Privacy Policy
This privacy policy applies to CyberCert Pty Ltd and our handling of personal information. CyberCert (ABN 87 662 681 423) is a technology company that provides Software as a Service (SaaS) and Platform as a Service solutions for governments and organizations (i.e. our customers).
Due to the commercial nature of our services, CyberCert, for the most part, collects the information of individuals in their professional capacity. For example, we collect information of the person who registers or activates the organization’s administrator or user account, as part of their role within the customer organization.
That being said, we recognize and value the protection of your personal information, which is an important part of our relationship with customers.
This Privacy Policy explains how we handle personal information. As an Australian company, we apply the privacy principles set out in the Australian Privacy Act 1988 (Cth), which guide how we collect and manage personal information. Importantly, we:
- give you clear information about our personal information handling practices,
- only collect personal information that is necessary for our functions,
- understand the purpose of our services, and restrict our use and disclosure of personal information in that regard, and
- take reasonable steps to keep the personal information we have secure.
Personal Information
Personal information is information that identifies a person (or could reasonably lead to them being identified).
When providing our services, we collect some personal information. The types of personal information we collect and process depends on our relationship with you. We generally collect and process personal information from the following groups of people:- Website visitors – We collect some personal information when people visit this website.
- Customers and prospective customers – Our customers are generally organizations, companies, corporations and government departments or agencies. The personal information we collect includes, for example, details of the contact person registered on the organization’s administrator or user account.
- Customers that use our SaaS and PaaS services – When our customers activate their administrator or user account, we require some personal information to register the account. This information is limited and relates to details of the person in their professional capacity, i.e. business email and phone.
- People who are interested in working for CyberCert – We collect personal information of job applicants, and (where relevant) an applicant’s referees.
Personal Information We Collect
The types of personal information we collect and process are set out below. We generally collect this information when you interact with our platform and website. We may also collect this information in person, via email, mail or phone.
We collect and use analytics and cookie data from a person’s use of the website www.cybercert.ai, to understand how people interact with our site.
We generally collect this information through the use of cookies. More information about this is contained in our Cookie Notice.
Information we collect and process when you use our website and platforms includes:- Your device’s IP address
- The date and time that you visited our website
- Whether you have been to our website before
- What site referred you to our website
- Approximate location of the device you used to interact with our website
If you are a contact person for an organization, we collect and process minimal personal information when you ask about our platforms and services. Inquiries can be made via email, post, or when you submit an online "contact us" form.
Information we collect and process may include the name of an organization’s contact person, the organization’s preferred phone, email and address details, and details of the inquiry or correspondence with us.We may use the details of a customer’s nominated contact person to communicate with our customer, including in regards to the platform, our services, sales, and accounts. Information we collect and process may include the name of the customer’s contact person, the organization’s preferred phone, email and address details.
We may send promotional emails to a customer’s nominated contact person, where they have opted to receive marketing material. Whilst these emails may be sent to a customer’s contact person, they are intended for our customers, i.e. organizations. If at any time the customer wishes not to receive promotional communication from us, they may unsubscribe using the unsubscribe method described in the email.We collect and process limited personal information to register or activate our customer’s CyberCert account. We collect details of the customer’s nominated person via our platform when you register your organization’s account, including:- First name
- Last name
- Country location
- Business mobile number
- Business email
- Password
- Role within the customer organization
- Profile picture (where it includes an image of a person)
When a customer uses our platform, they may provide us with contact information or other personal information that relates to an individual in their professional capacity, working for our customer’s suppliers or customers. We collect and use this information for the purpose of providing our cybersecurity services to our customers.A customer may submit a question or request support by submitting a form located within the customer’s administrator or user account. When the customer requests support, we collect the name of the customer’s contact person, business email address and details of the question, issue or support request, and our correspondence with you in regard to the request.We collect and process payment information to provide our products and services. When customers provide payment information to us, they will usually provide the payment information of the customer organization; not payment information of an individual.
There may be limited circumstances where personal payment information is provided to and processed by us (such as name on card, card type, amount purchased). We do not knowingly receive payment information of a person; rather, we ask our customers to use their approved corporate payment facilities.We collect and process feedback information to improve the types and quality of services offered, and the manner in which those services are provided to customers. We may collect your opinions and feedback by conducting surveys or market research, or by seeking other information from you on a periodic basis.When you submit a request to access or correct your personal information, or submit a privacy complaint, we use this information to process your request or investigate your concern, and to communicate with you. We collect and use your name, contact information and details regarding your request or concern.When you apply for a job with us, we collect and process your personal information as part of the application, and potentially, the hiring process. Recruitment information we collect and process may include name, email, phone, address, resume, cover letter details and references.Why we collect and use Personal Information
We collect and process personal information for a number of reasons, which have been described in the table below:
We collect and use... Purpose Analytics Data To analyze the usage of our website and platform, including through the use of cookies, to improve your user experience. Inquiries Information To answer your questions about our cybersecurity maturity assessment platform and services Customer Contact Information To enter into a contract with you (e.g. Terms of Use)
To provide you with access to the CyberCert platform
To communicate with you as part of our cybersecurity services
To send our customers promotional emails. Whilst these emails may be sent to a customer’s contact person, they are intended for our customers organizations.Help And Support Information To provide help and support in our customer’s use of the CyberCert platform Payment Information To accept payment for your purchase of our products or services Feedback Information To improve the types and quality of services offered, and the manner in which those services are provided to customers Access And Correction Requests, and Privacy Complaint Information To process your request or investigate your concern, and communicate with you Recruitment Information To process your job application and, if you are successful, to offer you a job and commence your employment Who we share your Personal Information with
CyberCert uses external parties (i.e. vendors) to provide services and functions on our behalf. In order for vendors to provide these services, we may share personal information that relates to the services being provided. We ensure that vendors only process personal information for the purpose it was provided to them, and not for any other purpose.
Our primary vendors that provide services on our behalf include:
- Google Analytics – provide analytics services, refer to the Google Privacy Policy.
- Google - provides data storage and SaaS related services, refer to the Google Privacy Policy.
- Amazon Web Services (AWS) – provides public cloud and IaaS related services, refer to the AWS Privacy Notice.
- HubSpot – provides our cloud based CRM services, refer to the HubSpot Privacy Policy.
- ZenDesk – provides our customers efficient help desk and customer service, refer to the Zendesk Privacy Policy.
- Stripe – provides our customers a secure payment portal, refer to the Stripe Privacy Policy.
We also have contracts with other domain specialists, subject matter experts, management consultants and information technology professionals to assist in providing our services. There may be limited instances where we share your information with these external parties for the purpose of providing services on our behalf.
We do not sell or share personal information with any advertisers, sponsors, content providers, media outlets, law enforcement or other person or entity, unless:
- We have your express permission, or
- There is a lawful ability or requirement for us to do so.
Anonymity
If you contact us with a general question, we may interact with you anonymously or through the use of pseudonym.
However, due to the nature of our business, we are unable to provide our cybersecurity maturity assessment platform anonymously, as we require factual information in order to register customer accounts and provide our cybersecurity maturity assessment services.
How we manage Personal Information
At CyberCert, we securely manage and dispose of personal information that we collect and process, as outlined below:
We store personal information that we collect using public cloud services that are secured using best practice authentication techniques to protect your data from unauthorized access, modification or disclosure. CyberCert stores data, including personal information, with Google and Amazon Web Services. The information is stored in the jurisdiction in which we collected it from (for example, where personal information is collected from within the US, the data is stored on servers located int the US) when it is possible to do so.
We also use vendors to store specific types of personal information (such as analytics and accounting information) on our behalf. The personal information stored by vendors relates directly to their functions and services, and is stored in accordance with our contract with these providers.CyberCert have implemented a range of data security practices and controls, including (but not limited to):- Use of access controls, including multi-factor authentication,
- Security awareness training,
- Encryption of personal information during transit and at rest where possible,
- Personal information is stored and backed up in secure offsite locations,
- Back-ups of data is regularly tested for full operational recovery,
- Use of anti-virus on all company workstations and laptops, and
- Installation of firewalls where our network connects to the public internet.
Protection of personal information from unauthorized access, disclosure, alteration or loss is a priority for us. Any concerns about the security of personal information collected or processed by CyberCert should be reported to us at using our contact details below.We keep your personal information for different periods, depending on the purpose that it was collected for. Where we no longer require personal information for the purpose it was collected, we will securely destroy that data.Accessing and correcting your Personal Information
CyberCert supports your right to:
- Access personal information we hold about you, or
- Correct your personal information, where you think that it is inaccurate, incomplete or out of date.
If you would like to access personal information we hold about you, we are happy to tell you what it is. We will not, however, tell someone else what personal information we hold about you (unless you permit us or there is a lawful ability or requirement for us to do so).
If you think the personal information we hold about you is incorrect, out of date or misleading, we are happy to correct it.
Your Legal Rights
Your rights include the following:
- You may request us to stop sending you marketing.
- You may request us to stop using your personal information where we are doing so under legitimate interests unless it is needed for dealing with legal claims or we have other compelling legitimate reasons that override your rights.
- You may access the personal information we hold on you.
- There are some limited exceptions to this right, such as information relating to others who have not consented to the disclosure of their information and information which is legally privileged.
- You may ask us to correct the personal information that you have shared with us if that information is inaccurate. We are not able to amend any data that has been created as a result of a transaction with us.
- You may ask for personal information which identifies you to be removed (anonymized). To do this the information that identifies you will be removed from our active systems. However, a separate and restricted copy of the identifying information may be kept for 7 years to meet the obligations we have to law enforcement, national authorities and legal proceedings. This right only applies under data protection laws in the European Union, the UK and some other countries.
We will handle all requests in accordance with applicable law. However, depending on the right you wish to exercise, and the nature of the personal information involved, there may be legal reasons why we cannot grant your request.
Subject to law, your personal data will be deleted upon request by you.
To exercise any of these rights, including to delete your personal data, please contact us via the “Help” button located on this website.
Questions and Concerns?
If you have a question about this Privacy Policy or are concerned about how we handle personal information, please contact us at:
Via the Help & Support contact form located in the bottom corner of this pageCyberCert Pty Ltd
GPO Box 1515
Brisbane, QLD 4001
AustraliaIf you have made a privacy compliant and are not happy with how we responded to your concern, you are able to contact the Office of the Australian Information Commissioner (OAIC). The OAIC’s process is available here.
Updates to this Privacy Policy
We may decide to update this Privacy Policy to ensure that our personal information handling practices are correctly reflected. If we make a significant change to this policy, we will notify you by publishing a notice on our website.
This policy was last revised on 1 Dec 2024.