How we handle your personal information.

1. Who we are

In this policy, "synfo", "we", "us" and "our" means Synfo Pty Ltd (ABN 61 656 470 610), an Australian managed IT, cybersecurity and cloud services provider based at 4/8 Clay Drive, Doncaster VIC 3108.

This policy applies to personal information we collect through our website (synfo.com.au), when you contact us, and when we deliver IT, cybersecurity and cloud services to our clients. Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Contacting our Privacy Officer

If you have a question about this policy, want to access or correct your information, or want to make a complaint, contact our Privacy Officer:

• Privacy Officer: George Josifidis, Co-founder and CTO
• Email: info@synfo.com.au
• Phone: 1300 079 636
• Post: Privacy Officer, synfo, 4/8 Clay Drive, Doncaster VIC 3108

2. What personal information we collect

We only collect personal information that is reasonably necessary for our business functions and activities. What we collect depends on how you deal with us.

Information collected automatically when you visit our website

Our website does not use analytics, advertising or tracking scripts, and does not set cookies of its own. However, like any website, some information is necessarily sent when your browser loads a page:

• Our web host, Cloudflare, receives standard request information such as your IP address, browser type, the page requested and the time of the request.
• Third-party content providers that serve fonts and code libraries used by our pages also receive your IP address and browser details when your browser requests those files. These are listed in section 5.

We do not collect sensitive information (such as health information, racial or ethnic origin, or criminal records) through our website. We ask that you don't include sensitive information in forms, chat messages or emails unless we specifically request it.

Dealing with us anonymously

You can browse our website and ask general questions without telling us who you are. Where you want us to respond to an enquiry or provide services, we'll need your name and contact details.

3. Personal information we handle when delivering services

As a managed service provider, we are given access to our clients' IT systems so we can support, monitor and secure them. In doing so, we collect and handle personal information about our clients' staff and, in some cases, their customers. At a general level, this includes:

• User account details: names, work email addresses, job titles, phone numbers and user identifiers.
• Device and technical information: device names, IP addresses, installed software, sign-in activity and security logs.
• Security monitoring data: alerts, events and logs collected by our security tools and Security Operations Centre to detect and respond to threats.
• Content stored in client systems (for example, email, files and backups). We access this only as needed to perform the services, such as restoring data, investigating an incident or at a client's request.

In these situations, we usually handle personal information on behalf of our client, under the terms of our agreement with them. If you are a staff member or customer of one of our clients and have a question about your personal information, you may also wish to contact that organisation directly.

4. How and why we use personal information

We collect personal information directly from you wherever we can: when you fill in a form, use the chat, email, call, or use our services. We may also collect it from your employer (if they are our client), from our service providers, or from publicly available sources such as business websites and professional networking profiles.

We use personal information to:

• respond to enquiries, audit requests and chat messages;
• provide, support, monitor and secure the IT, cybersecurity and cloud services our clients engage us for;
• manage support tickets, remote sessions and the Client Portal;
• verify identity before making changes to accounts, such as password resets;
• manage our relationships with clients, suppliers and partners, including billing and administration;
• send newsletters and information about our services, where you've asked for it or would reasonably expect it;
• maintain the security of our own systems and website; and
• comply with our legal obligations.

We will not use or disclose your personal information for any other purpose unless you consent, you would reasonably expect it and it is related to the purpose of collection, or it is required or authorised by law.

Automated decision-making

We do not use computer programs, including AI, to make or substantially assist in making decisions that could significantly affect your rights or interests. Our website chat uses AI to answer general questions, but it does not make decisions about you.

Direct marketing

We may send you information about our services, events or insights if you've subscribed or would reasonably expect to hear from us. Every marketing email includes a way to unsubscribe, or you can contact us to opt out at any time. We do not sell or rent personal information.

5. Who we disclose personal information to

We may disclose personal information to:

• our staff and contractors who need it to do their jobs;
• our clients, where the information relates to the services we deliver to them;
• technology vendors and service providers who help us run our business and deliver services (listed below), under arrangements that require them to protect the information;
• professional advisers such as lawyers, accountants and insurers; and
• government agencies, regulators or law enforcement where required or authorised by law.

Service providers used by our website and support tools

6. Overseas disclosure

We store personal information in Australia. Our email, chat, Client Portal and business systems all hold data onshore.

The providers that deliver our website files (Cloudflare, Google Fonts, jsDelivr, unpkg and cdnjs) run global networks that serve each visitor from a nearby location. Visitors in Australia are normally served from Australian locations, but these providers may handle your IP address and browser details on servers outside Australia.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it in a way that is consistent with the Australian Privacy Principles, such as through contractual commitments and by selecting reputable providers with strong security practices.

7. Cookies and local storage

Our website does not set its own cookies and does not use analytics or advertising cookies. We use your browser's storage in three limited ways:

• Theme preference: if you switch between light and dark mode, we store your choice under the key synfo-theme for the rest of your visit. It is cleared when you close the tab, and is never sent to us.
• Knowledge base feedback: if you answer "Was this helpful?" on a guide, we remember that you answered so we don't ask again. Only the answer is stored, in your browser.
• Chat session: the chat widget may store a session identifier in your browser so an open conversation continues if you move between pages.

Third-party providers that serve fonts or code libraries may apply their own cookie and logging practices. You can clear local storage and cookies at any time through your browser settings.

8. How we protect personal information

Security is what we do for a living, and we apply the same disciplines to our own systems. We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include access controls based on role, multi-factor authentication, encryption, security monitoring, staff training and working with providers that meet strong security standards.

We keep personal information only for as long as we need it for the purposes described in this policy or as required by law. When it's no longer needed, we take reasonable steps to destroy or de-identify it.

No method of transmitting information over the internet is completely secure. Please take care when sending personal information to us by email or chat.

9. Accessing and correcting your information

You can ask to access the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact our Privacy Officer using the details in section 1.

We'll need to verify your identity before we act on a request. We'll respond within a reasonable period, generally within 30 days. We don't charge for making a request or for correcting information. If we refuse a request, we'll tell you why in writing and how you can complain, unless it would be unreasonable to do so.

If your request relates to information we handle on behalf of a client (see section 3), we may need to refer it to, or work with, that organisation.

10. Making a complaint

If you think we've mishandled your personal information or breached the Australian Privacy Principles, please contact our Privacy Officer first using the details in section 1. Tell us what happened and how you'd like it resolved. We'll acknowledge your complaint, investigate it, and aim to respond in writing within 30 days.

If you're not satisfied with our response, or we haven't responded within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Online: oaic.gov.au
• Phone: 1300 363 992

11. Notifiable Data Breaches scheme

We are committed to responding quickly to any data breach. If we suspect a data breach has occurred, we will assess it promptly (and within 30 days). If it is an eligible data breach, meaning it is likely to result in serious harm to the individuals whose information is involved, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme under the Privacy Act.

Where a breach involves information we hold on behalf of a client, we will work with that client so the breach is assessed and notified appropriately.

12. Changes to this policy

We may update this policy from time to time to reflect changes in the law, our services or how we handle personal information. The current version will always be published on this page with the date it was last updated. If we make a significant change, we'll take reasonable steps to let affected clients know.