You're viewing Australia & New Zealand Australian owned and operated

Privacy Policy

Effective date: [27/01/2026] · Last updated: [23/10/2026] · Review cycle: Annual · Next review: 22/01/2027 · Approved by: Chief Executive Officer

Cybernetic Shield Pty Ltd (“Cybernetic Shield”, “we”, “our”, “us”) respects your privacy and is committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we handle personal information about people in New Zealand, we also comply with the Privacy Act 2020 (NZ) and its Information Privacy Principles. We also meet applicable child safety and digital wellbeing requirements, including obligations under the Online Safety Act 2021 (Cth), the Safer Technologies for Schools (ST4S) guidelines and the Trusted eSafety Provider (TEP) program.

This Privacy Policy explains how we collect, use, disclose and protect personal information across our websites, applications, programs and services in Australia and New Zealand. It operates alongside our Terms of Service, which set out our contractual obligations and service conditions.

If you have questions, please contact our Privacy Officer at csenquiry@cyberneticshield.au.

Services covered by this policy

This Privacy Policy applies to personal information handled across:

the Cybernetic Shield website, including its online forms and the Free Response Demo
the Schools Solution, Education Shield programs and other school-contracted services
the 24/7 Cyber Incident Helpline (phone, chat and online triage)
our parent and staff portal (4Cs Help)
student-facing tools, including 3Cs Help apps and web content
consultations, workshops and training
incident management and online harm support

1. Personal information we collect

We may collect the following types of personal information:

name, email address, phone number, and school or organisation details
student information provided by a school or parent
account details and login metadata
incident reports, chat transcripts, helpline notes and uploaded evidence (for example, screenshots)
social media information relevant to an incident, such as account names or content you share with us
device and technical information, such as IP address, browser and operating system
your approximate location (country), estimated from your IP address when you visit our website
optional precise location data, if enabled by a user
communication preferences, including whether you have opted in to receive updates from us
information you submit voluntarily, such as feedback, survey responses and uploads

We do not collect, use or store government-related identifiers (such as Medicare numbers, driver licence numbers or passport details) unless required by law.

Children’s data

Where information relates to a child, we apply enhanced safeguards, including minimal identifiers, strict access control, limited retention and no behavioural tracking.

1.1 Explicit consent

Some activities require your explicit consent, such as:

submitting sensitive information
uploading photos or screenshots
participating in digital forensic investigations, and the collection of supporting data
participating in optional wellbeing or research activities
enabling optional location-based features
creating accounts for children, where the child’s capacity requires parent or carer involvement
receiving newsletters and marketing communications

You may withdraw your consent at any time (see section 9).

2. How we use personal information

We may use personal information to:

provide and improve our programs, applications and online safety services
support individuals, families and schools with online safety matters
create and manage user accounts
respond to enquiries and requests for help through our 24/7 Cyber Incident Helpline and support services
provide safety guidance and tailored triage
respond to enquiries made through our website, and provide access to the Free Response Demo
show you the right regional version of our website
send service updates, security notifications and digital wellbeing resources
send newsletters and information about our services where you have opted in (you can unsubscribe at any time)
analyse usage of our services and website to improve safety features, performance and content quality
de-identify data to identify trends and help schools understand common risk themes
meet our legal, regulatory and safeguarding obligations

We do not:

use advertising networks or advertising identifiers
use behavioural tracking or profiling technologies on any student-facing service
make automated decisions that affect eligibility, safety outcomes or access to services
sell, rent or trade personal information

3. Our website, cookies and analytics

3.1 Student-facing services

On student-facing services, we use only the cookies needed for authentication, preferences, service performance, security, and error detection and technical support. We do not use advertising networks, third-party tracking or behavioural profiling on any student-facing service.

3.2 Our public website

Our public website (cyberneticshield.com) uses:

Essential cookies that keep the website secure and working properly.
A region cookie (cs_region) that remembers which regional website you chose, so we can show it to you next time. It lasts for 12 months.
HubSpot cookies and forms that help us understand how visitors use our website, which pages are most helpful, and which enquiries come from which pages and campaigns. If you submit a form, HubSpot may connect your earlier visits to our website with your enquiry.

Where required, we ask for your consent before setting non-essential cookies. We do not use advertising cookies or share website data with advertising networks.

3.3 Approximate location

When you visit our website, we use your IP address to estimate the country you are in, so we can show you the right regional website. This happens at the time of your visit. We do not store your IP address for this purpose or use it to identify you.

3.4 Managing cookies

You can block or delete cookies in your browser settings, and change your cookie choices at any time. Some features may not work correctly if cookies are disabled.

4. Disclosing personal information

We may disclose personal information to:

service providers who help us deliver our services (Microsoft 365, Microsoft Azure, Amazon Web Services, Moodle, HubSpot and Mailchimp)
schools, where relevant to provide support or reporting under contract
legal, clinical, risk or technical experts assisting with safety matters
law enforcement or regulators, where required by law
other parties, with your express consent

We do not sell or trade personal information.

4.1 Children’s data controls

For children’s information, we apply additional requirements:

reduced identifiers wherever possible
pseudonymised reporting to schools by default
no advertising trackers
no offshore storage of identifiable child data unless it is essential and has been risk-assessed
restricted access to case notes, disclosures and incident logs
limited retention, aligned with legal and contractual obligations

4.2 Sub-processors

We use a limited number of trusted third-party service providers (“sub-processors”) to support the secure delivery of our services. Sub-processors are engaged under written agreements that require them to process personal information only on our instructions, maintain appropriate security safeguards and comply with applicable privacy laws.

Sub-processors may process personal information only for the purposes set out below. They are not permitted to use data for advertising, marketing, profiling, commercial analytics, or artificial intelligence or machine-learning training.

Sub-processor	Purpose of processing	Data types processed	Lawful basis	Primary processing locations
Microsoft (Azure and Microsoft 365)	Website hosting, identity management, email, document storage, collaboration platforms, security monitoring and data protection services	User account details, website form and technical data, communications metadata, audit logs, evidence documents	Performance of contract; legal obligations; legitimate interests	Australia (primary data hosting); United States (telemetry and support services)
Amazon Web Services (AWS)	Secure hosting of applications and databases supporting student and wellbeing platforms	Student accounts, survey responses, evidentiary uploads, system logs	Performance of contract	Australia (primary hosting); Singapore (backup, telemetry and monitoring services)
HubSpot	Cyber Incident Helpline case management, secure communications and workflow processing; website forms, enquiries and website analytics	Contact details, case notes, chat records, communications metadata, website activity	Performance of contract; legitimate interests; consent (non-essential website cookies)	[Confirm: your HubSpot data centre region]; United States (telemetry data only)
Moodle LMS	Delivery of online education modules and assessment tracking	Student enrolment details, participation records, assessment responses	Performance of contract	Australia
Mailchimp	Delivery of operational service communications, alerts and newsletters	Email addresses, subscription preferences, message delivery records	Performance of contract; consent (newsletters)	Australia; United States

We review the security and privacy practices of all sub-processors before engaging them, and we carry out ongoing vendor assurance. We notify customers and schools of any material changes to our sub-processor arrangements.

5. Where data is stored and processed

Our primary systems are hosted in Australian data centres (Microsoft Azure in Sydney and Melbourne; AWS in Sydney). Some telemetry or support data may be processed overseas by certified providers, as set out in section 4.2. Where this occurs, we apply contractual and technical safeguards consistent with the APPs and, for people in New Zealand, the Privacy Act 2020 (NZ).

We aim to store all student and helpline data in Australia, unless processing elsewhere is essential for secure service operations.

6. Security of personal information

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure, including:

encryption in transit and at rest
multi-factor authentication
role-based access and least-privilege principles
zero-trust access controls
activity logging and periodic review
annual penetration testing
vendor security assurance
no local device storage of sensitive child data

While no system is entirely risk-free, we continuously strengthen our security.

7. Retention and deletion

We keep personal information only for as long as necessary to fulfil its purpose or meet legal or contractual requirements. We then securely delete or de-identify it. Retention periods are set out in our Information Retention and Disposal Schedule.

7.1 Account deletion and withdrawal of consent

You may request:

deletion of your account
withdrawal of your consent
deletion of optional or uploaded content
removal of helpline records, where legally permitted

Some records cannot be deleted immediately if they must be kept to:

meet legal or safeguarding obligations
prevent ongoing harm
meet school contractual requirements
maintain secure incident logs

Where deletion is not possible, we will explain why.

8. Access, correction and complaints

You may request access to, or correction of, personal information we hold about you by contacting our Privacy Officer at csenquiry@cyberneticshield.au. We aim to respond within 30 days.

If you have a privacy complaint, please contact us first so we can try to resolve it. If you are not satisfied with our response, you may contact:

in Australia: the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au
in New Zealand: the Office of the Privacy Commissioner at www.privacy.org.nz

9. Rights for parents, students and consumers

You have the right to:

access your personal information
request correction
request deletion (subject to legal requirements)
withdraw consent, including unsubscribing from newsletters at any time
understand how your information is used
request a portable copy of certain information

For children: parents and carers may make requests on behalf of a child unless doing so conflicts with the child’s safety, legal requirements or best interests. Older children may have the right to manage their own privacy, depending on their maturity and capability.

10. Changes to this policy

We may update this Privacy Policy to reflect changes in our services, legal requirements or safety practices. Where changes materially affect children, families or schools, we will provide reasonable notice. The “Last updated” date at the top of this page always reflects the current version.

11. Contact us

For privacy enquiries, corrections or complaints, contact:

Privacy Officer
Cybernetic Shield Pty Ltd
Email: csenquiry@cyberneticshield.au
Phone: 1300 707 009 (Australia) · +64 9 886 7536 (New Zealand)