Privacy Policy

2. What we collect

What we collect depends on how you deal with us.

When you contact us. Our contact form asks for your name, email address, phone number, company name, which option best describes you, and your message. We also keep what you tell us by email, phone, video call or in person.

When you visit our website. Our hosting provider, and the services that deliver parts of our site (listed in section 6), receive technical information your browser sends. This includes your IP address, browser type, device type and the pages you request. We do not use this information to identify you.

When you work with us. For clients, contractors and suppliers, we collect names, job titles, work contact details, billing details and records of our dealings. Those records include proposals, contracts, invoices, project correspondence and meeting notes.

When we contact you first. We research prospective clients and partners using business information people have chosen to publish, such as LinkedIn profiles and company websites. We only collect work details: name, role, organisation and professional contact details.

When you apply to work with us. Your CV, work history, portfolio and referee details.

Inside the products we build. When we build or support a product for a client, we may have access to personal information about that client's users. Section 8 explains how we handle it.

Sensitive information. We don't ask for sensitive information, such as health information, through our website. Please don't include it in the contact form. If a project genuinely needs sensitive information, we only collect it with consent or where the law allows, and only as much as the work requires.

Children. Our website and services are for businesses and organisations. We do not knowingly collect personal information from people under 18 through our website.

3. How we collect it

We collect most personal information directly from you: through our contact form, by email, on calls and in meetings, and through the agreements we sign with you.

We sometimes collect it from other people. That includes a colleague or contact who introduces you, a referral partner, public professional sources, and clients whose products we work on.

If we receive personal information we didn't ask for, we check whether we could have collected it lawfully. If we could not have, we destroy or de-identify it where it is lawful and reasonable to do so.

You can browse our website without telling us who you are, and you can ask us general questions without giving your real name. We do need your name and contact details to prepare a proposal or provide services.

4. How we use it

We use personal information to:

• respond to enquiries and arrange calls
• prepare proposals, and scope, deliver and support our work
• manage client and supplier relationships, invoicing and accounts
• send you updates about our work that you would reasonably expect or have agreed to receive
• recruit and engage team members and contractors
• keep our website and systems secure and protect them from spam and misuse
• improve our website and services
• meet our legal, tax and accounting obligations, and establish or defend legal claims.

We only use personal information for another purpose if you consent, if you would reasonably expect it and it relates to the original purpose, or if the law requires or allows it.

Marketing. Every marketing email we send includes a way to unsubscribe, and you can also ask us directly to stop. We comply with the Spam Act 2003 (Cth).

We do not sell personal information.

5. Cookies and website technologies

We use three tools to understand how people find and use our website.

Google Analytics records the pages you view, how you arrived (for example, from a search engine or a link we shared), your approximate location, device and browser, and actions such as submitting our contact form or booking a call. It uses cookies and processes your IP address. We look at this information in aggregate to improve our website and marketing.

LinkedIn Insight Tag lets LinkedIn report the professional characteristics of our visitors in aggregate, such as industry, job function and company size, and lets us show LinkedIn ads to people who have visited our site. It uses cookies, and LinkedIn may connect your visit to your LinkedIn account. We do not receive the identity of individual visitors.

Meta Pixel lets Meta (the company behind Facebook and Instagram) tell us when visitors take actions such as booking a call or submitting our contact form, and lets us show Facebook and Instagram ads to people who have visited our site. It uses cookies, and Meta may connect your visit to your Facebook or Instagram account. We do not send Meta the contents of our forms, and we do not receive the identity of individual visitors.

Some parts of our site are delivered by other services, such as our fonts, our case study video and some code libraries. When your browser loads them, those services receive your IP address. Embedded content, such as video, may set its own cookies under that provider's privacy policy.

You can block or delete cookies in your browser settings. You can also opt out of Google Analytics using Google's browser add-on, manage LinkedIn advertising in your LinkedIn account settings, and manage Facebook and Instagram advertising under Ad preferences in your Meta Accounts Centre.

6. Who we share it with

We only disclose personal information for the purposes in section 4. We may disclose it to:

• service providers who help us run our business, such as website hosting and form handling, email and file storage, video calls and meeting notes, scheduling, project management, relationship management, and accounting and invoicing
• members of our delivery team, including contractors and specialists working on client projects under confidentiality obligations
• our professional advisers, such as lawyers, accountants and insurers
• a prospective buyer of or investor in our business, under confidentiality, if we sell or restructure it
• government agencies, regulators, courts or law enforcement, where the law requires or authorises it
• anyone else you have agreed to.

Services used on our website. Webflow (website hosting and contact form submissions), Google Analytics (website analytics), LinkedIn (website analytics and advertising), Meta (website analytics and advertising), Calendly (call bookings), Google Fonts (typefaces), jsDelivr (code library delivery), Netlify (our work showcase), Vimeo (case study video), and Cloudflare Turnstile and Google reCAPTCHA (spam protection on our forms). Each handles information under its own privacy policy.

We require our service providers to keep personal information secure and to use it only for the job we engaged them to do. A list of our key service providers is available on request.

7. Overseas disclosure

Some of our service providers store information outside Australia, and some members of our delivery team work outside Australia. This means personal information may be disclosed to recipients in the United States, the Philippines, India and Pakistan, and in other countries where our providers or their data centres are located.

Before we disclose personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs. We do this through contract terms and confidentiality agreements, and by giving each recipient access only to what their work needs.

8. Client products and the data inside them

When we design, build or support a product for a client, that client usually decides what personal information the product collects and how it is used. We handle that information on the client's behalf, under our agreement with them, and only to do the work.

We limit access to client systems to the team members who need it, and we prefer test or de-identified data for development and testing.

If you use a product we built and have a question about your information, please contact the organisation that runs it. We will help them respond.

9. AI tools and automated decisions

We use AI tools in our work, including for research, writing, analysis, meeting notes and software development. When personal information is involved:

• we use business accounts whose terms stop the provider from training its models on our content
• we leave out personal information the task does not need
• a person on our team reviews the output before we rely on it
• we only put client data into an AI tool where our agreement with that client allows it.

Automated decisions. We do not use computer programs to make decisions that could significantly affect your rights or interests. People on our team make decisions about enquiries, engagements and hiring.

10. How we protect it

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. These steps include access controls and multi-factor authentication on our business systems, encrypted connections to our website, access limited to the people who need it, and confidentiality obligations on our team.

No method of storing or sending information is completely secure. If you think information you gave us has been compromised, please contact us straight away.

If a data breach occurs, we will act quickly to contain and assess it. We will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) where the Notifiable Data Breaches scheme requires it, and we will tell you where we believe you should know.

11. How long we keep it

We keep personal information only for as long as we need it for the purposes in this policy, or as long as the law requires.

• Financial and tax records are kept for at least five years.
• Enquiries that do not lead to work are deleted after 24 months.
• Records of client engagements are kept for seven years after the engagement ends.
• Job applications from people we don't engage are deleted after 12 months, unless you ask us to keep yours on file.

When we no longer need personal information, we securely destroy or de-identify it.

12. Accessing and correcting your information

You can ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

Send your request to the contact details in section 14. We may need to confirm your identity first. We will respond within 30 days.

Making a request is free. If providing access involves significant work, we may charge a reasonable fee, and we will tell you the amount before we proceed.

If we refuse a request, we will explain why in writing and tell you how to complain.

13. Complaints

If you have a concern about how we have handled your personal information, contact our Privacy Officer using the details in section 14. Please describe what happened and how we can reach you.

We will acknowledge your complaint within five business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner:

• Website: www.oaic.gov.au
• Phone: 1300 363 992

14. Contact us

Privacy Officer, Castle Digital
Contact form: castledigital.com.au/contact-us

15. Changes to this policy

We may update this policy from time to time. The current version will always be on this page, with the date it was last updated. If we make a significant change, we will note it on our website.