Privacy Policy

1. About this policy

CYRENTIQ is a business name of [LEGAL ENTITY NAME] (ABN [ABN]) (“CYRENTIQ”, “we”, “us”, “our”). We provide cyber security testing, compliance and certification readiness, and software testing services. We are based in Leongatha, Gippsland, Victoria, and work with organisations across Australia.

This policy explains how we collect, use, store, disclose and protect personal information, and how you can access or correct it or make a complaint. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy applies to our websites (cyrentiq.com.au and cyrentiq.com), our contact form, the free Security Health Check, our emails and our services.

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

2. What personal information we collect

When you use our contact form

Your first and last name, company or organisation, position or role, work email address, phone number (optional), organisation type, the service you are interested in, the system you would like help with, your description of what you want to achieve, your preferred timing, whether you can authorise the work, and anything else you choose to tell us.

When you complete the Security Health Check

Your first and last name, business name, work email address, role, phone number and town or suburb (both optional), whether you would like a free consultation, your answers about your business (for example industry, number of staff and the systems you use), your answers to the security questions, and the results we calculate from them.

Your Health Check answers describe your organisation’s security practices. Some may be commercially sensitive, so we treat them as confidential. We do not ask for sensitive information about you as an individual (such as your health information). Questions about the types of information your business handles refer to your business, not to you.

Your answers stay in your browser while you complete the check. They are only sent to us when you submit your contact details at the end.

Your consent choices

We record that you agreed to this Privacy Policy, whether you agreed to receive marketing emails, the wording you agreed to, and the date and time you agreed.

When you contact us or work with us

The content of emails, calls and meetings, and, during an agreed engagement, information about your systems, security findings and software that you authorise us to access. Engagement information is also covered by the confidentiality terms in your proposal and our Service Terms.

Technical and security information

When you visit our website, our hosting and security provider (Cloudflare) processes technical information such as your IP address, browser type, device information, the pages you request and the date and time. This is used to deliver the website and protect it against attacks, spam and abuse. Our forms use Cloudflare Turnstile, which checks signals from your browser to tell people and automated programs apart.

To limit repeated form submissions, we keep a one-way scrambled (hashed) version of your IP address, not the IP address itself, for up to 2 days.

Please do not send passwords, access credentials or confidential client records through our website forms.

3. Cookies and analytics

We do not use advertising cookies or tracking pixels.

We use Cloudflare Web Analytics to count visits and see which pages are popular. It does not use cookies, and it does not track you across other websites or build a profile of you.

Cloudflare may set strictly necessary security cookies (for example to recognise a visitor who has passed a security check), and the Turnstile check may use similar technologies. These are needed for the website to work securely. Our staff sign-in area uses a Cloudflare Access cookie for authorised team members only.

If we add other website tools in future, we will update this policy first.

4. How we collect personal information

We collect personal information directly from you when you complete a form, take the Health Check, email or call us, or work with us. Some technical information is collected automatically when you use our website (see section 2). Occasionally we receive information from someone who refers you to us, or from publicly available business sources such as your organisation’s website. Where we collect information about you from someone else, we take reasonable steps to let you know.

5. Why we collect and use personal information

• To respond to your enquiry and discuss the services you asked about.
• To calculate and show your Health Check results, email you a copy, and contact you about them, including arranging a free consultation if you ask for one.
• To prepare proposals, deliver and manage agreed services, and invoice for them.
• To manage our relationship with you in our customer relationship management system (HubSpot).
• To send you marketing emails, but only if you have agreed (see section 10).
• To keep our website, systems and information secure and to prevent spam, fraud and misuse.
• To improve our services, for example by reviewing de-identified, combined Health Check results.
• To meet our legal, insurance, tax and record-keeping obligations.

If you do not provide the required details, we may not be able to respond to your enquiry or give you your Health Check results. You can browse our website and call us without identifying yourself. Where it is practical and lawful, you can deal with us anonymously or by using a pseudonym.

6. Who we share personal information with

We share personal information only as needed for the purposes above, with:

• technology service providers who host, secure, store or send information for us (listed in section 7);
• specialist practitioners who help deliver an agreed engagement, under confidentiality obligations;
• our professional advisers, such as accountants, lawyers and insurers; and
• government agencies, regulators or law enforcement, where required or authorised by law.

We do not sell or rent personal information.

7. Where personal information is stored, and overseas disclosure

Website form submissions are stored in Australia. Some of our service providers are based overseas or may process information outside Australia, as shown below. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, for example through contractual privacy and security commitments.

We may work with specialist practitioners on agreed engagements. Any personal information we share with them stays in Australia.

We will update this section if we change providers or locations.

8. How we store and protect personal information

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These include:

• encrypting information in transit (HTTPS);
• limiting access to people who need it, and protecting staff accounts with multi-factor authentication;
• protecting our internal lead area with Cloudflare Access, which requires a verified one-time code;
• spam and abuse protection on our forms;
• choosing reputable providers with strong security practices; and
• treating security testing evidence and reports as confidential.

AI-assisted tools are used on client information only where agreed, with appropriate safeguards and human review.

No online system is completely secure. If you think your information has been misused or compromised, please contact us straight away.

9. How long we keep personal information

We keep personal information only for as long as we need it for the purposes described in this policy, or as the law requires. There is no fixed period. We review the personal information we hold at least once a year, and delete or de-identify information we no longer need. If you ask us to delete your information, we will do so unless the law requires us to keep it (for example, financial records).

Hashed IP addresses used to limit repeated form submissions are deleted automatically after 2 days. Website security and server logs are kept by Cloudflare for a short period, generally days.

10. Marketing emails and how to unsubscribe

We only send you marketing emails (such as cyber security tips and news about our services) if you have agreed, for example by ticking this optional box on our forms:

“Yes, send me occasional emails with cyber security tips and news about CYRENTIQ services. I can unsubscribe at any time.”

The box is never ticked for you. We record the date and time you agreed. Our marketing emails are sent through HubSpot. Every marketing email identifies CYRENTIQ, includes our contact details and has an easy unsubscribe link, in line with the Spam Act 2003 (Cth). You can also unsubscribe at any time by emailing info@cyrentiq.com.au. We will process your request promptly, and in any case within 5 business days.

Saying no to marketing does not affect your enquiry, your Health Check results or any services. We may still send you messages you have asked for, such as your Health Check results or replies about your enquiry.

11. Accessing and correcting your personal information

You can ask for access to the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. You can also ask us to delete it. Contact us using the details in section 14. We will need to confirm your identity before we act on a request.

We aim to respond within 30 days. There is no charge to make a request. If access involves significant time or cost, we may charge a reasonable fee, and we will tell you before we do. If we refuse a request, we will tell you why in writing and explain how you can complain.

12. Data breaches

If we suspect a data breach, we act quickly to contain it and assess the risk. If a breach is likely to result in serious harm to the people affected (an “eligible data breach” under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988), we will notify the people affected and the Office of the Australian Information Commissioner (OAIC) as the law requires.

13. Questions and complaints

If you have a question or complaint about how we handle personal information, please contact us (section 14) and include enough detail for us to look into it. We will acknowledge your complaint within 5 business days and aim to give you a response within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992.

14. Contact us

Privacy Officer, CYRENTIQ
Email: info@cyrentiq.com.au
Phone: (03) 9070 0878
Post: 16D McCartin Street, Leongatha VIC 3953

15. Third-party websites

Our website may link to other websites. We are not responsible for their privacy practices, so please read their privacy policies.

16. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The “Last updated” date at the top shows the current version. If we make a significant change, we will take reasonable steps to let affected people know.