Privacy Notice

1. Who this notice applies to

This notice applies to personal information VerneIT collects through this website, through direct enquiries, and in the course of delivering consulting engagements to client organisations.

2. Information we collect

We collect only the information we need to respond to enquiries and deliver engagements. This is usually business contact information provided to us directly.

• Name, business email address, phone number, and the organisation you represent.
• The content of your enquiry or correspondence with us.
• Engagement records, including notes, documents, and correspondence created during a program of work.
• Technical information collected automatically by this website, such as IP address, browser type, pages viewed, and referring site.

3. How we use it

We use personal information to respond to enquiries, prepare proposals, deliver and administer engagements, meet client security and clearance requirements, comply with legal and record-keeping obligations, and improve this website.

We do not sell personal information. We do not use it for automated decision-making, and we do not send marketing communications to people who have not asked to receive them.

4. Client and third-party information

During engagements we may be given access to systems and records containing personal information belonging to a client organisation. In those cases we act on the client's instructions as a service provider, and the client's own privacy policy governs how that information may be used. We handle it under the confidentiality, security, and clearance terms of the engagement contract, and we do not use it for any other purpose.

5. Disclosure

We may disclose personal information to delivery specialists engaged by VerneIT to work on a program, to our professional advisers, and to service providers who host our systems. Anyone we engage is bound by confidentiality obligations and may use the information only for the purpose we provided it.

We may also disclose information where required or authorised by law.

6. Overseas disclosure

Some of the software we use to operate our business — including email, document storage, and website analytics — is provided by vendors that may store data outside Australia. Where that occurs, we take reasonable steps to ensure the provider handles personal information consistently with the Australian Privacy Principles. Engagement material subject to Australian Government data residency requirements is held in Australia.

7. Security

We hold information in access-controlled systems with multi-factor authentication and encryption in transit and at rest. Access is limited to the people who need it to perform their role on an engagement. We retain information only as long as it is needed for the purpose it was collected or as required by law, and then delete or de-identify it.

8. Access and correction

You may request access to the personal information we hold about you, or ask us to correct it, at any time. We will respond within 30 days. If we decline a request we will explain why in writing. There is no charge for making a request.

9. Complaints

If you believe we have mishandled your personal information, contact our privacy officer using the details below. If you are not satisfied with our response, you may refer the matter to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

10. Changes to this notice

We may update this notice from time to time. The effective date at the top of the page shows when it was last revised. Material changes will be noted on this page.