Privacy Policy
TechBy Pty Ltd · Sydney, NSW, Australia · Contact
1. Who we are & scope
TechBy Pty Ltd ("TechBy", "we", "us") — Sydney, NSW, Australia. For privacy requests use the contact form on this site with subject "Privacy Request". This policy covers our website, contact, talent and newsletter forms, and transactional communications.
We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where NSW law applies, it is noted.
2. What we collect
2.1 You provide directly
- Contact form: name, email, topic, message, anti-spam token.
- Talent form: name, email, role, links, message, CV file (PDF only, size-limited, format-verified).
- Newsletter: email address only.
- Correspondence: follow-up messages you send via our contact channels.
2.2 Collected automatically (minimal)
- Hashed IP for rate-limiting and security (raw IPs not retained in our systems).
- Platform-level request metadata (standard hosting logs).
- Anti-spam challenge tokens and outcomes.
- Automated spam classification score (transient, not profiled).
2.3 We do NOT collect
- Sensitive information (health, biometrics, political opinions) unless volunteered — and you should not volunteer it.
- Payment data (no checkout on site).
- Precise geolocation or advertising identifiers.
3. Why we collect (lawful bases under APPs)
| Purpose | APP basis |
|---|---|
| Respond to your enquiry | APP 6.1 — reasonably expected |
| Assess applications (merit-based) | APP 6; HR context |
| Newsletter delivery | APP 7 — consent |
| Anti-spam, rate-limiting, security | APP 11 — security |
| Legal/compliance, defend claims | APP 11, 12 |
Withholding information may limit our ability to respond or assess.
4. Storage — encrypted Australian systems
Primary store: encrypted database in Australia (at-rest encryption, least-privilege access).
CVs: encrypted object storage in Australia when configured; otherwise encrypted in database with migration path. Format verification and executable rejection applied before storage.
Email: transactional provider acting as processor under contract; Brevo contactPixelTrackingConsent=false (no per-contact open/click tracking); Resend/Mailtrap/Sender have no per-message tracking flag — we send text-only with domain tracking left disabled, so no open/click tracking.
Anti-spam: challenge provider (see Cookies).
5. Cookies & similar tech
We use strictly necessary cookies only (anti-spam challenge, platform bot management). No analytics or marketing cookies without consent. See Cookies Policy.
6. Sensitive data warning (applicants)
We do not need sensitive personal data. Before submitting, redact: TFN, date of birth, passport/licence numbers, bank details, full home address, health, criminal record. If included inadvertently, we will delete and request a redacted resubmission. Applications assessed on merit only — see Terms.
7. Disclosures (limited)
We do not sell or rent personal information. Disclosures limited to:
- Contracted service processors (hosting, email, anti-spam) — Australian-hosted, contractual obligations only.Legal requirement (Australian law, court order, serious harm/fraud prevention).
No overseas marketing networks. Any overseas processor contracted under Australian privacy obligations.
8. Retention
| Record | Retention | Action |
|---|---|---|
| Genuine enquiries | 24 months from last contact | Delete / anonymise |
| Spam | 90 days | Auto-delete |
| Applications (including CV) | 12 months | Delete; earlier on request |
| Newsletter subscribers | Until unsubscribe | Suppress list (hash only) |
| System backups/logs | ≤35 days rolling | Automatic |
Earlier deletion on request (see §10).
9. Security (APP 11)
- Encryption at rest and in transit (TLS 1.3), HSTS, CSP, least-privilege access.CV verification: magic-byte check (PDF), executable rejection, size limit.
- Rate limits, anti-spam challenges, honeypot fields, IP hashing.
- Named-engineer access only, no bulk export, breach response per APP 11 + NDB scheme.
No system is 100% secure. Report suspected compromise via contact form.
10. Your rights — access, correction, deletion
Under APP 12/13 you may request access, correction or deletion. Submit via contact form with "Privacy Request". We respond within 30 days. No fee unless complex.
- Unsubscribe: newsletter link or contact form.
- Delete application: contact form "Delete my data" — confirm within 30 days.
- Opt out of automated screening: request manual review.
11. Complaints — OAIC
Contact us first. If unresolved, complain to the Office of the Australian Information Commissioner (OAIC) — oaic.gov.au. We cooperate in good faith.
12. Children
Not directed to children under 16. No knowing collection. Contact us if you believe a child provided data.
13. Updates
Material changes noted here and, where appropriate, communicated to recent correspondents. Check "Last updated" date. Prior version on request.
14. Contact
TechBy Pty Ltd
Sydney, NSW, Australia
Use the contact form on this site with subject "Privacy".
We acknowledge the Gadigal people of the Eora Nation — traditional custodians of the land on which we work — and pay respect to Elders past and present.