Privacy policy

This policy explains how ANPO Pty Ltd (ACN 698 868 147), trading as ANPO Digital (“we”, “us”, “our”), handles personal information. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) in all our work, whether or not the Act applies to a business of our size.

Who this policy covers

It covers people who visit this website, send us an enquiry, correspond with us, or work with us as a client or a client’s representative. It also explains how we treat personal information we come across inside a client’s systems during an engagement.

What we collect

• Enquiries: your name, email address, company or project name, the website or application you mention, the service you are interested in, and what you tell us about your project.
• Clients: contact and billing details for the people we work with, the signed scope and authorisation for each engagement, and our correspondence.
• Technical information: when you use the contact form, your IP address and browser signals are used to stop spam and abuse. Your IP address is stored only as a one-way hash, for up to an hour, for rate limiting. It is not kept with your enquiry.

We do not need sensitive information, such as health information or bank account details, and ask that you do not send it. This website does not use advertising or analytics cookies and does not track you across other websites.

You can contact us without giving your full name, or under a pseudonym, if you prefer. We need a working email address to reply, and we need to know who you are before we can agree to work together.

How we use it

We use personal information to:

• reply to your enquiry and prepare a scope or quote if you ask for one
• plan, deliver and invoice the work we agree with you
• confirm that the person authorising security testing has the authority to do so
• keep business, tax and legal records, and protect our legal rights
• protect this website and our systems from misuse

We do not sell, rent or trade personal information, and we do not add you to a mailing list. If we ever send marketing, it will only be with your consent, and every message will include a way to opt out.

Personal information inside client systems

Security testing can expose us to personal information held in a client’s systems, such as customer records in a database. When that happens we:

• access only what is needed to confirm and demonstrate a finding
• keep no more than the minimum evidence needed, and redact personal information from reports wherever possible
• store working evidence encrypted, and delete it within 30 days of delivering the final report, unless the engagement agreement says otherwise
• tell the client promptly if we find personal information exposed in a way that may need action under the Notifiable Data Breaches scheme

The client remains responsible for its own privacy obligations for that information. We handle it only on the client’s behalf and under the engagement agreement.

Who we share it with

We share personal information only with providers who help us run the business, and only what they need:

• Cloudflare hosts this website, protects it from attack, and provides Turnstile, which checks that a form submission comes from a person.
• Resend delivers contact form submissions to our inbox by email.
• Zoho provides our email, hosted in its Australian data centre.
• Our accountant, lawyers and other professional advisers, where needed.

We may also disclose information where the law requires it, or to an authority investigating unlawful activity.

Overseas disclosure

Cloudflare and Resend may process information outside Australia, including in the United States and other countries where Cloudflare operates its network. We choose providers with published security and privacy commitments, and limit what we send them. Where we can choose the location, as with our email, we keep information in Australia.

How long we keep it

• Enquiries that do not lead to work are deleted within 24 months.
• Engagement records, contracts and invoices are kept for seven years to meet tax and legal record-keeping obligations.
• Testing evidence is deleted within 30 days of the final report, as described above. The final report is kept with the engagement records.

How we protect it

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include multi-factor authentication on every account that holds client or enquiry data, encrypted storage, limiting access to the people doing the work, and collecting as little as we can in the first place.

If a data breach is likely to cause serious harm, we will assess it promptly and notify the people affected and the Office of the Australian Information Commissioner where required.

Access, correction and deletion

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it by emailing hello@anpodigital.com.au. We will respond within 30 days. If we cannot do what you ask, for example because the law requires us to keep a record, we will explain why.

Complaints

If you are concerned about how we have handled your personal information, contact us first and we will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy as our services or providers change. The date at the top shows when it last changed.

Contact

ANPO Pty Ltd, trading as ANPO Digital, Melbourne, Victoria, Australia. Email hello@anpodigital.com.au.