Legal
Privacy Statement
Last updated: [DATE]
1. Who we are
This Privacy Statement explains how Third Key Consulting (ABN 92 480 785 971) trading as The Third Key (“we”, “us”, “our”) handles personal information collected through this website. We are committed to handling personal information openly and transparently, in line with the Australian Privacy Principles (APPs).
2. What personal information we collect
The only personal information we collect through this website is what you choose to give us through our contact page:
| Field | Required? | Why we ask |
|---|---|---|
| Name | Required | So we know who we are replying to |
| Email address | Required | So we can respond to your enquiry |
| Organisation | Optional | To understand your context |
| Phone number | Optional | If you would prefer a call |
| Enquiry type | Required | To route your enquiry to the right person |
| Your message | Required | To understand what you need |
The enquiry-type list contains general categories only (General enquiry; Technology & cyber risk; Third-party risk management; AI risk & ISO/IEC 42001; Privacy request; Partnerships; Other). We do not ask for sensitive information. Please do not include sensitive or security-confidential information in your message.
Technical information. This website does not use analytics or advertising cookies. Our hosting provider, Cloudflare, processes standard technical information such as IP address and browser type to deliver the site and protect it from attacks, including through a bot check on the contact form. We do not use this information to identify you.
3. How we collect it
We collect personal information directly from you when you complete the contact form or email us. We do not buy personal information or collect it about you from third parties through this website. If we receive personal information we did not ask for, we will destroy or de-identify it as soon as practicable, where lawful and reasonable to do so.
4. Dealing with us anonymously
You can browse this website without telling us who you are. You may use a pseudonym when contacting us, but we need a working email address to reply.
5. Why we collect, use and disclose it
- To respond to your enquiry and communicate with you about it.
- To understand your needs and, if you ask, prepare a proposal for our services.
- To keep a record of our communications.
- To protect the security of this website and prevent misuse.
We only use your information for these purposes, for related purposes you would reasonably expect, or where the law allows or requires it. We do not sell, rent or trade personal information. We may disclose it to the service providers who help us operate this website and our email, only so they can provide those services, or if required by law. We do not use personal information collected through this website to make decisions about you by automated means.
6. Direct marketing
We will not add you to a mailing list because you submitted an enquiry. We only send marketing communications if you have asked for them or would reasonably expect them, and every marketing email includes a simple way to unsubscribe.
7. Storage outside Australia
This website is served through Cloudflare’s global network, which processes form submissions in transit but does not store them. Enquiries are delivered to and stored in our Microsoft 365 environment, which stores mailbox content in Australia. Where personal information is processed outside Australia, we take reasonable steps to ensure it is protected consistently with the APPs.
8. Government identifiers
We do not collect, use or disclose government-related identifiers through this website.
9. Keeping information accurate
We take reasonable steps to keep the personal information we hold accurate, up to date and complete. Please let us know if your details change.
10. Security and retention
Enquiries are sent over an encrypted (HTTPS) connection and stored in systems protected by multi-factor authentication and access controls. If your enquiry does not lead to an ongoing relationship, we delete or de-identify it within [24 months] of our last contact, unless the law requires us to keep it. If a data breach involving your personal information is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
11. Access and correction
You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting us. We will respond within 30 days and do not charge for making a request. If we refuse, we will explain why in writing and tell you how to complain.
12. Complaints
If you have a concern about how we have handled your personal information, please contact us first. We will acknowledge your complaint within [5] business days and aim to resolve it within 30 days. If you are not satisfied, you can contact the OAIC at www.oaic.gov.au or on 1300 363 992.
13. Visitors from outside Australia
If you are located outside Australia, you may have additional rights under your local privacy laws. Contact us and we will consider your request in line with those laws.
14. Changes to this statement
We may update this Privacy Statement from time to time. The current version will always be on this page, with the date it was last updated.
15. Contact us
To make a privacy request or complaint, or to ask a question about this statement, use the form on our Contact page and choose Privacy request as the enquiry type. We do not publish a postal address.