Privacy Policy

Kevin Matthew Velasco trading as Get On The Web (ontheweb.au), ABN 19 301 189 160 (we, us, our) provides managed IT and cyber security services to businesses in Australia. This policy explains how we collect, use, disclose and protect personal information, and how you can access it, correct it or complain.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) in everything we do, whether or not the law requires us to.

We handle personal information in two ways:

1. For our own business: for example, the details of our clients' contacts, our suppliers, job applicants and people who visit our website. We decide how this information is handled, and sections 2 to 4 and 6 to 16 apply.
2. On behalf of our clients: when we manage a client's computers, email, cloud services and backups, we can see and store personal information that belongs to that client, such as their staff's and customers' details. Our client decides how that information is handled, and section 5 explains how this works.

The kinds of personal information we collect and hold for our own business include:

1. Contact details: names, job titles, work email addresses, phone numbers and business addresses of our clients' staff, our suppliers and other people we deal with;
2. Account and billing information: billing contacts, invoices and payment records (we do not store full card numbers);
3. Support records: the content of support tickets, emails and chat messages, including information you tell us when asking for help;
4. Technical and account information: usernames, device names, IP addresses, sign-in records and activity logs from the systems we manage, which may identify individual users;
5. Website and portal information: information you enter into our website or client portal, and information our website collects automatically (see section 15);
6. Recruitment and screening information: résumés, referee comments, and, for people who will hold privileged access to client systems, the results of background checks such as police checks, collected with consent; and
7. Marketing preferences: whether you have chosen to receive news and updates from us.

We do not intentionally collect sensitive information (such as health information or criminal history) except for background checks with your consent, or where it is incidentally contained in support records or Client Data.

We collect personal information:

1. directly from you: when you contact us, raise a support ticket, sign an agreement, apply for a job or use our website or portal;
2. from your employer: when your organisation becomes our client and gives us your details so we can set up your accounts and support you;
3. automatically: through the monitoring, security and management tools we run on systems we manage for our clients, which record technical events and sign-in activity; and
4. from third parties: such as software vendors, referees and background check providers, where this is reasonably necessary.

If you don't give us the information we ask for, we may not be able to provide our services or respond to your request.

We collect, use and disclose personal information to:

1. deliver, support and secure the services our clients engage us for;
2. monitor for, investigate and respond to security incidents;
3. manage user accounts, licences and access;
4. bill clients and manage our accounts;
5. communicate with clients about their services, including service reports, planned changes and incidents;
6. recruit and screen staff and contractors;
7. meet our legal, regulatory and insurance obligations; and
8. send you news about our services, if you have not opted out.

You can opt out of marketing at any time by using the unsubscribe link in any marketing email or contacting us (section 16). We will still send messages about the services your organisation receives.

We do not sell personal information.

When we manage a client's systems, data stored in those systems (Client Data) may include personal information about the client's staff, customers and other people.

1. Our clients own Client Data. We use it only to deliver the services the client has engaged us for and on the client's instructions. We do not use it for our own purposes.
2. Privileged access is used only to deliver the services. Our technicians access client systems through individually named accounts, and only as needed to do the work.
3. Contact the client first. If you want to access or correct personal information held in a client's systems, or make a privacy complaint about it, please contact that organisation. If you contact us, we will pass your request to the client promptly and help them respond.
4. The client's privacy policy applies. How the client collects and uses your information is governed by the client's own privacy policy, not this one.

We may disclose personal information to:

1. our subcontractors, who help us deliver services and are bound by privacy and confidentiality obligations equivalent to ours. We remain responsible for them;
2. providers of the software and cloud services our clients subscribe to, such as Google Workspace and Microsoft 365, when we manage those services for the client, and providers of the tools we use to run our business and deliver our services, such as our backup, security, ticketing and remote management tools. We do not resell software or cloud subscriptions;
3. our professional advisers, insurers and auditors, who are bound by confidentiality;
4. a client's insurer, incident response firm or regulator, when we are helping that client respond to a security incident and the client has asked us to;
5. government agencies, regulators or law enforcement, where the law requires or permits it; and
6. a buyer of our business, if we sell all or substantially all of it, in which case our clients will be told in writing.

We disclose only what is reasonably needed for the purpose.

Client Data. We store all Client Data, including backups, in Australia. We will not store it outside Australia without the client's prior written agreement.

Our clients' own subscriptions. We do not resell software or cloud services. The subscriptions we manage, such as a client's email and cloud apps, are held by the client directly with the vendor, and we manage their billing, licences and administration on the client's behalf. Data in those services is stored wherever the vendor's terms say, not by us, and the client's agreement with us lists the services we manage.

Our own business records. The systems we use to run our business, such as our ticketing platform, accounting software and email, store information in Australia.

We hold privileged access to our clients' systems, so we hold ourselves to a high security standard. Our security program includes:

1. encryption at rest of all data we store, including Client Data, backups and our own business records;
2. multi-factor authentication on every account that can access client systems, including our remote management and ticketing tools;
3. a unique named account for each technician, with access removed within 1 Business Day of them leaving or changing role;
4. least-privilege access, and logging of privileged actions, with logs kept for at least 12 months;
5. patching and hardening of our own systems in line with the Australian Signals Directorate's Essential Eight at Maturity Level One;
6. background checks for staff with privileged access, to the extent the law permits;
7. annual security awareness training for all staff; and
8. immutable or offline backup copies, and regular test restores, for the backups we manage.

No system is completely secure. Where a client allows its staff to use personal devices that we do not manage, we apply the account protections available to us, such as multi-factor authentication, but we cannot control the security of those devices.

We may use artificial intelligence (AI) tools to help us work more efficiently. When we do:

1. we never enter Client Data or a client's confidential information into any AI tool or service;
2. we tell clients when a ticket update, email or report has been written or substantially drafted using AI;
3. a qualified technician reviews any AI-generated code or script before it runs on a client's systems, and we tell the client first;
4. we do not run AI-generated code or scripts on a client's systems while responding to a security incident; and
5. we remain responsible for AI-assisted work as if our own staff had done it.

Clients can tell us at any time that they don't want AI tools used on their systems, and we will stop within 5 Business Days.

We do not use automated decision-making. No computer program makes decisions about you, or is a key factor in a decision our staff make about you, whether about our clients, their staff, job applicants or anyone else. Decisions such as suspending services or accounts are made by our staff.

The security tools we run for our clients can automatically block a suspicious sign-in, quarantine an email or isolate a device to stop a cyber attack. These actions protect the client's systems, are made on the client's behalf and under its security settings, and are reviewed by our technicians. If you are affected by one, please contact your organisation's IT contact or us.

If we start using automated decision-making in future, we will update this policy before we do, describing the kinds of decisions involved and the kinds of personal information used.

If we become aware of a security incident affecting a client's systems or Client Data, we tell the client within 24 hours and help them contain and investigate it.

For Client Data, the client decides whether the incident is an eligible data breach under the Notifiable Data Breaches scheme and whether to notify affected people and the Office of the Australian Information Commissioner (OAIC). We give the client the information they need to make that assessment within the 30-day period the law allows. We do not notify the OAIC or affected individuals about Client Data without the client's consent, unless the law requires us to.

For our own business records, we assess any suspected breach promptly and, if it is likely to result in serious harm, notify affected individuals and the OAIC as the law requires.

We keep personal information only as long as we need it for the purposes in this policy or as the law requires. Then we securely destroy or de-identify it.

1. Client Data: when a client's agreement ends, we return their data in a commonly used format during a transition period of up to 30 days, then securely delete it from our systems within 30 days. We keep only copies the law requires us to keep, and those stay confidential.
2. Security and access logs: at least 12 months.
3. Financial and contract records: 7 years, as required by tax and corporations law.
4. Unsuccessful job applications: 12 months, unless you ask us to delete them sooner.

You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting us (section 16). We will respond within 30 days. We don't charge for making a request, but may charge a reasonable fee to cover the cost of giving access to a large amount of information, and we will tell you before we do.

If we refuse access or correction, we will tell you why in writing and how to complain.

For information held in a client's systems, please see section 5.

You can make a general enquiry without telling us who you are, or by using a pseudonym. We need to know who you are to provide support, set up accounts or deliver services.

Our public website does not use cookies or similar tracking technologies, and we do not use third-party advertising or tracking tools. Our web server records basic information about each visit, such as your IP address, the pages you view, your browser type and the time of your visit. We use this only to understand how our website is used and to keep it secure, and we do not use it to identify you.

When you sign in to our client portal, we use a session token to keep you securely signed in. It is used only for that purpose, is not used to track you, and expires when you sign out or after a period of inactivity.

To ask a question, make a request or complain about how we have handled your personal information, email our Privacy Officer at [email protected].

We will acknowledge your complaint within 5 Business Days and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

We may update this policy from time to time. The current version will always be on our website, with the date it was last updated. If a change materially affects how we handle Client Data, we will tell our clients in writing first.

LAST UPDATED: 16 OCTOBER 2026