1. About this policy
This policy explains how Refined IT Pty Ltd, trading as Refined IT, handles personal information in connection with enquiries, client accounts, website development, digital marketing, technology support, hosting and domain services.
Personal information is information or an opinion about an identified person, or a person who can reasonably be identified. Business contact details can be personal information when they identify an individual.
This policy covers Refined IT’s handling of information. A website or platform operated by one of our clients has its own information-handling arrangements. The client is responsible for explaining those arrangements to its users, while we remain responsible for our own conduct and applicable obligations.
2. Information we collect and hold
The information needed depends on the enquiry or service. It can include:
- Names, business names, contact details, roles and information supplied in an enquiry.
- Account, quotation, order, invoice, payment-status and service records.
- Communications, support requests, project instructions, approvals and records of work.
- Domain registrant, eligibility and administrative contact information required for the relevant registration.
- Technical records needed to operate, secure and support websites or systems, such as IP addresses, device/browser information, access logs and diagnostic information.
- Information a client authorises us to access in its website, hosting account, application or connected business system when providing the agreed service.
We seek information relevant to the purpose for which it is collected. Please do not submit passwords, full payment-card details, identity documents, health information or other sensitive information through a general enquiry form. Contact us first if a service requires information that needs a more suitable transfer method.
3. How information is collected
Information is collected when you contact us, submit a form, request a quote, place an order, manage an account or ask us to provide support. It can also be supplied by an authorised representative of your business.
When you authorise access to a website, hosting account or business system, we can obtain information from that system as needed for the agreed work. We ask clients to confirm that they are entitled to provide that access and information.
Technical information can be recorded by a website, hosting service, security tool or connected provider when the relevant service is used. Any additional tracking or collection must be assessed and described in the relevant collection notice before it is enabled.
Where practicable, we explain at or before collection why information is needed, important disclosures and the consequences of not providing it. A link to this policy supports those explanations; it does not replace a specific notice where one is required.
4. Why we use personal information
We use information for purposes connected with your dealings with us, including responding to enquiries, preparing proposals, providing and supporting services, administering accounts, managing billing, maintaining security and investigating problems or complaints.
Information can also be needed to meet legal obligations, establish or exercise legal rights, and maintain appropriate business records. We do not treat an enquiry or acceptance of this policy as unlimited permission to use information for unrelated purposes.
Where another use requires consent or a separate legal basis, that requirement must be addressed before the use occurs.
5. Information in client websites and systems
Providing development, hosting or support can involve access to information belonging to a client’s customers, staff or other contacts. We limit that access to the agreed work, authorised support and legitimate security or legal needs.
Clients must consider the personal information they place in their systems, provide appropriate notices and permissions, and tell us about particular handling or security requirements before work begins. Hosting or building a website does not by itself establish that the client’s own privacy arrangements meet every applicable requirement.
If your request concerns information you gave to one of our clients, contact that organisation first. We can assist the client with an authorised request where appropriate, while dealing directly with any issue concerning our own handling of information.
6. Who information is shared with
Information is shared only where there is an appropriate reason connected with the service, your instructions or a legal requirement. Depending on the service, recipients can include authorised team members and contractors; hosting, software, communications and security providers; domain registrars and registries; payment and accounting providers; and professional advisers.
We consider the information a recipient needs for its task and the arrangements governing its handling. We do not treat the involvement of a contractor or provider as removing our own responsibilities.
Information can also be disclosed to a regulator, court, law-enforcement body or another party where required or authorised by law. Where a client directs a connection to another service, that provider’s own terms and privacy information also need to be considered.
7. Overseas handling of information
A service provider or contractor can process information or access a system from outside Australia. An Australian hosting location does not necessarily mean that all administration, support, backups or connected services remain in Australia.
For each relevant service, the locations of likely overseas recipients and the applicable handling arrangements must be identified before the service is enabled. This policy and any relevant collection notice must then describe those disclosures, including recipient countries where practicable.
Where the Australian Privacy Principles apply, we take the steps required by applicable cross-border disclosure obligations. Agreeing to a service or reading this policy is not, by itself, a blanket waiver of those protections.
8. Cookies, analytics and connected website features
Cookies and similar technologies can support functions such as security, sessions and saved preferences. Analytics, advertising, embedded content and other connected features can involve additional information collection or sharing when enabled.
The technologies actually deployed, their purposes and any available choices must be explained in the website’s relevant notices or settings. Installing a plugin does not, by itself, establish consent or satisfy every privacy obligation. We do not describe information as anonymous merely because a report does not show a person’s name.
You can manage cookies through your browser. Blocking some technologies can affect functionality. Where consent is required for an optional feature, it must be obtained before that feature collects or discloses the relevant information.
9. Marketing communications
Service communications, such as responses to your enquiry and information needed to administer an account, are distinct from optional marketing.
We send electronic marketing only where permitted by applicable law and provide a practical way to unsubscribe. You can also contact us using the details below to ask that marketing stop. Requests are actioned within the period required by law; for commercial electronic messages, this is generally within five working days.
Unsubscribing from marketing does not prevent necessary service, billing or security communications. Promotional material must not be added to a service message to avoid applicable consent or unsubscribe requirements.
10. Security and retention
We take reasonable steps appropriate to the information and circumstances to protect information against misuse, interference, loss and unauthorised access, modification or disclosure. Security arrangements must take account of the service, access permissions and the providers involved. No online system can be promised to be completely secure.
Information is retained for as long as reasonably needed for the purpose for which it is held and for applicable legal, accounting, dispute or security requirements. When it is no longer needed and no retention obligation applies, we take reasonable steps to destroy it or de-identify it.
Removal from an active account does not necessarily remove every copy immediately. Backups and required records can have separate retention arrangements. Relevant service arrangements should explain export, account closure and backup expiry without promising retention that is not actually provided.
11. Access, correction and your choices
You can contact us to request access to personal information we hold about you or ask for inaccurate, incomplete or outdated information to be corrected. We take reasonable steps to verify identity and authority without asking for more information than is necessary.
We respond within a reasonable period and explain any lawful reason for refusing or limiting a request, together with available complaint options. If a charge for providing access is permitted and proposed, we explain it before proceeding. We do not charge for making a request or for correcting information.
You can ask a general question without identifying yourself where practicable. Some services, account actions and domain registrations require identification or contact information. If necessary information is not provided, we explain any resulting limitation on the service.
12. Privacy and security incidents
If you suspect an issue involving personal information handled by Refined IT, contact us promptly. Please provide enough information to help identify the issue without sending exposed credentials or unnecessary sensitive material through the enquiry form.
We assess suspected incidents, take appropriate containment and response steps, and notify affected people, clients or authorities where required by applicable law or the relevant service agreement. The response depends on what occurred, the information involved and the risk of harm.
13. Contact us or raise a privacy complaint
For privacy questions, access or correction requests, or a complaint, contact Refined IT on (08) 9291 3284 or use our contact form. Ask for the person responsible for privacy and include your preferred response method.
We consider the issue, seek any information reasonably needed to investigate and explain the outcome or next steps. If more time is needed, we explain why. You do not need to be a current customer to raise a concern about our handling of your information.
If you are not satisfied, you can seek guidance about available complaint rights from the Office of the Australian Information Commissioner. Its ability to investigate depends on the matter and applicable law.
14. Policy changes and related information
This policy should be reviewed when our services or information-handling practices change. An adopted version will show its revision or effective date. Where a material change requires a separate notice or consent, simply editing this page will not replace that requirement.
Related service information is available in our Terms and Conditions, Hosting Terms, Domain Terms, Acceptable Use Policy and Delivery Policy.