Privacy Policy
This Privacy Policy explains how Jordan Gall (ABN 68 170 885 814) (“we”, “us”, “our”) collects, uses, discloses and protects personal information. It covers our website jordangall.com, our online tools, our quote builder, our services and our hosted applications.
As at the date of this policy, the Privacy Act 1988 (Cth) small business exemption may apply to us. Whether or not it does, we choose to handle personal information in line with the 13 Australian Privacy Principles (APPs). As a cyber security business, we think that is the least we should do. [CONFIRM with lawyer whether the business is currently an APP entity.]
1. What we collect
We only collect personal information that is reasonably necessary for what we do. Depending on how you deal with us, this may include:
- Contact details: your name, business name, email address and phone number.
- Quote requests: when you ask the quote builder to email you a quote, we collect your contact details, the services and team size you selected, any message you add, and your consent to be contacted about the quote.
- Risk Check answers: your answers to the Risk Check questions and the results we generate.
- Email Checker lookups: the domain name you enter. The checker reads public DNS records only (such as SPF, DKIM and DMARC); it does not access any mailbox.
- Hosted service accounts: your name, email address, sign-in and multi-factor authentication details, subscription details, and the content you store in the hosted application.
- Billing information: invoices and payment records. Card payments are processed by Stripe; we do not see or store your full card number.
- Service delivery information: when we look after your systems, we may access information about your staff, accounts, devices, security alerts, sign-in logs and settings, and the results of training or practice scam emails.
- Website usage data: IP address, browser and device type, pages viewed and referring site. Analytics data is only collected if you accept analytics cookies (see section 7).
We do not intend to collect sensitive information (such as health information) through our website. Please do not send it to us unless we specifically ask for it for a legitimate purpose.
2. How we collect it
- Directly from you: through our forms, quote builder, Risk Check, Email Checker, email, phone, or when you engage us or sign up to a hosted service.
- Automatically: through our website, security services such as Cloudflare, and (with your consent) analytics cookies.
- From your organisation's systems: when your business engages us, we access information in its Microsoft 365, Google Workspace, device management, backup and security tools as needed to deliver the services.
- From others: occasionally through referrals from existing clients or partners.
3. Why we use it
- to respond to enquiries and prepare, send and follow up on quotes you request;
- to generate your Risk Check and Email Checker results;
- to provide, manage, secure and improve our services and hosted applications;
- to bill you and keep business records;
- to understand how our website is used and improve it (only with your consent for analytics); and
- to comply with our legal obligations and protect our rights.
We do not send newsletters or marketing emails. If that ever changes, we will only send them with your consent, and every message will include an unsubscribe option, as the Spam Act 2003 (Cth) requires.
4. Automated decisions
Our quote builder and Risk Check produce automatic results: an indicative price and an indicative risk level. These are information for you, not decisions about you. They do not determine whether we will work with you or on what terms; a person (Jordan) reviews every engagement. We do not use computer programs to make decisions that could reasonably be expected to significantly affect your rights or interests. If that changes, we will update this policy as APP 1.7 and 1.8 require.
5. Who we share it with
We do not sell personal information. We share it only as needed with:
- Service providers who help us run the business, including Cloudflare (website security and delivery), our email provider [CONFIRM: e.g. Microsoft 365 / Apple iCloud / SMTP2GO], Stripe (payments) and Google Analytics (only if you accept analytics cookies);
- the vendors of tools your business uses, where needed to deliver services (for example Microsoft or Google);
- subcontractors who help deliver services, bound by confidentiality obligations;
- professional advisers such as our accountant, lawyer and insurer;
- government, law enforcement or regulators where the law requires or authorises it; and
- a buyer or successor, if the business is sold or restructured.
6. Overseas disclosure
Our website, quote records and hosted applications are hosted on infrastructure we operate in Australia. [CONFIRM.] Some service providers (including Cloudflare, Google, Stripe and our email provider) may process or store information overseas, mainly in the United States and other countries where they operate. We take reasonable steps to make sure these providers handle personal information consistently with the APPs.
7. Cookies and analytics
When you first visit our website, a banner lets you choose whether to allow analytics cookies. Until you choose Accept, Google Analytics does not load and no analytics cookies are set. You can change your choice at any time using Cookie settings at the bottom of every page.
| Name | Purpose | Type | How long |
|---|---|---|---|
| jg_cookie_consent | Remembers your cookie choice (stored in your browser, not sent to us) | Strictly necessary | 12 months |
| __cf_bm and similar Cloudflare cookies | Protects the website from bots and attacks | Strictly necessary | Up to 30 minutes |
| _ga, _ga_* | Google Analytics: counts visits and how pages are used | Analytics (only with consent) | Up to 2 years |
Google processes analytics data under its own privacy policy. You can also block cookies in your browser settings.
8. How long we keep it
| Information | Kept for |
|---|---|
| Quote requests and the quote register | [2 years], or longer if you become a client |
| Risk Check results | [2 years] |
| Email Checker lookups | Not stored beyond standard server logs ([30 days]) |
| Client and billing records | 7 years (tax and business record obligations) |
| Hosted service data after cancellation | 7 days, then permanently deleted (or immediately on request) |
| Information accessed in your systems during service delivery | Only as long as needed for the service, then deleted |
When we no longer need personal information, we take reasonable steps to destroy or de-identify it. [CONFIRM retention periods.]
9. How we protect it
We protect personal information with measures appropriate to a cyber security business. These include multi-factor authentication on our administrative accounts, encryption in transit, least-privilege access, regular security updates, backups and access logging. No system is completely secure, so we cannot guarantee absolute security.
10. Data breaches
If we become aware of a data breach involving personal information we hold, we will act quickly to contain it and assess the risk of serious harm. Where there is a likely risk of serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC), following the Notifiable Data Breaches scheme, whether or not it strictly applies to us. Where the breach affects information we handle for a client, we will tell that client without undue delay.
11. Access, correction and deletion
You can ask for access to the personal information we hold about you, ask us to correct it, or ask us to delete it where we no longer need it. Contact us using the details below. We will respond within 30 days. There is no charge to make a request.
12. Complaints
If you think we have mishandled your personal information, please contact us first so we can try to fix it. We will respond within 30 days. If you are not satisfied, you can complain to the OAIC at www.oaic.gov.au.
13. Contact us
- Jordan Gall
- Email: [email protected]
- Phone: +61 403 072 097
- Location: Kingscliff, NSW
14. Changes to this policy
We may update this policy from time to time. The current version is always available on our website, with the “Last updated” date shown at the top.