Privacy policy
This policy explains how Red Pulse handles personal information collected through this website and in the course of consulting engagements. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, whether or not we are legally required to in a given year, because our clients expect it of a security consultancy.
1. What we collect
Through this website
- Contact form: your name, work email, organisation and the message you send.
- Technical data: IP address, browser type, pages requested and timestamps, collected by our hosting and content-delivery providers for security and operation. We do not run analytics or advertising trackers on this site.
During an engagement
- Business contact details of the people we work with.
- Security evidence from systems in scope. This can incidentally include personal information such as user account names, email addresses, sign-in and multi-factor status and administrator identities. We collect configuration and security metadata, not the content of files, email or messages, unless a penetration test explicitly scopes it and you authorise it.
2. Why we collect it
To respond to enquiries, scope and deliver engagements, produce reports, invoice, meet legal obligations, and protect the security of our own systems. We do not sell personal information or use it for marketing without consent. If you have enquired or engaged us we may occasionally email you about directly relevant changes to the frameworks we assess; every such email includes a way to opt out, as required by the Spam Act 2003 (Cth).
3. Who we share it with
| Provider | Purpose | Location |
|---|---|---|
| Microsoft Azure | Website hosting and contact form processing | Australia East and global CDN edge |
| Cloudflare | DNS, content delivery and security filtering | Global edge |
| Resend | Delivering contact form emails to us | United States |
| Google Workspace | Business email and document storage | Australia / global |
| Microsoft 365 | Business email, documents and engagement workspaces | Australia |
Engagement evidence is stored in Australian regions. Where a provider processes data overseas, we rely on their contractual commitments and take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles. We may also disclose information where required by law or to protect our rights, and to professional advisers under confidentiality.
4. Security and retention
Information is stored encrypted at rest and in transit, access is limited to people working on the relevant matter and protected by multi-factor authentication, and we review access regularly. Contact enquiries are kept for up to two years. Engagement evidence is deleted or returned within 90 days of the final report unless you ask us to keep it or the law requires retention. Reports and contractual records are retained for seven years for legal and insurance purposes.
5. Access, correction and complaints
You can ask to access or correct personal information we hold about you by emailing privacy@redpulse.net. We respond within 30 days. If you are unhappy with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
6. Data breaches
If we become aware of a data breach involving personal information that is likely to result in serious harm, we will notify affected individuals and the OAIC in accordance with the Notifiable Data Breaches scheme, and notify affected clients without undue delay regardless of the threshold.
7. Overseas visitors
This site is intended for Australian organisations. If you contact us from the European Union or United Kingdom, we process your enquiry on the basis of our legitimate interest in responding to it, and you have the rights described in section 5 together with any additional rights under your local law.
8. Changes
We may update this policy; the effective date above will change. Material changes affecting current clients will be notified by email.