Privacy Policy

Composed Digital Pty Ltd (ABN 71 683 496 380) ("Composed Digital", "we", "us") is a Braze and composable marketing technology consultancy. This policy explains how we collect, use, disclose and protect personal information, and how you can access or correct it or make a complaint.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and, where it applies, the Privacy Act 2020 (NZ).

This policy applies to personal information we handle about:

• Client and prospective client contacts
• Suppliers, partners and other business contacts
• Visitors to our website and people who contact us
• Job applicants and contractors

It also explains how we handle our clients' customer data when we access it to deliver our services (see section 6).

Depending on how you deal with us, we may collect:

• Name, job title, company, email address and phone number
• Details of your enquiry or our business dealings with you
• Job applicant information such as your CV, work history, qualifications and referee details
• Website usage information such as IP address, browser type and pages visited

We do not collect sensitive information (such as health information or racial or ethnic origin) unless you choose to give it to us, it is reasonably necessary, and you consent, or it is otherwise permitted by law.

We usually collect personal information directly from you, for example when you:

• Contact us by email, phone or through our website
• Meet with us or attend an event
• Engage us, or provide services to us
• Apply for a role with us

We may also collect it from publicly available sources (such as LinkedIn or your company website), from your employer or colleagues, or from recruitment agencies and referees.

We use personal information to:

• Respond to enquiries and provide our services
• Manage our client, supplier and partner relationships
• Send business updates and information about our services (you can opt out at any time)
• Assess job applications and manage our workforce
• Operate, secure and improve our website and business systems
• Meet our legal and regulatory obligations

When we deliver services, our team may access personal information about our clients' customers within our clients' own systems (for example, a client's Braze instance). When we do this:

• We act on our client's behalf and on its instructions. Our client remains responsible for that data, and its own privacy policy applies.
• We access the data only to deliver the contracted services, using access granted and controlled by the client.
• We do not export, copy or store client customer data on our own systems or devices, and we do not use it for any other purpose.
• Our access is removed at the end of the engagement.

We may disclose personal information to:

• Service providers who support our business, such as our IT, cloud and communication providers
• Our professional advisers, such as accountants, lawyers and insurers
• Our clients or partners where needed to deliver a project you are involved in
• Government bodies or regulators where required or authorised by law

We do not sell personal information.

Some of our service providers, including Microsoft 365, may store or process personal information outside Australia. Where this happens, we take reasonable steps to make sure the information is handled in line with the Australian Privacy Principles.

We store personal information in secure, cloud-hosted business systems (including Microsoft 365). Our Information Security Policy sets out the controls we apply, including:

• Least-privilege access and multi-factor authentication
• Full disk encryption on all work devices
• Encryption of data at rest and in transit by our cloud providers
• No storage of sensitive client data on local devices

We keep personal information only for as long as we need it for the purposes in this policy or as required by law. When it is no longer needed, we securely delete or de-identify it.

We may send you information about our services and events. You can opt out at any time by using the unsubscribe link in our emails or by contacting us.

Our website may use cookies and analytics tools to understand how it is used and to improve it. You can set your browser to refuse cookies, although some parts of the website may not work as intended.

You can ask to access or correct the personal information we hold about you by contacting us (see section 15). We will respond within a reasonable time, usually 30 days. If we refuse a request, we will explain why.

If you have a concern about how we have handled your personal information, please contact us first. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au) or, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz).

This policy must be reviewed annually or when significant changes to our business, technology or privacy law occur. The latest version is published on our website.