privacy law. You can contact us for more information about overseas handling relevant to a specific interaction or engagement.

7. How we hold and protect information

We hold personal information in electronic systems and, where relevant, in hard copy records. We use reasonable administrative and technical safeguards designed to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. The safeguards used depend on the information and service, and may include access controls, authentication, encryption, secure communications and backups.

No method of storage or transmission is completely secure. We review and manage security risks as part of our business practices.

8. Retention and destruction

We keep personal information only for as long as it is needed for the purposes described in this policy, to provide our services, to meet legal or contractual requirements, or to resolve disputes. When it is no longer needed, we take reasonable steps to destroy it or de-identify it, unless we are required or permitted by law or contract to retain it.

Client information is also handled in accordance with the relevant engagement terms and any agreed return or deletion requirements.

9. Access and correction

You may ask for access to personal information we hold about you, or ask us to correct it if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details in section 1. We may need to verify your identity and clarify the information you are requesting.

We will respond within a reasonable period. We may refuse access or correction in circumstances permitted by law. If we do, we will explain our reasons and the available complaint options, unless the law allows us not to.

10. Privacy complaints

If you have a concern or complaint about how we have handled personal information, contact us in writing using the details in section 1. Please describe the issue and how you would like us to resolve it. We will acknowledge and investigate your complaint and respond within a reasonable period.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC). The OAIC generally asks individuals to raise the matter with the organisation first and allow it an opportunity to respond. Information is available at oaic.gov.au.

11. Data breaches

If we become aware of a data breach involving personal information, we will assess and respond to it in accordance with applicable law, including any notification obligations that apply to us.

12. Website links and changes to this policy

Our website may link to third-party websites. Their privacy practices are governed by their own policies.

We may update this policy from time to time. The current version will be published on our website with its updated date.