PRIVACY POLICY

2. Personal and Sensitive Information We Manage

In our capacity as an IT service provider, we may have administrative access to, or temporarily host, data repositories belonging to our clients. This data includes:

• 2.1Business Contact Information: Names, operational business email addresses, and phone numbers of client personnel.
• 2.2System & Technical Metadata: Device identifiers, IP addresses, network diagnostic configurations, and remote technical support audit logs.
• 2.3Highly Sensitive Information: for example, healthcare: our technical personnel may interact with systems containing clinical records, patient databases, medical histories, and healthcare identifiers. We treat all such sensitive data as strictly confidential under the APPs.

3. Data Architecture: Local Hybrid-Cloud & Storage Boundary

We prioritise decentralised infrastructure to minimise exposure risks:

• 3.1On-Premises Hybrid Storage: Most of our clients’ core data repositories, including sensitive patient databases, are maintained locally onsite at the client’s physical premises or within the client’s designated hybrid-cloud environment.
• 3.2Our Boundary: We do not wholesale duplicate or permanently migrate client patient databases to our own corporate cloud environments. Our access is strictly limited to remote administrative oversight and architectural maintenance.

4. Third-Party Hardware, Software and Service Suppliers

• 4.1Suppliers: Clients should contact those vendors directly for information regarding their privacy, data retention and NDB policies, particularly for those foreign entities whose governing laws are very different to those of Australia and may apply to Australian data housed in Australia but where the company is foreign-owned.
• 4.2Website Links: This website may contain links to websites that are maintained by third parties. While Kauri Computing supports the adherence to privacy guidelines, we are not responsible for the policies and practices of third parties. We recommend that you review the privacy policy of any website before releasing any personal information to third parties.

5. How We Use and Access Managed Information

Any access to client data or system metadata is strictly constrained to professional IT service delivery:

• 5.1Provisioning, maintaining, and debugging business-critical network infrastructure.
• 5.2Reviewing automated email security threat telemetry and backup logs.
• 5.3Performing system health checks to prevent cyber incidents, ransomware, or internal data corruption.
• 5.4Managing billing accounts, corporate service contracts, and professional relations.

6. Team Confidentiality and Site Security

We enforce strict personnel compliance before any technical deployment or system interaction occurs:

• 6.1Confidentiality Agreements: Every member of our team signs a client-provided Confidentiality Agreement before working on your site.
• 6.2Pre-Work Requirement: This agreement must be signed by the team member prior to any work being undertaken on behalf of a client.

7. Data Security and Governance

Aligned with our strict internal compliance frameworks, we enforce corporate security controls:

• 7.1Access Control: Multi-factor authentication (MFA) and strict role-based access controls (RBAC) are applied to all support tools.
• 7.2No Trading of Data: We never trade, sell, lease, or rent commercial business contact data or client-side patient information to third parties.
• 7.3Cookies: A cookie is a message that is stored on your web browser from a web server. The cookie contains information that is usually used to identify users in order to customise web pages, retain login information for user convenience, and other administrative purposes. Cookies can also be used to identify the user or to track browsing behaviour, and is sent back to the server when the web browser requests a page from the server. This website contains no cookies, so no information about you or your visit to our website is retainable by us unless you email us or fill in one of our forms.
• 7.4Security: This website does not provide for the secure transmission of data through the internet, and we advise users that there are inherent risks of transmitting data through the internet.
• 7.5Anti-Corruption & Law Disclosures: In compliance with our Anti-Corruption Policy, we do not disclose handled information to external organisations or entities unless legally compelled by Australian law enforcement or court order.

8. Cross-Border Data Disclosures

We make every effort to resolve data flows locally. Where our diagnostic tools or specialised third-party vendors route metadata or backup verification packets through international server infrastructure, we cannot ensure they enforce privacy protections that match or exceed Australian regulatory requirements because their governing laws will apply and the client should contact those suppliers directly for details.

9. Data Incident Management & Notifiable Data Breaches (NDB) Scheme

We maintain a proactive Data Breach Response Plan to isolate and remediate security events rapidly.

• 9.1Definition of an Eligible Breach: A data breach occurs if personal or sensitive health information is lost, or subjected to unauthorised access or disclosure. It becomes an “eligible data breach” under the NDB scheme if the incident is objectively likely to result in serious harm to any affected individuals.
• 9.2Assessment Timeframe: If we suspect or detect a potential security anomaly or data exposure, we will execute an immediate investigation. In accordance with statutory requirements, we will complete a formal assessment within 30 days of becoming aware of the suspected incident.
• 9.3Joint Notification Framework: Because we operate within a hybrid client-premises infrastructure, a data incident may involve both our technical tools and your internal systems. In a multi-party breach scenario, we will collaborate transparently with your management team to ensure that either your organisation or our business files a coordinated notification to the Office of the Australian Information Commissioner (OAIC) and all affected individuals.
• 9.4Mandatory Notification Contents: Where a mandatory notification is triggered, the statement will clearly identify the compromised data categories, specify actionable security recommendations for affected individuals, and provide direct contact details for further support.

10. Rights to Access, Correction, and Contact

Client personnel and data owners retain the right to query, access, or request corrections to the information we hold about them. For questions concerning our security controls or compliance guidelines, contact our Privacy Officer via privacy@kauri.com.au.

We will take all reasonable steps to ensure that all information held about you is accurate and up to date. Please inform us when your details need amending and we will update our records accordingly.

11. Complaints

If you believe your personal or sensitive information has been mishandled, please submit your complaint in writing to our Privacy Officer at privacy@kauri.com.au.

We will acknowledge your request and aim to resolve the issue within 30 days. If you do not receive a response from us within 30 days, or if you remain dissatisfied with our resolution, you have the right to lodge a formal complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.