Privacy Policy

1. Who we are and what this policy covers

This website is operated by Maxwell Vidler trading as UniMatter ('UniMatter', 'we', 'us', 'our'). We are an advisory and technology practice based at Level 1, 16 McDougall Street, Milton, Queensland 4064, Australia, operating across the legal, clinical, and compliance sectors. Our disciplines are Systems Architecture and Security; Business Transformation; Research; productised systems (UniMatter Assurance and UniMatter Excel) delivered as engagements; and advisory and fractional engagement.

This policy applies to personal information we collect through this website and in our dealings with website visitors and prospective clients. It covers our marketing pages, our Insights section, our contact mechanism, and the client engagement surface through which engagement records and shared work are exchanged. Client access is provisioned per engagement, with access issued directly to the client.

This policy does not govern how we handle information you provide to us under a client engagement. Where we are engaged to provide services, the handling of engagement information is governed by the separate engagement terms and, where applicable, a data processing agreement between us and the client.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (the 'Privacy Act') and the Australian Privacy Principles (the 'APPs') contained in that Act.

2. The personal information we collect

'Personal information' means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not. The personal information we collect through the website includes:

1. Contact and proposal enquiries — your name, email address, organisation, and the content of your message when you enquire. The contact and proposal forms on the website prepare an email in your own email client addressed to administrator@unimatter.com.au; we receive the information when you send that email. No form data is transmitted to or stored on our servers by the website itself.
2. Technical data — your IP address, device and browser type, the pages you request, and the dates and times of your visits, as recorded in the standard server logs of our hosting provider when the website is served to you. The website operates no analytics or advertising trackers and sets no non-essential cookies.
3. Account and access data — where client access is provisioned to you under an engagement, the account details required to provide and secure that access, such as your name, email address, login credentials, and connection and access logs. Engagement records and shared work are exchanged through the client engagement surface, with access issued directly to the client.
4. Correspondence and engagement enquiries — the information you provide when you correspond with us or make an enquiry about engaging our services, including any details you choose to include.

We do not seek sensitive information about you through the website. 'Sensitive information' includes information about your health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or criminal record. Please do not include sensitive information in a contact-form submission or general enquiry. Where the provision of services requires us to handle sensitive information, we will collect and manage it under the separate engagement terms, not through the website.

3. How we collect personal information

We collect personal information in the following ways:

1. Directly from you — when you send us an email prepared through the contact or proposal form, when you are provisioned with client access under an engagement, when you correspond with us, or when you make an enquiry.
2. Automatically — through the server logs of our hosting infrastructure when the website is served to you, as described in clause 5. The website operates no analytics and sets no non-essential cookies.
3. From third parties — only where it is lawful to do so, or where you have consented. For example, we may receive information from a referrer or from a service provider that supports our website. Where we collect personal information about you from a third party, we take reasonable steps to ensure you are made aware of the collection.

4. Why we collect it and how we use it

We collect and use personal information for purposes connected with operating our website and our practice, including to:

• respond to your enquiries and correspondence, and follow up on prospective engagements;
• provide, operate, maintain, and improve the website and our services, including the client engagement surface through which client access is provisioned per engagement;
• maintain and improve the content, performance, and reliability of the website;
• protect the security and integrity of the website and detect, prevent, and respond to misuse, fraud, or unauthorised access;
• send you marketing communications where you have consented to receive them, as described in clause 6; and
• comply with our legal obligations and respond to lawful requests.

We use personal information only for the purpose for which it was collected, for a directly related purpose you would reasonably expect, or where you have consented or the use is otherwise permitted or required by law.

5. Cookies and analytics

A 'cookie' is a small file placed on your device when you visit a website. The website currently operates no analytics or advertising trackers and sets no non-essential cookies.

The website is a static site served from the global edge network of our hosting provider, Vercel Inc. The records generated by your visit are limited to the standard server logs maintained by that provider, which may include the technical data described in clause 2. The website also loads its typefaces and an icon library from third-party content-delivery networks (Google Fonts; unpkg), which receive the standard technical data of a request — such as your IP address and browser type — when those files are served to you.

Should we introduce analytics or non-essential cookies in the future, we will update this policy before doing so and, where required, seek your consent before any non-essential cookie is set. You can control or disable cookies through your browser settings, and you can delete cookies already stored on your device.

6. Direct marketing and your choices

We may send you marketing communications, such as updates, Insights, and information about our services, only where you have consented to receive them or where we are otherwise permitted to do so. Our marketing communications comply with the Spam Act 2003 (Cth).

Every marketing email we send includes a means to unsubscribe. You may opt out of marketing communications at any time by using the unsubscribe function in the message or by contacting us using the details in clause 17. Once you opt out, we will stop sending you marketing communications, although we may still contact you about an enquiry or engagement.

7. When we disclose personal information

We do not sell personal information. We disclose personal information only in the following circumstances:

1. Service providers and sub-processors — to organisations that provide services supporting our website and practice, being our hosting provider, Vercel Inc. (which serves the website as a static site from its global edge network), and our email provider, Microsoft 365 (Exchange Online). We require these providers to handle personal information consistently with this policy and the Privacy Act.
2. Professional advisers — to our professional advisers, such as legal, accounting, or insurance advisers, where reasonably necessary.
3. Where required or authorised by law — where disclosure is required or authorised by law, by a court or tribunal, or by a regulator, or is otherwise permitted under the Privacy Act.
4. Business successor — to a successor to our practice in connection with a sale, transfer, or restructure of the business or its assets, in which case we will take reasonable steps to ensure the recipient is bound by appropriate privacy obligations.

8. Overseas disclosure

Some of our service providers may store or process personal information outside Australia. Our service providers, Vercel Inc. and Microsoft, may process data on infrastructure located in the United States and other jurisdictions. Before disclosing personal information to an overseas recipient, we take steps consistent with APP 8 to ensure the recipient handles the information in accordance with the APPs, except where an exception under the Privacy Act applies, such as where you have consented to the disclosure after being informed that APP 8 will not apply.

9. How we keep personal information secure

We take reasonable steps to protect personal information from misuse, interference, and loss, and from unauthorised access, modification, or disclosure. These steps include technical measures such as access controls and encryption in transit, organisational measures restricting access to those who need it, and the selection of reputable service providers. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security; however, we work to protect personal information using measures appropriate to the risk.

10. How long we keep it

We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it by law. Our retention periods depend on the type of information and the reason we hold it; they are set out in our Data Retention and Deletion Policy, available at /legal/data-retention-deletion. When we no longer need personal information, we take reasonable steps to destroy it or to de-identify it.

11. Accessing and correcting your information

Under APP 12 you may request access to the personal information we hold about you, and under APP 13 you may ask us to correct it if you consider it is inaccurate, out of date, incomplete, irrelevant, or misleading. To make a request, contact us using the details in clause 17. We will respond within a reasonable period. We may need to verify your identity before acting on a request. There is no fee to make a request, although we may charge a reasonable cost for giving access in some circumstances. If we decline a request, we will tell you why in writing and explain how you may complain.

12. Data breaches

We maintain procedures to identify and respond to data breaches. Where a data breach involving personal information is likely to result in serious harm and the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act applies, we will notify the affected individuals and the Office of the Australian Information Commissioner (the 'OAIC') as required by that scheme, and we will set out the steps we recommend you take in response.

13. Making a privacy complaint

If you have a concern about how we have handled your personal information, please contact us first using the details in clause 17. We will acknowledge your complaint, investigate it, and respond to you within a reasonable period.

If you are not satisfied with our response, you may complain to the OAIC. The OAIC is the independent national regulator responsible for privacy in Australia and can investigate complaints about the handling of personal information. Its contact details are available at oaic.gov.au.

14. Children

The website is intended for a professional audience and is not directed to persons under 18 years of age. We do not knowingly collect personal information from children through the website. If you believe a child has provided us with personal information, please contact us using the details in clause 17 and we will take reasonable steps to delete it.

15. Third-party links

The website may contain links to third-party websites, including in our Insights section. We provide these links for convenience only. We do not control those websites and are not responsible for their content or privacy practices. We encourage you to read the privacy policy of any third-party website you visit.

16. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our services, or the law. We will publish the updated policy on this page and change the effective date shown above. Where a change is significant, we will take reasonable steps to bring it to your attention. We encourage you to review this policy periodically.

17. How to contact us

If you have any questions about this policy, wish to access or correct your personal information, or wish to make a privacy complaint, you can contact us at:

• Email: administrator@unimatter.com.au
• Telephone: +61 493 522 896
• Maxwell Vidler trading as UniMatter
• Level 1, 16 McDougall Street, Milton QLD 4064

If you are visiting the website from outside Australia, you may have additional rights under the privacy laws of your own jurisdiction. This policy and our handling of personal information are governed by the laws of Queensland and the Commonwealth of Australia.