Privacy Policy

Montra Digital Pty Ltd (ABN 81 698 077 235)('Montra', 'we', 'us' or 'our') builds, hosts and supports websites and software for businesses. This policy explains how we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

It covers two different roles. When you contact us or become our customer, we decide how your information is used and this policy applies directly. When we host or run a system for one of our customers, such as a real estate CRM, a client website or a compliance application, we handle the information in it on that customer's behalf. See section 9.

1. Information we collect

Depending on how you deal with us, we may collect:

• Enquiries: your name, email address, phone number, the service you are interested in and anything you write in your message.
• Customers: contact and billing details for the people we work with, account and user details for the systems we provide, and records of our dealings (emails, meeting notes, support requests, invoices).
• Website technical data: your IP address, browser and device details, and the date and time of your request. Our hosting provider records these in standard server and security logs. Our contact form also uses Cloudflare Turnstile to block spam, which assesses signals from your browser.

We do not use analytics, advertising or tracking tools on this website. We do not intentionally collect sensitive information (such as health information) about website visitors. We do not ask for your tax file number.

You can contact us without giving your name, using a pseudonym, but we may not be able to help you fully if we cannot identify you or reply to you.

2. How we collect it

We collect most information directly from you: through our contact form, by email or phone, in meetings, and when you use a system we provide. We may also collect information from your organisation (for example, when it gives us the names of staff who need user accounts) or from public sources such as the ABN Register.

3. Why we collect, use and disclose it

• To respond to your enquiry and give you information about our services
• To provide, support, secure and improve the services we deliver to customers
• To manage our customer relationships, including billing and accounts
• To protect our website and systems against spam, abuse and security threats
• To meet our legal obligations and to establish or defend legal claims

We will only send you marketing if you have agreed to it, and every marketing email has an unsubscribe link. We do not sell, rent or trade personal information.

4. Who we share it with

We use the service providers below to run our business. They handle personal information only to provide their service to us. Our current list is on our sub-processors page.

• Amazon Web Services: hosting, databases, storage, email delivery and security services, in the Sydney (ap-southeast-2) region
• Cloudflare: Turnstile spam protection on our contact form
• Our email hosting provider: for the mailbox that receives your enquiry
• Professional advisers, such as our accountants, lawyers and insurers

We may also disclose information where the law requires or allows it, for example to a regulator or law enforcement agency, or to protect someone's life, health or safety.

5. Overseas disclosure

We store the personal information we control in Australia. Some of it may still be processed overseas:

• Cloudflare Turnstile processes your IP address and browser signals on Cloudflare's global network, which includes the United States and other countries.
• Our content delivery network serves our website from locations close to you. Our web application firewall (a security service) runs in the United States, and its logs, which include IP addresses, are stored there.

We take reasonable steps to ensure these providers handle personal information consistently with the APPs.

6. Cookies

This website sets one cookie, which remembers the language you choose (English or Korean). Cloudflare Turnstile may set its own cookie to tell people from bots. We do not use advertising or tracking cookies. You can block cookies in your browser settings, but the contact form may not work without Turnstile.

7. Storage, security and retention

We protect personal information with technical and organisational measures appropriate to the information. These include encryption in transit and at rest, access controls, multi-factor sign-in for our staff and audit logging. Our security page describes these measures in more detail. No system is completely secure, and we cannot guarantee that information will never be accessed without authorisation.

We keep information only as long as we need it for the purposes above or as the law requires. As a general guide:

• Enquiries that do not become work are deleted after two years.
• Customer and financial records are kept for seven years after the engagement ends, as tax and corporations law requires.
• Security logs are kept for up to 90 days unless we need them to investigate an incident.

8. Data breaches

If a data breach is likely to cause serious harm to the people whose information is involved, we will notify them and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. If the breach involves data we hold for a customer, we will tell that customer promptly so they can meet their own obligations.

9. Data we host for our customers

Our customers, such as real estate agencies, professional firms and organisations whose websites we run, use our systems to hold information about their own clients and contacts. For that data:

• the customer decides what is collected and why, and is responsible for its own privacy notices, consents and legal obligations;
• we handle the data only to provide, secure, back up and support the service, and as the customer instructs, under our data processing terms;
• we do not use it for our own purposes, sell it, or use it to train AI models.

If your information is held in one of our customers' systems (for example, you are a buyer or tenant dealing with an agency), please contact that organisation first. They are responsible for your request, and we will help them respond to it.

Some of our customers' systems may use automated processes, such as risk scoring, that can contribute to decisions about individuals. The customer configures and makes those decisions, and its privacy policy should explain how they work.

10. Access and correction

You can ask for access to the personal information we hold about you, or ask us to correct it. We will respond within 30 days. We do not charge for a request, but may charge a reasonable fee for providing access to a large volume of information. If we refuse a request, we will tell you why in writing and how to complain.

11. Complaints

If you think we have mishandled your personal information, please email our privacy contact at consulting@montra.com.au with the details. We will acknowledge your complaint within five business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

12. Changes to this policy

We may update this policy from time to time. The current version is always on this page with the date it was last updated.

13. Contact us

Privacy contact, Montra Digital Pty Ltd (ABN 81 698 077 235), Western Australia: consulting@montra.com.au