Privacy Policy

Privacy Policy

Effective Date: 23 July 2023 | Last Updated: 3 July 2025

Your Privacy Matters to Us
At Cyberhaven Technologies, we are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, and protect your data when you interact with our services. We take every step to ensure that your information is handled securely, in compliance with all relevant data protection laws. Your trust is essential to us, and we are dedicated to safeguarding your privacy every step of the way.

1  Introduction

Vstrah Pty Ltd (ABN 31 669 458 986), trading as Cyberhaven Technologies (“Cyberhaven Technologies”, “we”, “us”, “our”), respects your right to privacy. We are bound by the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and, where applicable, other international frameworks such as the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

This policy explains what personal information we collect, why, how we use and disclose it, how we secure it, and the choices you have. It applies to all websites, portals, applications, products and services offered or operated by Cyberhaven (collectively, “Services”), unless a separate privacy notice is supplied for a particular Service.

2  Definitions

3  What We Collect

4  How We Collect Information

1. Directly from you when you complete web forms, create an account, engage support, pay invoices, visit our premises, or apply for a job.
2. Automatically through cookies, server logs, analytics tools and security monitoring systems.
3. Third parties or public sources: channel partners, recruitment agencies, credit‑reference providers, social‑media platforms (subject to their privacy settings), and public registers (ASIC, ABN Lookup, etc.).
4. Referral or delegation from one of our clients if you are their employee or customer and they engage us on your behalf (we act as their service provider).

5  Why We Collect and Use Your Information

* Where GDPR applies, our primary lawful bases are contract performance, legal obligation, legitimate interests(balanced against your rights), and consent for specific optional activities.

6  Disclosure of Personal Information

We never sell your information. We may disclose it to:

• Internal staff of Vstrah Pty Ltd/Cyberhaven, under strict need‑to‑know access controls.
• Service providers (data‑centre hosts, SaaS vendors, payment gateways, background‑check agencies, courier firms) bound by confidentiality and security obligations.
• Affiliated business entities for intra‑group administration and consolidated reporting.
• Clients where we act as their managed‑service provider and you are their authorised user.
• Regulators, courts and law‑enforcement when required by law or to defend legal rights.
• Prospective purchasers in connection with a merger, acquisition or asset sale (subject to confidentiality).

Cross‑border disclosures may occur where our cloud infrastructure or vendors reside outside Australia (e.g. AWS, Microsoft 365). We take reasonable steps to ensure overseas recipients handle your data in a manner consistent with the APPs, including contractual safeguards and, where GDPR applies, Standard Contractual Clauses.

7  Data Security

We employ a layered security program combining:

• Encryption in transit (TLS 1.2+) and at rest (AES‑256).
• Role‑based access control (RBAC), multi‑factor‑authentication (MFA) and least‑privilege principles.
• ISO 27001‑aligned policies, periodic penetration testing and vendor risk assessments.
• Physical safeguards (24/7 surveillance, secure server rooms, visitor logs).
• Staff training on privacy, social engineering, secure coding and incident response.
• Business Continuity & Disaster Recovery (BCDR) plans with off‑site backups.

Despite best efforts, no method of transmission or storage is completely secure. If a data breach arises that is likely to cause serious harm, we will notify affected individuals and the OAIC (and any other relevant authority) in accordance with the Notifiable Data Breaches Scheme and GDPR articles 33–34 if applicable.

8  Data Retention & Destruction

We retain personal information only for as long as necessary to fulfil the purposes outlined in this policy or as required by law (e.g., tax, employment, audit). Retention periods vary:

• Contracts & invoices – 7 years (ATO record‑keeping).
• Job applicant data – 2 years (or sooner if consent is withdrawn).
• Customer support logs – up to 3 years post‑closure.
• Security logs – maximum 12 months unless needed for investigation.

Data scheduled for deletion is securely erased or anonymised following industry standards (NIST SP 800‑88).

9  Your Rights and Choices

To exercise these rights, email privacy@cyberhaven.com.au or write to us (see Section 13). We may verify your identity before fulfilling requests and may refuse or limit actions where legally permitted (e.g., frivolous or vexatious requests, or where disclosure would impact another’s privacy).

10  Marketing & Communications Preferences

We may email you newsletters, security advisories, event invitations or special offers relevant to your relationship with Cyberhaven. You can opt out by:

• Clicking “unsubscribe” in any marketing email; or
• Contacting us at support@cyberhaven.com.au.

Transactional or service‑related notices (e.g., password resets, outage alerts) are not considered marketing and are sent as necessary.

11  Cookies, Analytics & Tracking Technologies

Our websites use first‑party and third‑party cookies, pixels and similar tools for authentication, remembering preferences, measuring traffic and improving usability. We do not use cookies to serve behavioural advertising unless you expressly consent.

You may disable cookies via browser settings or amplify privacy by using plug‑ins (such as uBlock Origin). However, certain features may become unavailable. For details see Schedule A: Cookie Categories.

12  Third‑Party Links

Our Services may include links to external websites or social‑media platforms. We are not responsible for the privacy practices or content of those sites. We recommend reviewing their privacy statements before providing personal information.

13  Children’s Privacy

Our Services are not directed to children under 16. We do not knowingly collect personal information from minors without verifiable parental consent. If you believe a child has provided us information, please contact us and we will act promptly to delete it.

14  Automated Decision‑Making & Profiling

Cyberhaven does not engage in solely automated decisions that produce legal or similarly significant effects on individuals (GDPR Art. 22). Where we use analytics or risk‑scoring tools, human oversight remains integral.

15  Policy Updates

We may amend this Privacy Policy periodically to reflect changes in laws, technology or business operations. The revised version will be posted at www.cyberhaven.com.au/privacy with a new “Last Updated” date. If changes materially impact your rights, we will provide advance notice via email or prominent site banner. Your continued use of the Services after the effective date constitutes acceptance.

16  Complaints & Contact Information

If you have a question, concern or complaint about privacy, please contact:

Privacy Officer
Vstrah Pty Ltd t/a Cyberhaven Technologies
Suite 18, 162 Macquarie Street, Hobart TAS, 7000, Australia
📞 (03) 6164 8899 | 📧 privacy@cyberhaven.com.au

We aim to respond within 30 days. If you are dissatisfied with our response in Australia, you may complain to the Office of the Australian Information Commissioner (www.oaic.gov.au). EU residents may contact their local supervisory authority.

Schedule A – Cookie Categories

Schedule B – Key Third‑Party Service Providers

Version 1.0.1 © Cyberhaven Technologies (ABN 31 669 458 986) – All rights reserved.