1. About this policy

This policy explains how Cube Cybersecurity Pty Ltd, ABN 14 604 585 097   (Cube Cyber, we, us or our) handles personal information. It applies to personal information we collect through our website, in the course of delivering our services, and in running our business.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

2. The personal information we collect

The kinds of personal information we collect depend on how you deal with us:

• Enquiries and website forms: your name, job title, organisation, email address, phone number, and anything you choose to tell us in your message.

• Clients, partners and suppliers: names and business contact details of the people we work with, along with records of our communications and dealings.

• Delivering our services: our security services involve access to client systems, and those systems contain personal information, such as user account details, email addresses, device and network identifiers, and activity logs. Section 7 explains how we handle this.

• Job applicants: information in your application and resume, referee details, and notes from interviews.

• Website visitors: technical information collected through Google Analytics, such as pages viewed, approximate location, device and browser type, and how you arrived at our site.

We do not ask for sensitive information, such as health information or information about racial or ethnic origin, unless it is needed for a specific purpose and you consent, or the law permits it. Sensitive information can sometimes be present in client systems we are engaged to secure. Where that happens, we handle it under our agreement with the client and do not use it for any other purpose.

You can generally contact us anonymously or under a pseudonym, for example when asking a general question. We need your details if you want us to respond, provide a service, or consider a job application.

3. How we collect personal information

We collect personal information directly from you when you fill in a form on our website, email or call us, meet with us, attend an event, or apply for a role. We also collect it from your employer or organisation when they engage us, from our partners and referrers, from public sources such as LinkedIn and company websites, and automatically through our website analytics.

If we receive personal information we did not ask for, we will check whether we could have collected it lawfully. If not, we will destroy or de-identify it where it is lawful and reasonable to do so.

4. Why we collect, use and disclose personal information

We use personal information to:

• respond to your enquiry and provide the information you asked for

• scope, deliver, manage and invoice our services

• monitor, detect and respond to security threats in environments we are engaged to protect

• manage our relationships with clients, partners and suppliers

• send you updates and insights you have agreed to receive

• assess job applications

• understand how our website is used and improve it

• protect the security of our own systems, and meet our legal and regulatory obligations.

We will not use or disclose your personal information for another purpose unless you consent, you would reasonably expect it and the purpose is related, or the law requires or permits it.

5. Direct marketing

With your agreement, we may send you updates about our services, events and security insights. Every marketing email includes a way to unsubscribe, and you can also ask us to stop by emailing info@cubecyber.com. We do not sell, rent or trade personal information.

6. Who we share personal information with

We may disclose personal information to:

• service providers who support our business, including Microsoft (email, documents and the systems that receive our website form submissions), Google (website analytics) and Framer (our website platform)

• technology vendors whose platforms we operate as part of our services, where this is needed to deliver the service and is covered by our client agreements

• our professional advisers, such as accountants and auditors

• government agencies, regulators or law enforcement, where the law requires or permits it.

Our service providers are only permitted to use personal information to provide their services to us.

7. Personal information in client environments

When we deliver security services, such as 24/7 monitoring, managed detection and response, security testing or incident response, we handle personal information held in our clients' systems on their behalf. We do this under our agreement with each client, only for the purpose of delivering the service, and with access limited to the people who need it.

Client data handled through our SOC and services is kept onshore in Australia.

If you want to access or correct personal information held in a client's systems, please contact that organisation first, as its privacy policy governs that information. If you contact us, we will refer your request to the client and help them respond.

8. Overseas disclosure

Some of our service providers store or process information outside Australia. Specifically:

• Google Analytics: website usage information is processed by Google in the United States and other countries where Google operates.

Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs. Client data handled through our SOC and services is not affected by these arrangements, as set out in section 7.

9. Cookies and website analytics

Our website uses Google Analytics, which sets cookies to measure how visitors use the site. This information is aggregated and helps us understand which content is useful. We do not use it to identify individual visitors.

You can block or delete cookies through your browser settings, or install Google's Analytics opt-out browser add-on. The website will still work if you do.

10. How we protect and store personal information

We hold personal information in electronic systems, mainly Microsoft 365 and our business applications. We operate an information security management system certified to ISO 27001, and protect personal information with access controls, encryption, monitoring and staff training. No system is completely secure, but we treat the protection of personal information as core to what we do.

We keep personal information only for as long as we need it for the purposes in this policy, or as the law requires. After that, we take reasonable steps to destroy or de-identify it.

11. Data breaches

If we experience a data breach that is likely to result in serious harm to the people involved, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

12. Accessing and correcting your personal information

You can ask for access to the personal information we hold about you, or ask us to correct it, by emailing info@cubecyber.com. We will need to confirm your identity before we act on the request. We will respond within a reasonable time, usually within 30 days. We do not charge for making a request.

In some circumstances the law allows us to refuse access or correction. If we do, we will explain why in writing and tell you how to complain.

13. Questions and complaints

If you have a question about this policy, or believe we have mishandled your personal information, please contact us:

Email: info@cubecyber.com (please include "Privacy" in the subject line)

Phone: 1300 085 366

We will acknowledge your complaint within five business days and aim to resolve it within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

14. Changes to this policy

We may update this policy from time to time. The current version will always be on our website, with the date it was last updated.