1. Introduction
Oslys Pty Ltd is a specialised digital engineering and cybersecurity consultancy. We recognise that trust and confidentiality are the foundation of our industry. We are committed to protecting your privacy and ensuring that any personal information we collect is handled in strict accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This Privacy Policy outlines how we collect, use, disclose, and secure your personal and technical data when you interact with our website, communicate with us, or engage our services.
2. The Information We Collect
To manage risk and ensure clarity, we categorise the information we collect into two distinct streams:
A. Corporate & Website Data
This is standard information collected during normal business operations and marketing, which may include:
- Contact Information: Name, email address, phone number, company name, and job title.
- Communication Records: Correspondence via email, contact forms, or direct inquiries.
- Technical Analytics: IP addresses, browser types, geographic location (country/state level), and website usage patterns (collected via standard cookies and analytics tools).
B. Client Engagement & Infrastructure Data
During the course of providing cybersecurity auditing, penetration testing, or software engineering services, we may be exposed to technical data.
- Minimisation Principle: We actively request that clients provide sanitised, dummy, or anonymised data for development and testing environments.
- Scope of Exposure: In instances where exposure to live environments is required, we may temporarily process server logs, network configurations, source code, or infrastructure credentials. We do not treat this as marketing data, nor is it ever cross-referenced with your personal profile.
3. How We Collect Information
We collect personal information through lawful and fair means, primarily:
- Directly from you: When you fill out a contact form, email us, request a proposal, or sign a Statement of Work (SOW).
- Automatically: When you navigate our website (via cookies and server logs).
- Through Service Delivery: During authorised security audits, code reviews, or infrastructure deployments, as explicitly permitted by our Master Services Agreement (MSA).
4. How We Use Your Information
Oslys uses your information strictly for the following purposes:
- To deliver software engineering, cybersecurity, and consulting services.
- To respond to your inquiries and provide technical or administrative support.
- To issue invoices, manage billing, and fulfill legal or financial obligations.
- To improve our website performance, security posture, and user experience.
- To send relevant security alerts, vulnerability notices, or service updates (you may opt-out of these communications at any time).
We do not—and will never—sell, rent, or trade your personal information or system data to third-party data brokers, marketers, or advertisers.
5. Disclosure and Overseas Transfers
We may share your information with trusted third parties exclusively to facilitate our business operations. These include:
- Cloud hosting providers (e.g., AWS, Vercel) and secure communication platforms.
- Legal, accounting, and financial service providers advising Oslys Pty Ltd.
Overseas Disclosure (APP 8) & Data Sovereignty
At Oslys, we treat data sovereignty as a core architectural requirement, not an afterthought. For our primary client bases in Australia and Canada, our default posture is to design and provision cloud infrastructure that ensures your core data remains hosted within your respective national borders. Furthermore, active software engineering and access to development environments are strictly ring-fenced to the geographical boundaries agreed upon in your Statement of Work.
However, because modern digital infrastructure relies on distributed global networks (such as edge-routing CDNs, threat-intelligence feeds, or encrypted administrative SaaS tools), some encrypted metadata or routing traffic may inevitably pass through servers located outside of Australia or Canada. By engaging our services, you consent to this limited operational transfer, with the assurance that Oslys exclusively utilises vendors bound by elite global security frameworks (such as SOC 2, PIPEDA, and GDPR).
6. Data Security & Retention (Our Posture)
As a cybersecurity consultancy, protecting data is our core competency. We implement aggressive technical and administrative controls to prevent unauthorised access, modification, or disclosure:
- Encryption: Data in transit and at rest is protected using industry-standard encryption (e.g., AES-256, TLS 1.3).
- Access Controls: We employ strict principle-of-least-privilege (PoLP) access, hardware-backed Multi-Factor Authentication (MFA), and zero-trust internal architecture.
- Zero-Retention for Engagements: Technical data, server logs, or credentials provided during a security audit or software build are retained only for the duration of the engagement. Upon completion, this data is securely purged or handed back to the client in accordance with our project off-boarding protocols.
7. Notifiable Data Breaches
In the unlikely event of an unauthorised data exposure that is likely to result in serious harm, Oslys complies fully with the Notifiable Data Breaches (NDB) scheme under the Privacy Act. We will promptly notify affected individuals and the Office of the Australian Information Commissioner (OAIC), alongside executing our internal incident response playbooks.
8. Your Rights: Access, Correction, and Deletion
Under the APPs, you have the right to:
- Request access to the personal information we hold about you.
- Request that we correct any inaccurate, out-of-date, or incomplete information.
- Request the deletion of your personal data (subject to our legal and tax retention obligations).
To exercise these rights, please contact our Privacy Officer using the details below. We will respond to all legitimate requests within 30 days.
9. Changes to this Policy
We may update this Privacy Policy periodically to reflect changes in our engineering practices, legal requirements, or global operations. The updated policy will be published on our website with the revised "Effective Date."
10. Contact Us
If you have questions about this Privacy Policy, wish to exercise your data rights, or need to lodge a privacy-related complaint, please contact us at:
Oslys Pty Ltd
Email: inquiries@oslys.com
We will investigate any complaints and provide a formal response in writing within 30 days.