Privacy Policy

1. Introduction

Portcullis Security (ABN 60 366 372 069) ("we", "us", or "our") is committed to protecting the privacy of your personal information. This Privacy Policy sets out how we collect, hold, use, disclose and otherwise manage personal information in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

By using our website (portcullis-security.ai), engaging our services, or otherwise providing personal information to us, you acknowledge that you have read and understood this Privacy Policy.

2. Scope and application

This Privacy Policy applies to all personal information collected by Portcullis Security through:

• Our website at portcullis-security.ai and all associated pages
• Email correspondence
• Service engagements and consulting arrangements
• Third-party platforms we use to deliver our services (including Calendly and email hosting providers)
• Social media interactions

This policy does not apply to information collected by third-party websites linked from our site. We encourage you to review those parties' privacy policies separately.

3. What personal information we collect

The types of personal information we may collect include:

• Name and job title
• Email address
• Phone number
• Organisation name and size
• IP address and browser/device information
• Website usage data and analytics (pages visited, time on site, referral source)
• Information you provide via contact forms, email correspondence or booking forms
• Information provided during service engagements, including documents, reports and correspondence

We do not collect sensitive information (as defined under the Privacy Act) unless it is reasonably necessary for the services being provided and you have provided explicit consent.

4. How we collect personal information

We collect personal information through the following means:

• Directly from you — when you contact us via email, submit a form on our website, book a consultation through Calendly, or engage us for services
• From our website — through cookies, Google Analytics and server logs when you browse our site
• From third-party platforms — when you interact with us through LinkedIn, Calendly or other professional platforms
• From your organisation — when your employer or colleagues engage us on behalf of your organisation

Where practicable, we will collect personal information directly from you. If we receive unsolicited personal information that we did not request and could not have collected under the APPs, we will destroy or de-identify that information as soon as practicable, provided it is lawful and reasonable to do so (APP 4).

5. Why we collect personal information

We collect and use personal information for purposes that are directly related to our business activities, including:

• Responding to enquiries and providing information about our services
• Scheduling and managing consultations and meetings
• Delivering our cyber security advisory and fractional CISO services
• Preparing reports, assessments and deliverables
• Communicating with you about service engagements
• Improving our website, content and service offerings
• Sending updates or marketing communications where you have provided consent
• Complying with applicable laws and regulatory obligations

We will not use your personal information for a purpose other than the purpose for which it was collected, unless you have consented, or unless the secondary purpose is related to the primary purpose and you would reasonably expect us to use the information for that purpose (APP 6).

6. Disclosure of personal information

We do not sell, rent, or trade your personal information. We may disclose your personal information to the following categories of recipients where necessary to deliver our services or meet our obligations:

• Third-party service providers — including Calendly (scheduling), our email hosting provider, and Google Analytics (website analytics). These providers are engaged to assist us in operating our business and are required to handle personal information in accordance with applicable laws
• Professional advisors — including lawyers, accountants and insurers, where required
• Regulatory or legal authorities — where required or authorised by Australian law, including in response to a court order, subpoena or lawful request
• Successors — in the event of a sale, merger, restructure or transfer of our business, personal information may be transferred to the successor entity

We take reasonable steps to ensure that any third party to whom we disclose personal information handles it in accordance with the APPs (APP 8).

7. Cross-border disclosure

Some of the third-party service providers we use (including Calendly and Google) may store or process data in locations outside Australia, including the United States. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles the information in a manner consistent with the APPs, or that the recipient is subject to a substantially similar privacy regime (APP 8.1).

By providing personal information to us, you acknowledge that some processing may occur outside Australia. We remain accountable for any personal information disclosed to overseas recipients in accordance with the Privacy Act.

8. Data security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure (APP 11.1). Our security measures include:

• Encryption of data in transit (TLS/HTTPS) and at rest where applicable
• Access controls limiting who can view personal information to those with a legitimate business need
• Use of strong authentication including multi-factor authentication
• Regular review of security controls and practices
• Vetting of third-party service providers for adequate security practices

No method of electronic transmission or storage is completely secure. Whilst we strive to protect your personal information, we cannot guarantee absolute security.

9. Data retention and destruction

We retain personal information only for as long as it is needed to fulfil the purpose for which it was collected, or as required by law. When personal information is no longer needed, we will take reasonable steps to destroy or permanently de-identify it (APP 11.2).

Specific retention periods include:

• Enquiry and contact data — retained for up to 24 months after last contact, then destroyed
• Client engagement data — retained for 7 years after the conclusion of the engagement, in accordance with Australian taxation and business record requirements
• Website analytics data — retained in accordance with Google Analytics' data retention settings (currently configured for 14 months)

10. Cookies, analytics and tracking

Our website uses cookies and third-party analytics tools to collect usage data and improve the user experience.

Google Analytics: We use Google Analytics to understand how visitors interact with our website. Google Analytics collects information such as pages visited, time spent on pages, referral sources and browser/device type. This data is aggregated and does not personally identify you. Google's privacy policy is available at policies.google.com/privacy.

Calendly: When you book a consultation through Calendly, information you provide (name, email, any notes) is processed by Calendly in accordance with their privacy policy, available at calendly.com/privacy.

Cookies: Our website may use cookies to improve functionality and track usage. You can control cookie settings through your browser preferences. Disabling cookies may affect certain features of the website.

11. Third-party links

Our website may contain links to third-party websites, services and platforms. We are not responsible for the privacy practices, content or security of those third-party sites. We encourage you to review the privacy policies of any site you visit.

12. Your rights — access and correction

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you (APP 12). We will respond to access requests within 30 days
• Request correction of personal information that is inaccurate, incomplete, out of date, irrelevant or misleading (APP 13)
• Withdraw consent for marketing communications at any time
• Request deletion of personal information that is no longer required for the purpose for which it was collected, subject to any legal obligations requiring retention

To exercise any of these rights, please contact us at Doug@portcullis-security.ai. We may need to verify your identity before processing your request. There is no charge for making a request or for the first provision of information, though we may charge a reasonable fee for subsequent or complex requests.

13. Complaints

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, you may lodge a complaint with us in writing at Doug@portcullis-security.ai.

We will acknowledge receipt of your complaint within 7 business days and investigate and respond within 30 business days. If you are not satisfied with our response, you have the right to escalate the matter to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

14. Notifiable data breaches

In accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988, if we become aware of an eligible data breach that is likely to result in serious harm to any individual whose personal information is involved, we will:

• Notify the OAIC as soon as practicable
• Notify affected individuals as soon as practicable, including a description of the breach, the types of information involved, and recommended steps to mitigate potential harm

We maintain an internal data breach response plan and will take all reasonable steps to contain and remediate any suspected or confirmed breach.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. Any changes will be published on this page with an updated effective date. We encourage you to review this policy periodically.

Where changes are material, we will take reasonable steps to bring the updated policy to your attention.

16. Contact us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have a concern about how your personal information has been handled, please contact us: