1. About This Policy
This Privacy Policy applies to all personal information collected by Cyber Beacon Pty Ltd through our website (cyberbeacon.com.au), our membership portal, our consulting services, our booking system, and any other interactions with us. By using our website or services, you acknowledge that you have read and understood this Privacy Policy.
2. What Personal Information We Collect
The types of personal information we collect depend on how you interact with us:
| Interaction | Information Collected |
|---|---|
| Website browsing | IP address, browser type, device type, pages visited, referring URL, and session duration (via server logs and, if enabled, analytics tools) |
| Contact form | Name, email address, company name, and message content |
| Cyber security quiz | First name, email address, your quiz answers, and the date you took the quiz. Collected only if you choose to receive your result by email. Your IP address is also recorded for fraud-prevention purposes. If you tick the “send me updates” box, your name and email are also added to our mailing list (see clause 4) |
| Free consultation booking (via Calendly) |
Name, email address, phone number, company name, package of interest, and any free-text notes you provide. Booking is processed by Calendly (see clause 5) |
| DIY Package purchase (membership portal) |
Name, email address, business name, and billing address. Payment details (credit card) are collected and processed directly by Stripe — Cyber Beacon does not receive or store your full card number |
| Cyber Security Review (consulting engagement) |
Contact details as above, plus IT environment configuration data, policy settings, system metadata, and screenshots collected during the review as described in the engagement letter |
| Guided Cyber Fix (consulting engagement) |
Contact details as above, plus configuration data visible during screenshare or in-person guided sessions, and session recordings (with consent) |
| DIY Check-In (video consultation) |
Contact details, scheduling information, and any information you share during the session. Session recordings (with consent) |
We do not collect sensitive information (as defined in the Privacy Act) unless it is directly relevant to a service you have engaged us to provide, and you have provided consent.
3. How We Collect Personal Information
We collect personal information:
- Directly from you — when you fill in a form on our website, take the cyber security quiz, book a consultation, purchase the DIY Package, enter into an engagement letter, or communicate with us by email, phone, or video call.
- From your systems (consulting engagements only) — during a Cyber Security Review, we access your cloud tenant configuration (read-only) as authorised under the engagement letter. During a Guided Cyber Fix, configuration data may be visible to us during screenshare sessions. We do not access emails, files, or personal data within your environment except as strictly necessary to perform the review.
- Automatically — via server logs, cookies, and analytics tools when you visit our website (see clause 8).
We will not collect personal information by unlawful or unfair means.
4. Why We Collect and Use Personal Information
We collect and use personal information for the following purposes:
- To provide our services, including the DIY Package, Cyber Security Review, Guided Cyber Fix, and DIY Check-In
- To deliver your cyber security quiz results by email (if you have requested them)
- To schedule, confirm, and remind you of consultation bookings
- To process payments and issue tax invoices
- To respond to enquiries submitted via our contact and consultation booking forms
- To manage your membership account on our Platform
- To send you communications directly related to your purchase or engagement (e.g., account credentials, service updates, engagement deliverables)
- To prepare reports and deliverables as described in engagement letters
- To improve our website, services, and materials
- To send you marketing communications, where you have provided express consent (see below)
- To comply with our legal and regulatory obligations
- For internal record-keeping, insurance, and professional indemnity purposes
4.1 Direct marketing communications
We will only send you direct marketing communications (such as cyber security tips, product updates, and announcements) if you have provided express consent — for example, by ticking the “send me updates” box on our cyber security quiz, or by separately requesting to be added to our mailing list. Marketing communications are sent on a roughly monthly basis. Every marketing email contains a one-click unsubscribe link, and you can also withdraw consent at any time by emailing [email protected]. We do not use your personal information for direct marketing without your consent.
5. Disclosure to Third Parties
We may disclose personal information to the following categories of third parties, solely for the purposes described in this policy:
| Third Party | Purpose | Data Shared |
|---|---|---|
| Calendly (Booking system) |
Scheduling free consultation bookings, sending confirmation and reminder emails, and creating calendar events | Name, email address, phone number, company name, package interest selection, and any free-text comments you provide on the booking form. Processed under Calendly’s Privacy Policy |
| Stripe (Payment processor) |
Processing DIY Package payments | Name, email, billing address, payment card details. Processed under Stripe’s Privacy Policy |
| Anthropic (Claude API) (AI service provider) |
Assisting in analysis of configuration data and preparation of review findings and reports | De-identified or summarised configuration data, policy settings, and system metadata. We do not submit credentials, personal information, emails, or file contents. See clause 6 |
| PandaDoc (e-signature platform) |
Electronic execution of engagement letters | Names, email addresses, and the engagement letter document |
| Microsoft 365 (Email, calendar, and transactional mail delivery) |
Sending transactional emails (including cyber security quiz results and marketing emails), hosting business email, managing booking calendar events, and hosting Microsoft Teams meetings for consultations | Name, email address, message content, and meeting/calendar event details |
| Web hosting provider (VentraIP, Sydney AU) |
Hosting the Cyber Beacon website and membership portal | Server logs (IP addresses, request data). Hosted on Australian servers |
We do not sell, rent, or trade personal information to third parties for marketing purposes. We will not disclose personal information to any other third party unless required or authorised by law (e.g., in response to a court order or regulatory requirement).
6. Use of Artificial Intelligence Tools
Cyber Beacon Pty Ltd uses artificial intelligence (AI) tools, including the Anthropic Claude API, to assist in delivering consulting services. Specifically, AI tools may be used to analyse configuration data collected during Cyber Security Reviews, assist in identifying gaps and preparing findings, and generate draft content for review reports.
When using AI tools:
- We take reasonable steps to minimise the disclosure of personal information. Data submitted is limited to technical configuration details, policy settings, and system metadata where practicable.
- We do not submit credentials, passwords, authentication tokens, emails, or file contents to AI tools.
- Data submitted to AI tools is processed transiently and is not retained by Cyber Beacon after processing is complete.
- AI service providers may process data on servers located outside Australia, including in the United States (see clause 7).
AI tools are not used to process personal information collected via the cyber security quiz, contact form, or consultation bookings. Use of AI tools in consulting engagements is disclosed in, and subject to consent provided under, the relevant engagement letter.
7. Overseas Disclosure of Personal Information
Some of the third-party service providers we use may process data on servers located outside Australia:
- Calendly — United States
- Anthropic (Claude API) — United States
- Stripe — United States (with data processing infrastructure globally)
- PandaDoc — United States
- Microsoft 365 — primarily Australian data centres for Australian tenants, with limited global processing for specific services
Our website hosting (VentraIP) uses Australian-based servers located in Sydney.
Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles the information consistently with the APPs, or that the disclosure is otherwise permitted under APP 8. Where data is submitted to overseas processors, Cyber Beacon Pty Ltd remains accountable for the handling of that information under the Privacy Act.
8. Cookies and Analytics
Our website uses cookies for the following purposes:
- Essential cookies: WordPress session cookies required for the membership portal to function (login state, session management). These cannot be disabled without breaking site functionality.
- Booking cookies: Calendly may set cookies on the booking page (/book-now/) to support the booking flow and remember your input during the form.
- Payment cookies: Stripe may set cookies during the checkout process to support fraud prevention and payment processing.
We do not currently use third-party analytics or advertising cookies. If we introduce analytics tools (e.g., Google Analytics) in the future, this policy will be updated accordingly and a cookie consent mechanism will be implemented.
You can control cookies through your browser settings. Disabling essential cookies may prevent you from accessing the membership portal, booking a consultation, or completing purchases.
9. Data Security
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Our security measures include:
- TLS 1.3 encryption for all data in transit (HTTPS)
- Encrypted storage for data at rest
- Access controls limiting who can access personal information to those who need it to perform their role
- Secure destruction of engagement data (credentials, screenshots, notes) within 14 days of engagement completion
- Multi-factor authentication on administrative accounts
- Australian-based hosting with VentraIP (Sydney data centre)
No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.
10. Data Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:
| Data Type | Retention Period |
|---|---|
| Membership account data (DIY Package) | For the life of your active membership, plus 12 months after account closure |
| Contact and consultation booking form submissions | 12 months from date of submission, or longer if an engagement proceeds |
| Cyber security quiz submissions (name, email, answers) | 12 months from date of submission |
| Marketing mailing list (opt-in records) | Until you unsubscribe or withdraw consent. We retain a record of your unsubscribe request to ensure we do not contact you again in error |
| Calendly booking records | Retained by Calendly under their data retention policy; copied to Cyber Beacon’s records for 12 months, or longer if an engagement proceeds |
| Engagement records, reports, and change logs (consulting services) | 7 years from completion of the engagement (for insurance, legal, taxation, and regulatory purposes) |
| Client credentials, screenshots, and raw system data (consulting services) | Securely destroyed within 14 days of engagement completion |
| Session recordings (Guided Fix / DIY Check-In) | Provided to the client and not retained by Cyber Beacon unless separately agreed |
| Payment records and tax invoices | 7 years (as required by Australian tax law) |
| Server logs | 90 days |
When personal information is no longer needed, we will take reasonable steps to securely destroy or de-identify it.
11. Your Rights
11.1 Access and Correction (APP 12 & 13)
You have the right to request access to the personal information we hold about you, and to request correction of any information that is inaccurate, out of date, incomplete, irrelevant, or misleading. To make a request, contact us using the details in clause 14. We will respond to your request within 30 days. There is no charge for making a request or for correcting information. If we refuse a request for access or correction, we will provide written reasons for the refusal.
11.2 Withdrawal of Consent
Where we rely on your consent to process personal information, you may withdraw that consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal. Please note that withdrawing consent for certain processing (e.g., AI tool usage during an active engagement) may affect our ability to deliver services.
11.3 Unsubscribe from Marketing Emails
If you have opted in to receive marketing emails from us, you can unsubscribe at any time by clicking the unsubscribe link at the bottom of any marketing email, or by emailing [email protected]. Unsubscribing from marketing emails will not affect transactional communications (such as engagement deliverables, booking confirmations, or quiz results you have specifically requested).
11.4 Account Deletion
DIY Package members may request deletion of their membership account by contacting us at the email address below. Upon account deletion, we will remove your account data from the Platform, subject to any retention obligations described in clause 10.
12. Notifiable Data Breaches
In the event of an eligible data breach (as defined in Part IIIC of the Privacy Act), Cyber Beacon Pty Ltd will comply with the Notifiable Data Breaches scheme, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required. If you become aware of a potential data breach involving your Cyber Beacon account or engagement data, please notify us immediately using the contact details in clause 14.
13. Complaints
If you believe that we have breached the APPs or handled your personal information inappropriately, you may lodge a complaint with us by contacting us using the details in clause 14. We will acknowledge your complaint within 7 days, investigate the matter, and provide a written response within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
14. Contact Us
Cyber Beacon Pty Ltd
Privacy Officer: Matt Thomas, Director
Email: [email protected]
Website: cyberbeacon.com.au
ACN: 697 612 285
ABN: 31 214 198 772
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. Material changes will be communicated by updating this page and, where practicable, notifying affected individuals by email. We encourage you to review this page periodically. The “Last updated” date at the bottom of this page indicates when the most recent changes were made.
Document Version: 1.2 | Last updated: 18 May 2026