Book a vCISO annual plan before Christmas and get GRC platform for FREE. Claim the offer

Skip to content

Privacy Policy

How we collect, use, and protect your personal information.

What is a privacy policy?

A privacy policy explains what personal information an organisation collects, why it collects it, and how that information is used, disclosed, stored and deleted. CyberNinja's policy complies with the Australian Privacy Act 1988 (Cth) and the New Zealand Privacy Act 2020.

Last updated: 13 October 2026

1. About this policy

This Privacy Policy explains how CyberNinja Consulting Pty Ltd (“CyberNinja”, “we”, “us”) collects, uses, stores and discloses personal information. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) and, for New Zealand clients and individuals, the Privacy Act 2020 (NZ) and its Information Privacy Principles.

2. Personal information we collect

We collect only the personal information we need to run our business and deliver our services. This may include:

  • Contact details: name, email address, phone number, company and job title, provided through enquiry forms, consultation bookings and report requests.
  • Free self-assessment tools: answers to our free Cybersecurity Gap Assessment are processed in your browser and are only sent to us if you ask for a report by email.
  • Correspondence: emails, messages and meeting notes when you contact us or work with us.
  • Engagement information: personal information about client staff that appears in information our clients share with us during an engagement, such as names and roles in policies, access lists or audit evidence.
  • Job applicants and contractors: resumes, qualifications, references and contact details.
  • Website use: technical information such as IP address, browser type and pages visited, collected through cookies and analytics.

We do not collect sensitive information, such as health information, unless a service requires it and you have given your explicit consent. If sensitive information appears in client information we receive, we only use it as needed for that engagement.

3. How we collect it

We collect personal information directly from you, automatically through cookies and analytics when you use our website, and from third parties such as your employer or referral partners, with your knowledge and consent. We may also collect business contact details from public sources such as LinkedIn or company websites where they relate to your professional role.

4. How we use it

We use personal information to:

  • Respond to enquiries, provide quotes and deliver our services.
  • Send assessment reports you have requested.
  • Manage our relationships with clients, partners and suppliers.
  • Send marketing emails where you have consented or where the Spam Act 2003 (Cth) otherwise allows it. Every marketing email includes an unsubscribe link.
  • Improve our website using aggregated analytics.
  • Recruit staff and contractors.
  • Meet our legal and regulatory obligations.

We do not use personal information for unrelated purposes without your consent.

5. Use of AI tools

We use business AI tools, under company accounts, to help prepare and review our work. These tools are provided on terms that do not allow the provider to use our data to train its models. Everything produced with AI is reviewed by a person before it is used or sent to a client.

We do not use personal information in computer programs to make decisions that could significantly affect an individual’s rights or interests without human involvement.

6. Who we disclose it to

We share personal information with service providers that help us run our business, under contracts that require them to protect it. These include:

  • Vercel Inc. for website hosting, with servers in Sydney and content delivered through a global network.
  • Resend Inc. for transactional email from our website.
  • Google (Google Workspace and, where you consent, Google Analytics) for email, file storage, collaboration and website analytics.
  • Vercel Analytics for cookieless, aggregated website analytics.
  • HubSpot for customer relationship management.
  • Xero for accounting and invoicing.
  • Slack and Atlassian (Jira) for internal communication and task management.
  • Scytale for managing our information security and compliance programme.
  • Anthropic (Claude) for business AI assistance.
  • Apple for managed devices and accounts.
  • Professional advisers bound by confidentiality, and law enforcement agencies or regulators where the law requires it.

We do not sell or rent personal information.

7. Overseas disclosure

Some of our service providers store or process personal information outside Australia, including in the United States and the European Union, and in other countries where they operate. Before using a provider, we review its security and privacy practices and take reasonable steps to make sure it handles personal information in line with the APPs.

8. Cookies and analytics

Essential cookies are always on. Analytics cookies are only set with your consent.

We use Google Consent Mode. If you decline analytics, Google Analytics runs in a restricted mode that sets no cookies and sends only an anonymous consent signal.

A cookie notice appears on your first visit. You can change your choice at any time using the Cookie Settings link in the website footer or through your browser settings.

9. How we protect it

We operate an information security management system aligned with ISO/IEC 27001:2022. Personal information is protected through access controls, multi-factor authentication, encryption in transit and at rest, managed devices, logging and monitoring, supplier security reviews and staff training.

10. How long we keep it

  • Website enquiries: up to 3 years after your last contact with us.
  • Marketing subscriptions: until you unsubscribe or ask us to delete your details.
  • Client contracts, statements of work and invoices: 7 years after the transactions they relate to, in line with the financial record-keeping requirements of the Corporations Act 2001 (Cth).
  • Client engagement working files: for the duration of the engagement, then deleted or returned within 30 days of the engagement ending, unless the client contract says otherwise.
  • Unsuccessful job applications: 12 months after the role is filled.

When personal information is no longer needed, we securely delete or de-identify it.

11. Your rights

You can ask to access, correct or delete the personal information we hold about you, or opt out of marketing, by contacting us using the details below. We will respond within 30 days. In limited cases allowed by law we may refuse a request, and if so we will tell you why.

12. Data breaches

If a data breach involving your personal information is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. For New Zealand individuals, we will notify you and the Office of the Privacy Commissioner where required by the Privacy Act 2020 (NZ).

13. Complaints

If you have a concern about how we have handled your personal information, please contact our Privacy Officer. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact the OAIC at oaic.gov.au, or the New Zealand Office of the Privacy Commissioner at privacy.org.nz.

14. Third-party websites

Our website may link to other websites. We are not responsible for their privacy practices, so please read their privacy policies. More information about how we protect data is available on our Security page.

15. Contact us

Privacy Officer, CyberNinja Consulting Pty Ltd

16. Changes to this policy

We review this policy at least once a year and update it when our practices change. The current version is published on our website with its effective date, and is available on request.