PRIVACY POLICY SUMMARY

Nova Sec Australia is a cyber security consultancy. We advise businesses on how to protect the personal information they hold. This page explains how we look after yours.

We are a small business, and we could rely on an exemption in the Privacy Act. We don't. We handle personal information in line with the Australian Privacy Principles, because we would be poor advisers if we didn't.

What we collect. If you contact us, we collect your name, email address, phone number, business name, and whatever you write in your message. When you visit this website, our servers record your IP address, browser and the pages you look at.

Why we collect it. To answer you. To do work you have asked us to do. To keep this website running and secure. To meet our legal obligations.

We do not sell your information. We do not send marketing emails.

We use Google Ads. For conversion tracking to measure whether ads led to an enquiry. This sets cookies and sends Google your IP address and the pages you viewed. Opt out through your browser's cookie settings or Google's Ad Settings.

Some of your information goes overseas. Our website sits behind Cloudflare in the United States. Our customer records are held in Odoo, hosted in Australia, but Odoo is a Belgian company and its staff can access the system from overseas. Our email and documents are with Microsoft in Australia, though Microsoft is a global company and some processing happens elsewhere. Our analytics provider and our encrypted backups are in the European Union. Our encrypted mailbox is in Switzerland.

How long we keep it. Enquiries that don't become work: 12 months. Client records: seven years after the work ends. Website logs: 90 days.

You can see it, and change it. Ask us what we hold about you and we will tell you and give you a copy, free. If it's wrong, we will fix it.

If you're unhappy, tell us. Email [email protected]. We will respond within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We use AI carefully. We use AI tools for research and drafting, but never enter client identities or system data into them. Everything you receive has been written or checked by a person.

Contact: [email protected] · +61 494 563 622

PRIVACY POLICY

About this policy

Nova Sec Australia (ABN 16 926 391 567) is a cyber security consultancy based in Gippsland, Victoria. We work with small businesses on security assessments, engineering, and certification.

This policy explains how we handle personal information. It applies to this website and to our business generally. It does not replace the confidentiality terms in a client engagement agreement, which sit alongside it.

We choose to be bound by the Privacy Act

Nova Sec is a small business operator. Under section 6D of the Privacy Act 1988, businesses with a turnover of $3 million or less are usually exempt from the Australian Privacy Principles.

We do not rely on that exemption. We handle personal information as though the Privacy Act applies to us in full, including the Australian Privacy Principles and the Notifiable Data Breaches scheme.

What personal information we collect and hold

When you contact us. Your name, email address, phone number, the name of your business, and whatever you write in your message or say on the phone.

When you visit this website. Our web server and our security provider record your IP address, your browser and operating system, the pages you visit, and the time of your visit. This is standard security logging.

When you become a client. During an engagement we will see information about your systems. Depending on the work, that can include the names, email addresses and account details of your staff. If we are working with a health service or a law firm, we may incidentally see information about their patients or clients.

We do not go looking for that information. We collect the minimum we need to do the work, we do not copy it out of your systems unless we have to, and we destroy any working copies when the engagement ends.

We do not collect sensitive information about you as a website visitor or an enquirer. We do not collect health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or criminal record.

How we collect it

We collect personal information directly from you. When you fill in our contact form, send us an email, ring us, or speak to us in a meeting.

We do not buy personal information. We do not collect it from list brokers, data brokers, or social media scraping.

We collect technical information automatically when you visit this website, as described above.

Being anonymous

You can ask us a general question without telling us who you are. Ring us, or write from an anonymous email address, and we will still answer.

We cannot do consulting work anonymously. We need to know who our client is before we look at their systems, and so do our insurers.

How we hold it

Email and documents. Microsoft 365, stored in Australia under Microsoft's Advanced Data Residency. Microsoft is a global provider, and some processing could takes place outside Australia.

Odoo. We use Odoo for this website, our contact form, our customer records, our quotes and our invoicing. Your name, your business, your contact details and our correspondence with you are stored there. The data is hosted in Australia, but Odoo is a Belgian company and its support staff can access the system from outside Australia.

Security. We use multi-factor authentication on every account. Information is encrypted in transit and at rest. Access is limited to those who need it. We apply the same controls to ourselves that we recommend to our clients, and we hold SMB1001:2025 Level 3 (Gold) certification.

Backups. Our backups are stored with Backblaze in the European Union. They are encrypted before they leave our systems, and Backblaze does not hold the keys. Backblaze can store our backups. It cannot read them.

No system is completely secure. If we suffer a data breach that is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

We do not link your information across sources. We do not build profiles of you.

Why we collect, hold, use and disclose it

• To answer your enquiry
• To provide consulting services you have engaged us for
• To invoice you and keep the financial records the law requires
• To keep this website running and to protect it from attack
• To meet our legal and regulatory obligations
• To measure the effectiveness of our advertising

That is the complete list. We do not use your information for anything else.

We do not sell, rent or trade personal information. We do not disclose it to anyone for marketing purposes. We do not send marketing email and we do not run a mailing list.

We disclose your information only:

• to the service providers listed below, who hold it on our behalf
• where you have asked us to
• where we are required to by law

How we use AI

We use AI tools for research and drafting.

What we do not put into them. We do not enter client identities, credentials, or unredacted system data into any AI tool. Where we need help analysing something technical we anonymise the data. What goes in is not traceable back to you.

What happens to what we do put in. The AI providers we use do not train their models on our data, and retain it for no more than 30 days.

Who is accountable. Every document you receive has been written or reviewed by a person. AI does not make decisions about your security, and no finding reaches you that we have not checked ourselves.

Sending information overseas

Some personal information leaves Australia. Here is exactly where it goes and why.

If you send us a message through this website, that information passes through Cloudflare in the United States before it reaches us.

Before we disclose personal information to an overseas recipient, we take reasonable steps to ensure they will handle it in line with the Australian Privacy Principles, as APP 8 requires.

Cloudflare's CSAM Scanning Tool

We use Cloudflare, and we have its CSAM Scanning Tool switched on.

The tool compares content passing through Cloudflare against lists of digital fingerprints of known child sexual abuse material, maintained by the National Center for Missing and Exploited Children and similar bodies. If it finds a match, Cloudflare reports it to NCMEC.

It compares fingerprints against a known list. It does not read or inspect the content of your message.

Cookies

This website uses only the cookies it needs to work.

We use Plausible for analytics. It sets no cookies, does not track you across other websites, and collects no personal information. We use it to see which pages people read, and which advertisements brought them here.

We do not use Google Analytics. We do not load fonts or scripts from Google. We do not use advertising or tracking pixels.

How long we keep it

When the period ends, we delete the information or de-identify it.

Getting access to your information, and correcting it

You can ask what we hold about you. Email [email protected]. We will tell you, and give you a copy, free of charge. Before we release anything, we'll ask you to confirm your identity. We will respond within 30 days.

If we cannot give you access, we will tell you why in writing.

You can ask us to correct it. If information we hold about you is wrong, out of date, incomplete or misleading, tell us and we will fix it.

If we disagree that it needs correcting, we will tell you why, and you can ask us to attach a statement to the record saying you believe it is wrong.

Deletion. You can ask us to delete your information. We will, unless we're required to keep it — tax law requires financial records for seven years, and client engagement files are kept for seven years after the work ends for the same reason. Where we can't delete something, we'll tell you which obligation applies and when we can.

Making a complaint

If you think we have mishandled your personal information, tell us.

Step 1. Email [email protected], or write to us, and set out what happened.

Step 2. We will acknowledge your complaint within five business days and give you a written response within 30 days. If we have got something wrong, we will say so and fix it.

Step 3. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• oaic.gov.au
• 1300 363 992
• GPO Box 5218, Sydney NSW 2001

You do not need our permission to do this.

Changes to this policy

We review this policy when the way we work changes, and at least once a year. The version number and date at the top tell you when it last changed.

Getting this policy in another format

If you would like this policy in a different format, ask and we will provide it, free of charge.

Contact

Nova Sec Australia ABN 16 926 391 567 [email protected] +61 494 563 622