We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), which set the minimum standard for how we collect, hold, use and disclose personal information. This policy applies to personal information we collect through our website, over the phone, by email, and in the course of delivering IT services to our clients.

It does not apply to the internal systems or data of our business clients that we are contracted to manage — our handling of that information is instead governed by the individual service agreement with that client, referenced in section 6.

The personal information we collect depends on how you interact with us. It typically includes:

• Contact details — name, business name, role, phone number, email address and postal address.

• Enquiry and engagement information — details you provide when requesting a quote, an IT audit, or support, including a description of your systems or the issue you're experiencing.

• Billing information — invoicing details and payment records (we do not store full credit card numbers ourselves; these are handled by our payment providers).

• Technical and support data — device, network and system information reasonably needed to diagnose and resolve an IT issue, and records of support tickets and correspondence.

• Website usage data — pages visited, general location (suburb/region level), browser type and referring pages, collected via cookies and analytics tools (see section 7).

We do not intentionally collect sensitive information (such as health information) about individuals visiting our website. Where our work for a client incidentally involves access to sensitive information held on that client's systems — for example, patient records on a medical practice's server — this is addressed under section 6.

Wherever practical, we collect personal information directly from you — through our website's contact and enquiry forms, by phone, by email, or in person during a site visit or consultation. Occasionally we may collect information from a third party, for example a referral from another business, or publicly available business directories when we're researching a prospective client's industry before an initial conversation.

We use personal information to:

• respond to enquiries and provide quotes for our services;

• deliver, manage and invoice for IT support and consulting services;

• maintain support records so we can provide continuity of service;

• send service updates, maintenance notices, or — with your consent — occasional information about services we think may be relevant to your business; and

• meet our legal and regulatory obligations, including tax and record-keeping requirements.

We don't use your personal information for automated decision-making that would significantly affect you, and we don't sell personal information to third parties.

With your consent and if it complied and safe to do so ,we disclose personal information only where it's necessary to run our business or deliver our services, including to:

• subcontractors or specialist technicians engaged to deliver part of a service on our behalf;

• software and hosting providers we rely on to run our own business systems (for example, accounting, helpdesk ticketing, and email platforms);

• technology partners whose products we deploy for clients, such as 8x8 for cloud communications and CodeTwo for email management, where needed to configure or support that product; and

• government or regulatory bodies where we're required to by law.

We require our subcontractors and service providers to protect personal information consistently with this policy.

As a managed IT provider, our technicians may have administrative access to a client's network, devices, backups or software — including, for some clients, systems that hold patient records, employee records, or other sensitive information (for example, medical practices running Best Practice or Medical Director).

In that context, the client remains the data controller and is responsible for their own compliance obligations, including any obligations under the Privacy Act or the My Health Records Act. CleverConnect acts as a service provider: our staff only access client data as far as is needed to deliver, monitor or troubleshoot the agreed service, we do not use it for any other purpose, and access is governed by the confidentiality terms in our client service agreement.

Note for clients: if your practice or business needs a copy of these terms for your own privacy documentation or a data processing arrangement, contact us and we'll provide the relevant clause from your service agreement.

Our website uses cookies and similar technologies to remember your preferences and understand how visitors use the site, so we can improve it. This includes standard analytics cookies that report aggregated, anonymised traffic patterns rather than identifying individual visitors.

You can control or delete cookies through your browser settings. Blocking cookies may affect how some parts of the website function, but you can still browse the site and contact us without accepting non-essential cookies.

We take reasonable technical and organisational steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure. This includes restricting access to personal information to staff who need it to do their job, using secure systems for storage, and applying the same security discipline to our own systems that we recommend to our clients.

Some of the cloud platforms and software providers we use to run our business (for example, email, accounting or backup platforms) may store or process data on servers located outside Australia. Where this occurs, we take reasonable steps to ensure the provider handles personal information consistently with the Australian Privacy Principles before we rely on that service.

You can ask us for access to the personal information we hold about you, or ask us to correct it if it's inaccurate, out of date or incomplete. To make a request, contact us using the details in section 13. We'll respond within a reasonable period, generally within 30 days.

In some circumstances permitted by the Privacy Act, we may need to decline a request — if that happens, we'll explain why and let you know how to lodge a complaint about the refusal.

If you believe we've mishandled your personal information, contact us first using the details below so we can investigate and respond. If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We may update this policy from time to time to reflect changes in our practices or legal obligations. The version on this page is always the current one, and the "last reviewed" date at the top of this page will change whenever we update it.

For any question about this policy, or to make an access, correction or complaint request, get in touch:

CleverConnect Pty Ltd

03 9969 5454

hello@cleverconnect.com.au