How we handle your information.

CYBER THREAT INTELLIGENCE GROUP PTY LTD (ABN 13 680 647 349), trading as CyberTI®, is the entity responsible for the personal information referred to in this policy. In this policy, "we", "us" and "our" mean that company.

This policy explains, in general terms, how we may collect, hold, use and disclose personal information, and how you can seek access to or correction of information we hold about you. It applies to this website at https://www.cyberti.com.au, to enquiries made with us, and to our business generally.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Questions about this policy can be sent to info@cyberti.com.au.

Dealing with us anonymously

You may deal with us anonymously or under a pseudonym where it is lawful and practicable for us to allow it — for example, you can browse this website without identifying yourself, and we do not require an account to do so.

In many cases, though, providing contact details is necessary. If you ask us to respond to an enquiry, arrange a demonstration or scope an engagement, we generally need enough information to reply to you and to be reasonably satisfied we are dealing with the person we believe we are dealing with. Where we cannot act on an anonymous request, we will explain what we need and why.

Personal information we collect

We collect only the personal information reasonably needed for our functions and activities. What we collect depends on how you interact with us.

Some of what our contact and demonstration request forms ask for is needed for us to respond to you; the rest is optional and simply helps us understand your enquiry. This may include:

Your name, work email address and the organisation you work for.

A phone number, where you choose to give one.

The content of your enquiry, including any details you choose to share about your environment, tooling, timelines or compliance drivers.

For demonstration requests, the service area you are interested in and, optionally, the approximate size of your organisation.

How we collect personal information

We generally collect personal information directly from you — for example through our website forms, by email, by telephone, at meetings and events, or in the course of delivering services you have engaged us for.

We may also collect information about you from your employer or a colleague who refers you to us, from publicly available professional sources such as your organisation's website or LinkedIn profile, and from service providers who support functions we ask them to perform.

If we receive personal information we did not solicit and could not lawfully have collected ourselves, we will destroy or de-identify it as soon as practicable, where it is lawful and reasonable to do so.

We do not seek sensitive information — such as health information, or information about race, religion, political opinions or criminal record — through this website, and you should not send it to us through our forms. Where sensitive information is genuinely required for an engagement, we will ask for your consent first and explain why it is needed.

Why we collect and use your information

We use personal information for the purpose it was collected, for related purposes you would reasonably expect, and for any other purpose you consent to or that the law requires or authorises. This may include:

Responding to enquiries and arranging demonstrations.

Scoping, quoting, negotiating and delivering security services, and managing our relationship with you and your organisation.

Providing, supporting, securing and improving our services and this website.

Record-keeping, including for accounting, insurance and dispute-resolution purposes.

Protecting our systems, our clients and ourselves from fraud, misuse and security threats.

Meeting our legal, regulatory, professional and contractual obligations.

Marketing communications

We are a business-to-business security provider, not a high-volume marketer. Replying to your own enquiry is a service communication, not marketing, and is not something you can opt out of.

We will only send commercial marketing messages where you have consented, or where the Spam Act 2003 (Cth) otherwise permits it because of an existing business relationship connected to the message. We do not sell, rent or trade contact details to third parties for their own marketing.

Commercial electronic messages we send identify us as the sender, include accurate contact details, and contain a working unsubscribe facility that stays available for at least 30 days. Unsubscribing is free and does not require you to log in or provide further personal information.

We action unsubscribe requests within 5 business days, as the law requires. You can also opt out at any time by emailing info@cyberti.com.au and asking us to stop. If you opt out, we may still contact you where necessary about a service we are actively providing to you.

Cookies and website analytics

This website is hosted on the Wix platform, which sets a small number of essential cookies the site needs to work and, where a cookie banner is shown, to remember the choice you make in it. These cookies are not used to identify or track you across other websites.

We use Google Analytics and Hotjar to understand how this website is used and where pages could be improved. Both are loaded through Google Tag Manager on every visit, before you make a choice in the cookie banner and regardless of the choice you make in it. That is a limitation of how these tags are currently installed on the hosting platform, and we would rather tell you than let the banner imply otherwise. Google Analytics records pages viewed, scrolling, outbound and file-download clicks, and form interactions, and keeps that data for 14 months. Hotjar records a replay of the session — including mouse movement, clicks and typing — for every visit; it masks digits and email addresses automatically, but not other free text. Our cookie notice sets out what each of them stores in your browser.

We do not use this website to run advertising, remarketing or social media tracking campaigns. If we introduce any other non-essential technology in future, it will load only after you have accepted it, and we will update our cookie notice and this policy first.

Separately from cookies, the infrastructure that serves this website keeps standard technical logs — such as IP addresses, browser type, the pages requested and the time of the request. These exist so the site can be run securely and reliably, are used for security, troubleshooting and capacity purposes, and are not used to build a profile of you.

Clearing this site's data in your browser settings removes the choice you made and brings the banner back on your next visit. It does not currently stop the analytics described above, because those load ahead of the banner — the only reliable way to block them is a browser or extension that blocks Google Analytics and Hotjar directly, and the site works normally if you do.

Automated decision-making

We do not use computer programs to make, or to substantially help make, decisions about you that could reasonably be expected to significantly affect your rights or interests. Enquiries submitted through this website are read and actioned by our people.

If that changes, we will update this policy first to describe the kinds of information and decisions involved.

When we disclose personal information

We do not sell personal information. We may disclose it where necessary for a purpose described in this policy, where you have consented, or where the law requires or authorises it. This may include disclosure to:

Service providers who perform functions on our behalf — for example, email and productivity platforms, cloud hosting and infrastructure, enquiry and relationship management tools, accounting, and professional advisers. They are subject to confidentiality obligations and may use information only to provide their service to us.

Our insurers and legal advisers, where reasonably necessary to obtain advice, make or defend a claim, or comply with a policy of insurance.

Anyone required or authorised by Australian law, or by a court, tribunal, regulator or law enforcement agency.

Anyone we reasonably believe should be told in order to lessen or prevent a serious threat to life, health or safety.

A purchaser or prospective purchaser in connection with a sale or restructure of our business, subject to confidentiality obligations.

Any other person you have expressly authorised us to disclose to.

Overseas disclosure

Some of the technology providers we rely on operate globally, so personal information we hold may be stored or accessed outside Australia.

This website is hosted by Wix, which stores the enquiries you submit, the contact record we create from them and the emails we send in reply, in the United States and in other countries where Wix operates. Google receives website usage data through Google Analytics and Google Tag Manager, and processes it in the United States and other countries. Hotjar receives the session recordings described in our cookie notice and processes them in the European Union. If you open our news page, LinkedIn receives your connection details in the United States and Ireland. Our error reporting is handled by Sentry in the United States.

Before we disclose personal information to an overseas recipient, we take steps that are reasonable in the circumstances to try to ensure the recipient does not breach the Australian Privacy Principles — ordinarily by contract, by relying on a provider's published data protection commitments, and by preferring providers with recognised security certifications.

If you would like to know more about where information relevant to you is held, contact us at info@cyberti.com.au and we will tell you what we reasonably can.

Information we handle during client engagements

When we deliver security services, we may encounter personal information belonging to our client's staff, customers or other individuals — for example in log data, alerts, endpoint telemetry, or findings from a security assessment.

In that context our client is generally the entity responsible for that information and we handle it on their behalf, under the confidentiality, security and data handling terms of the written agreement covering that engagement. We use it only to deliver the engaged services, and we return, destroy or de-identify it as that agreement requires.

If you are an individual whose information we have encountered in the course of work for one of our clients, the appropriate first point of contact is usually that organisation, because it holds the relationship with you and the context for the information. We will assist our client to respond to you as our agreement with them requires.

How we secure your information

We take steps that are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. As a cybersecurity provider, we treat this as an operational discipline rather than a policy statement.

These steps may include access controls and multi-factor authentication, encryption of information in transit and at rest where appropriate, logging and monitoring, hardened and patched systems, vetting of personnel, confidentiality obligations on staff and contractors, and periodic review of our providers.

No method of transmission over the internet and no method of electronic storage is completely secure. While we work to protect your information, we cannot guarantee absolute security, and information you send us over the internet is sent at your own risk. Please do not send confidential technical detail, credentials or sensitive information through our website forms — contact us first and we will arrange a secure channel.

Data breaches

We maintain a data breach response plan. If we suspect that personal information we hold has been lost, or accessed or disclosed without authorisation, we will contain the incident and assess it as promptly as we reasonably can.

Where we determine that an eligible data breach has occurred — meaning the breach is likely to result in serious harm to an individual — we will notify the affected individuals and the Office of the Australian Information Commissioner as soon as practicable, and we will tell you what happened, what information was involved and what you can do in response.

How long we keep your information

We keep personal information only for as long as we reasonably need it for the purposes set out in this policy, or for as long as the law requires us to keep it. When it is no longer needed and we are not required to retain it, we take reasonable steps to destroy it or to permanently de-identify it. As a general guide:

Enquiry and demonstration request details, where no engagement follows: generally retained for up to around 24 months from our last substantive contact with you, then deleted.

Records relating to an engagement, including correspondence and reports: generally retained for around 7 years after the engagement ends, reflecting our record-keeping practice and the period in which a claim could typically be brought.

Financial and tax records: retained for the period required by Australian law, currently 7 years.

Marketing preferences and unsubscribe records: retained for as long as we send marketing communications, so that we can honour your choice and demonstrate that we have.

Information held on behalf of a client during an engagement: retained, returned or destroyed as that engagement's written agreement requires.

Accessing and correcting your information

You may ask us for access to the personal information we hold about you, and you may ask us to correct it if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading. Send your request to info@cyberti.com.au, describing what you are seeking so that we can locate it.

We will ask you to verify your identity before we release information, so that we do not disclose your details to someone else. There is no charge for making a request. We may charge a reasonable fee to cover the cost of giving access in some cases — for example, retrieving a large volume of archived material — and we will tell you the likely cost before we incur it.

We aim to respond within 30 days. If we reasonably need longer, we will tell you why and agree a reasonable extension with you.

In limited circumstances the Privacy Act permits us to refuse access or a correction — for example, where giving access would unreasonably affect another person's privacy, would reveal a confidential commercial decision, or would prejudice a legal claim or a law enforcement matter. If we refuse, we will tell you in writing why, and how you can complain about that decision. If we decline to correct information, you may ask us to attach a statement of your view to the record, and we will do so.

Privacy complaints

If you believe we have handled your personal information in a way that breaches the Australian Privacy Principles, please tell us first so we have the chance to put it right. Email info@cyberti.com.au with the details of your concern and how you would like it resolved.

We aim to acknowledge your complaint within 5 business days, investigate it, and give you a written response within 30 days where we reasonably can. If the matter is complex and we need longer, we will tell you before that time is up, explain why, and agree a new date with you.

If you are not satisfied with our response, or we have not responded in a reasonable time, you can refer the matter to the Office of the Australian Information Commissioner. The OAIC accepts complaints and publishes guidance on the process at oaic.gov.au, and will generally expect you to have raised the matter with us first.

Children and young people

This website and our services are directed at businesses and the people who work in them. They are not directed at children, and we do not knowingly collect personal information from anyone under 18 through this website.

If you believe a child has provided personal information to us, contact us at info@cyberti.com.au and we will delete it.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our technology, or the law. The current version is always published on this page, and the date it was last updated is shown at the top.

Where a change is significant, we will take reasonable steps to bring it to your attention. We encourage you to review this page periodically.

How to contact us about privacy

For any privacy question, access or correction request, or complaint, email us at info@cyberti.com.au. Please include enough detail for us to identify you and understand what you are asking for.

Our full legal identity is CYBER THREAT INTELLIGENCE GROUP PTY LTD, ABN 13 680 647 349, trading as CyberTI®.

Written to be kept to, not to be clicked past

These pages are short and plainly worded on purpose, so what they describe stays close to what we actually do — not a list of everything a lawyer could think to disclaim.

Ready to see your attack surface the way an attacker does?

Book a walkthrough with an Australian-based security engineer. No scripted demo, no obligation.

Both forms deliver to info@cyberti.com.au.