Get in Touch
Detection & Support
24/7 Security Operations Risk Operations Centre Get Incident Support Digital Forensics & Incident Response Education The Evolution from SOC to ROC Introducing ROC+
Engineering
Strategy, Architecture & Solutions Cyber Engineering About Cyber Engineering Meet our Cyber Engineering Team
Meet Rio

Privacy Policy.

Data & Privacy Statement.

Policy Statement

Purpose

The Privacy Act 1988 requires entities bound by the Australian Privacy Principles to have a privacy policy. This Privacy Policy outlines the personal information handling practices of Ctrl Security Pty Ltd (ctrl:cyber or Ctrl).

Scope

The scope of the Policy encompasses all functions, business units, employees and contractors of Ctrl. This includes all information created and received by Ctrl as well as third party systems that are bound by contractual agreement with Ctrl.

 

Overview

We collect, hold, use and disclose personal information to carry out the everyday functions and activities that enable us to run our business.

These functions and activities include:

  • establishing, managing and maintaining our business relationships;
  • conducting administrative and business functions;
  • responding to enquiries and requests from individuals and businesses;
  • considering a potential contractor’s engagement with us;
  • opening and administering our client accounts during sales and/or delivery cycle;
  • managing and reporting to our investors;
  • managing marketing and sales initiatives, such as information about our product offerings;
  • developing, providing, and improving our services and solutions;
  • consulting with stakeholders, for example, contractors and regulators;
  • responding to access and correction to information requests;
  • communicating with the public, stakeholders and the media including through websites and social media;
  • managing subscriptions to email and other updates;
  • registering attendance for events that we host;
  • assessing suitable candidates for career opportunities within Ctrl;
  • processing and responding to privacy questions, concerns and complaints; and
  • undertaking any other purpose related to or ancillary to any of the above.

 

Collection of your personal information

Types of information we collect

The types of personal information we collect, and hold may include name, contact details, identification, affiliations, dealings and transactions with us, including by phone, email and online.

If you apply to work with us, we may also collect information about your education, experience, character and background checks including eligibility to work, vocational suitability, identity, reference, directorship, financial probity, and criminal record checks.

In addition, if you join us, we collect information about your employment or engagement including information about your performance, conduct, use of our IT resources and payroll matters.

Collecting sensitive information

Sometimes we may need to collect sensitive information about you, for example:

  • health information, to make suitable accommodations to support your application for a role;
  • criminal history information to undertake a criminal history check; or
  • information relating to your dietary needs when attending one of our events.

 

How we collect personal information

We endeavour to only collect the personal information we need for our functions or activities.

The main way we collect personal information about you is directly, that is, when you give it to us. For example, we collect personal information such as contact details and complaint, review, and details when:

  • we conduct our administrative and business functions;
  • you purchase our services;
  • we process your orders and payment transactions;
  • we respond to your enquiries and requests;
  • you apply for a job vacancy at Ctrl;
  • we obtain your feedback about our products;
  • you ask for access to information the Ctrl holds about you; or
  • you notify the Ctrl about a data breach.

Indirect collection

While conducting our business, handling and resolving a complaint, we may also collect personal information (including sensitive information) about you indirectly. This may be from publicly available sources or from third parties, such as our customers or partners, or other third-party companies such as law enforcement agencies, recruitment companies.

Collecting through our website

Ctrl’s public website is hosted in Australia. As you navigate our website, certain information may be collected passively, including your Internet Protocol (IP) address, browser type, domain names, times, and operating system. We may also collect information about how you found our website and how you interact with our website. This information helps us understand the effectiveness of our advertising, as well as our website layout and content. We do not intentionally gather personal information about visitors who are minors. If you use Risk Intelligence Overlay (RIO), we collect information about how you use and interact RIO, to help us improve the product and identify and manage bugs.

Cookies and tracking pixels

Our website may use cookies and tracking pixels from time to time.

Cookies are small data files transferred onto computers or devices by websites for record-keeping purposes and to enhance functionality on the website. The cookie allows us to maintain the continuity of your browsing session and remember your details and preferences when you return.

If you do not wish to have cookies placed on your computer, you can configure your web browser application to reject cookies however some parts of our website may not function fully as a result.

Tracking pixels are small pieces of code, often generated by third-party suppliers, placed on our website to collect information about how you interact with our website, enabling us to personalise the content you see. We may share information collected by tracking pixels with third-party suppliers (such as Meta), to help us deliver advertising content to you, for example, displaying an advertisement on LinkedIn after you have browsed our website. When we use tracking pixels for direct marketing, we will provide you with an opportunity to opt out.

Email lists

We use third-party providers to manage our mailing lists. Analytics are performed to give us insights on when you click on links in the email, or when you download the images in the email. These insights include which emails you open, which links you click, your mail client (e.g. ‘Outlook’ or ‘iPhone’), if your action occurred on ‘mobile’ or ‘desktop’, and the country geolocation of your IP address (the IP address itself is not stored).

Social networking services

We use social networking services such as Facebook, Instagram and LinkedIn to communicate with the public about our work. When you communicate with us using these services we may collect your personal information, but we only use it to help us to communicate with you and the public. The social networking service will also handle your personal information for its own purposes. These services have their own privacy policies, which you can access on their websites.

 

Use and Disclosure

We primarily use and disclose personal information for the purposes for which it was given to us that are directly related to one of our functions and activities. Common situations in which we disclose information are detailed below.

  • When clients ask to be on an email or mailing list so that we can send them information about our products.
  • When customers ask to respond to quote to be emailed or posted with contact information.
  • To manage and improve our business and services, including reporting to our investors.
  • If you are a contact person for one of our clients or suppliers, personal information about you may be used by us in our dealings with the customer or supplier you represent.
  • We may exchange your personal information with third parties including your organisation, providers that host our website servers, manage our IT and manage our human resources information, government authorities, and our advisors and contractors.
  • If you apply to work with us, we may exchange your personal information with background checking services, recruiters, law enforcement agencies, referees and your current and previous employers.
  • If you join us, we may exchange your personal information with other employers seeking a reference about you, providers of payroll, superannuation, banking, and training services. Your professional, biographical information may be shared with clients and prospective clients.

 

Disclosure to service providers

Ctrl uses a number of service providers to whom we disclose personal information. These include providers that host our website servers, manage our infrastructure and manage our human resources information.

Disclosure of sensitive information

We only disclose your sensitive information for the purposes for which you gave it to us or for directly related purposes you would reasonably expect or have agreed to, for example, to handle a complaint.

Overseas Recipients

We may disclose personal information to our related bodies corporate, third party suppliers and service providers located overseas. Except where specific individual consent has been obtained, we take reasonable steps to ensure that the overseas recipients of your personal information do not breach the privacy obligations relating to your personal information.

We may disclose your personal information to entities located overseas, including the following:

  • Our data hosting and other IT service providers, located in the US and EU;
  • Our clients and their related entities located in foreign countries, to the extent that we are acting on their behalf or at their direction in using, storing, or collecting your personal information.

Storage and security of personal information

We take steps to protect the security of the personal information we hold from both internal and external threats by:

  • regularly assessing the risk of misuse, interference, loss, and unauthorised access, modification or disclosure of that information;
  • taking measures to address those risks, for example, we keep a record (audit trail) of when someone has added, changed or deleted personal information held in our electronic databases and regularly check that staff only access those records when they need to; and
  • conducting regular audits to assess whether we have adequately complied with or implemented these measures.

 

Access and Correction

If you wish to seek access to the personal information we hold about you, or request that we change that personal information, please contact our Privacy Officer (details below).

 

Policy Updates

This Policy may change from time to time and is available on our website.

 

Complaints

Please contact us if you wish to make a complaint about how we have handled your personal information. We may request additional details from you regarding your concerns and may need to engage or consult with other parties to investigate and deal with your issue. We will keep records of your request and any resolution.

For any questions and notices, please contact us at:

Privacy Officer

Ctrl

T: +61 1 300 578 528

E: info@ctrl.co

If you are unsatisfied after your complaint has been addressed by Ctrl, you may contact the Office of the Australian information Commissioner by visiting their website, www.oaic.gov.au.