IT FIRST RESPONDER PRIVACY POLICY

Current version — effective 16 August 2026

IT First Responder Pty Ltd (ABN 24 617 080 127) (ITFR, we, us or our) respects privacy and handles personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and other applicable privacy laws. This policy explains our information-handling practices. It is not a substitute for service-specific privacy, data-processing or security terms agreed with a customer.

Privacy contact: IT First Responder Pty Ltd, 02 8003 4009, [email protected]. Please use this contact for privacy enquiries, access or correction requests, complaints and data-breach questions.

1. Scope and who is responsible

This policy applies to personal information collected through our websites, forms, portals, service desk, proposals, contracts, events, communications and delivery of IT, managed support, Microsoft 365, cloud, endpoint, identity, email, network, SOC/MDR/XDR, backup, incident-response, project, connectivity, telephony, governance, advisory, hardware, software and AI/Copilot services.

ITFR may act as an APP entity for its own business operations. When a customer gives us personal information about its employees, contractors, users, customers or other individuals for managed services, ITFR generally handles it on the customer’s documented instructions and the customer remains responsible for its notices, consents and lawful authority. The customer’s contract, statement of work and any data-processing schedule govern that handling if they differ from this public policy.

The Privacy Act’s small-business exemption may apply in some circumstances, but ITFR follows this policy as a matter of practice and contract. Whether the Privacy Act applies depends on turnover and statutory exceptions; the exemption does not remove contractual, confidentiality, security, consumer, state or territory obligations.

2. Personal information we collect

Depending on the relationship and service, we may collect:

• identity and contact details, job title, employer and authorised-contact information;
• billing, payment authorisation, tax and transaction information (we do not intentionally store full payment-card numbers where our payment provider processes them);
• service requests, recordings or transcripts where notified, correspondence, proposals, contracts, preferences and feedback;
• device, endpoint, network, identity, email, security, access, authentication, configuration, log, telemetry, alert, vulnerability, backup and incident-response information;
• information contained in customer systems, files, mailboxes, tickets, backups and cloud tenants that we are authorised to access;
• website and technical information such as IP address, browser, device, referring page, approximate location, cookies and interaction data;
• information supplied by customers about their personnel, customers, suppliers and users; and
• information needed to investigate fraud, misuse, threats, complaints, disputes or legal obligations.

We do not seek sensitive information unless it is reasonably necessary and permitted by law or the customer has instructed us to handle it. If sensitive or health information is placed in a service system, the customer must ensure it has lawful authority and appropriate safeguards.

3. How we collect information

We collect information directly from individuals and customers, from authorised customer systems and service providers, and automatically through websites, portals, logs, cookies and security tools. We may receive information from Microsoft, cloud, security, backup, telecommunications, payment, identity, analytics and other providers, from public sources, and from a customer’s authorised representative.

Where practicable, we will provide an APP 5 collection notice or link when collecting personal information. If a customer supplies information about another person, the customer must provide any notice and obtain any consent required by law, unless an exception applies.

4. Why we collect, use and disclose information

We collect, use and disclose personal information as reasonably necessary to:

• provide, administer, secure, monitor, support, troubleshoot and improve contracted services;
• manage accounts, quotes, proposals, orders, billing, renewals, procurement, warranties and customer relationships;
• authenticate users, administer identities and permissions, detect threats, investigate incidents and protect people, systems and information;
• perform migrations, backups, restores, projects, audits, advisory work and service reporting;
• communicate service notices, maintenance, security alerts, support updates and other essential information;
• send marketing communications where permitted, subject to unsubscribe rights;
• maintain records, meet legal and regulatory duties, respond to lawful requests and establish, exercise or defend legal claims; and
• manage risk, quality, fraud, complaints, workplace safety and business operations.

We will not use or disclose personal information for a materially unrelated purpose unless permitted or required by law, reasonably expected, or the individual consents. We do not sell personal information.

5. Service providers, disclosures and overseas handling

We may disclose information to personnel, related entities, subcontractors and technology providers that help us deliver services, including hosting, Microsoft and cloud platforms, RMM/PSA and ticketing systems, backup and security platforms, SOC/MDR/XDR providers, identity and email providers, telecommunications carriers, payment processors, accountants, insurers, professional advisers, auditors, debt-recovery providers and government or law-enforcement bodies where authorised or required.

Some providers may store or access information outside Australia, including in the countries in which Microsoft, cloud, security, backup, support, communications and other providers operate. Before an overseas disclosure, ITFR will take steps required by APP 8 or rely on a lawful exception. Overseas recipients may be subject to foreign laws and may not provide identical protections. Current provider locations can change; customers may request more detail for a particular service.

When acting for a customer, we may disclose information to the customer, its authorised users and its nominated providers on the customer’s instructions. We may disclose information to police, regulators, courts, insurers, advisers or emergency services where necessary, authorised or required by law.

6. Cookies, analytics and communications

Our websites may use necessary cookies, preference cookies, analytics and security technologies. These may record device, browser, IP, page and interaction information. We may use third-party analytics, hosting, consent-management, advertising or embedded-content providers where configured. Browser settings and available consent controls can limit cookies, but disabling necessary cookies may affect functionality. Our marketing messages include an unsubscribe facility. Service, security, billing and account notices may continue where necessary to perform a contract or comply with law.

7. Microsoft 365, cloud, security telemetry and AI

Managed services may require access to tenant, endpoint, identity, email, network, backup and security telemetry. Access is limited to authorised personnel and tools for the agreed purpose, but security logs and alerts can contain usernames, addresses, message metadata, device identifiers or fragments of customer content.

Where AI, Copilot, automation or machine-assisted tools are used, they may process prompts, configuration data, service records or other information according to the applicable service configuration and provider terms. ITFR will use reasonable controls and human review appropriate to the task. Customers must not provide information to an AI tool unless authorised and must review material outputs; AI output is not a legal, financial, medical, compliance or security guarantee.

8. Security and data retention

ITFR takes reasonable steps appropriate to the circumstances to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Controls may include access restriction, authentication, least privilege, logging, encryption where appropriate, backups, supplier controls, staff training, incident procedures and secure disposal. No method of transmission or storage is completely secure, and this policy does not promise that a breach can never occur.

We retain personal information only for as long as reasonably necessary for the purpose collected, service delivery, security, backups, dispute management, legal obligations, tax, audit and legitimate business records. Retention periods vary by system and service. When no longer required, we take reasonable steps to delete, destroy or de-identify it, subject to backup cycles, legal holds, customer instructions and lawful retention duties.

9. Data breaches and incident notification

We maintain procedures to identify, contain, assess, remediate and record suspected privacy incidents. Where the Notifiable Data Breaches scheme applies and an eligible data breach is reasonably believed to have occurred, ITFR will notify the OAIC and affected individuals as required by law. We will notify an affected customer without undue delay where required by the customer contract or reasonably necessary, provide available information, and cooperate with the customer’s response. Notification timing and content may be affected by law-enforcement, security, forensic or safety considerations.

10. Access and correction

An individual may request access to, or correction of, personal information we hold by contacting [email protected]. We may need to verify identity and authority, clarify the request and consult a customer where the information is held on the customer’s behalf. We will respond within the period required by applicable law, ordinarily within 30 days for an access request, and explain any permitted refusal or charge. We may redact information about another person, confidential business information or security-sensitive details where lawful.

If information is inaccurate, incomplete, out-of-date or misleading, please identify the correction sought and supporting material. If we refuse correction, we will provide reasons where required and, where appropriate, associate a statement with the record.

11. Complaints and external review

Privacy complaints should be sent to [email protected] or IT First Responder Pty Ltd, marked “Privacy Complaint”. We will acknowledge and investigate complaints using a fair, confidential process and respond within a reasonable period. If you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992. Nothing in this policy limits a person’s rights under applicable law, including the statutory cause of action for serious invasions of privacy where its requirements are met.

12. Direct marketing

We may send information about ITFR services, products, events and relevant offerings where permitted by law. We will identify ourselves and provide a simple unsubscribe method. You can opt out at any time; transactional, security, service and account communications are not marketing and may continue.

13. Children, sensitive information and identity

Our services are directed to businesses and professionals, not children. We do not knowingly collect children’s information except where a customer lawfully provides it for an agreed service. We may collect sensitive information only where reasonably necessary and permitted by law, with additional controls appropriate to the sensitivity and risk. We may ask for identity or authority evidence before disclosing or changing information.

14. Employees, contractors and customer-controlled data

Employee records may be subject to the employee-records exemption or other applicable rules. Customer-controlled data remains subject to the customer’s instructions, contract and policies. Customers must ensure their collection, disclosure to ITFR, access permissions, retention, cross-border transfers and use of personal information are lawful. ITFR may refuse or suspend access that is unlawful, unsafe or outside the agreed authority.

15. Changes and version history

We may update this policy to reflect changes in law, technology, services or practices. We will publish the new version and effective date. Material changes will be notified where required or reasonably appropriate. An updated public policy does not retrospectively alter contractual privacy terms or the version incorporated into an accepted quote, proposal or service agreement.

Version: 16 August 2026 · Entity: IT First Responder Pty Ltd · ABN: 24 617 080 127.