ELSCOMM ABN 13 509 095 511 ("we", "us" or "our")
Effective date: August 2026
Version: 1.0
1. About this Policy
Our clients give us access to their systems. That access is the service, and it only works if we are clear about what we do with information and accountable when something goes wrong. This Policy sets out how we handle personal information, and how you can get in touch about the information we hold about you.
1.1 Our position under the Privacy Act. We are a small business operator within the meaning of section 6D of the Privacy Act 1988 (Cth), and we are not presently an APP entity bound by the Australian Privacy Principles. We have adopted this Policy voluntarily because clear information handling is part of providing a professional service, not because we are required to publish one.
1.2 What this means in practice. This Policy describes the practices we actually apply. It is informed by the Australian Privacy Principles, which we regard as a sensible standard, but adopting this Policy does not make us an APP entity and nothing in it should be read as a representation that we are bound by the Privacy Act.
1.3 Where we are bound regardless. Some obligations apply to us irrespective of our position under the Privacy Act, including obligations under the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), the Australian Consumer Law, State and Territory health records legislation where applicable, and the terms of our agreements with clients. Nothing in this Policy limits those obligations.
1.4 If our position changes. If our circumstances change such that we become an APP entity, we will update this Policy accordingly.
1.5 Meaning of personal information. In this Policy, personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not. Sensitive information includes health information and information about an individual's racial or ethnic origin, political opinions, religious beliefs, sexual orientation or criminal record. These meanings follow section 6(1) of the Privacy Act.
1.6 Scope. This Policy applies to our website at elscomm.com.au and to our business operations generally.
2. The two capacities in which we handle information
We deal with personal information in two distinct ways, and the difference determines who is responsible for it.
2.1 As a business in our own right. We collect and hold personal information about visitors to our website, prospective clients, our clients' personnel, our suppliers, our own personnel and applicants for employment. We decide how that information is used. Sections 3 to 13 of this Policy apply to it.
2.2 As a service provider to our clients. In providing managed IT, support, monitoring, backup, disaster recovery and security services, our personnel may access systems, applications and data owned or controlled by our business clients. Those systems may contain personal information about our clients' own customers, employees and contacts.
We access and handle that information for the purpose of providing the contracted services, in accordance with the client's instructions and the applicable services agreement. We do not use it for our own commercial purposes, and we do not disclose it except as directed by the client, as permitted under the services agreement, or as required or authorised by law. We may use information derived from managed environments in de-identified or aggregated form for service delivery, capacity planning, security monitoring and threat detection, where the services agreement permits.
2.3 Requests about information held in client systems. If you are a customer, employee or contact of one of our clients and you want to know what is held about you, contact that client. They decide how that information is handled and they are the right first point of contact. If you approach us, we will refer the request to the client and assist them in responding.
3. What we collect
3.1 Website visitors and enquirers. Your name, email address, telephone number, business name and position, together with anything else you choose to include in an enquiry form or in correspondence with us.
We also collect technical information automatically, including your IP address, browser type and version, operating system, device type, the referring website, the pages you access, and the date, time and duration of your visit. Section 5 explains how.
3.2 Clients and prospective clients. The names, positions, business contact details and system credentials of the individuals you authorise to raise tickets, approve changes or administer accounts; billing and account information; records of support requests, tickets, calls, correspondence and remote access sessions; and technical information about managed devices, networks and systems, which may include usernames, device identifiers and access logs.
3.3 Suppliers and business contacts. Names, positions and business contact details.
3.4 Applicants for employment. Information in your application, résumé and referee reports, and the results of any pre-employment checks you consent to.
3.5 Sensitive information. We do not seek to collect sensitive information. Where it is necessary for our business, we will collect it only with your consent or where the law otherwise permits.
3.6 Dealing with us anonymously. You are welcome to make a general enquiry without identifying yourself. We cannot provide support, account administration or billing without knowing who you are, and before we act on a request affecting a managed system we will verify the identity and authority of the person making it. That verification step is a security control and we apply it consistently.
4. How we collect it
4.1 Wherever practical we collect personal information directly from you, through our enquiry forms, email, telephone, meetings, onboarding documentation, support ticketing and service agreements.
4.2 We also receive personal information from third parties, including our clients when they nominate you as an authorised contact, referral sources, publicly available sources such as company registers, and the software platforms through which we deliver our services.
4.3 If we receive personal information we did not ask for and have no legitimate need for, we destroy or de-identify it once we identify it, provided it is lawful and practical to do so.
5. Cookies and analytics
5.1 Our website uses cookies. A cookie is a small text file placed on your device by a website.
5.2 We use:
(a) strictly necessary cookies, required for the website to operate;
(b) analytics cookies, through Google Analytics, etc. which show us aggregate visitor behaviour such as traffic sources, pages viewed and session duration, and which we use to improve the site; and
5.3 Your browser settings allow you to refuse or delete cookies. Doing so may affect parts of our website.
5.4 Information collected through analytics tools may be transmitted to and stored on servers outside Australia. Section 8 applies.
6. Why we collect it
We collect, hold, use and disclose personal information to:
(a) respond to your enquiries and send you what you have asked for;
(b) provide, maintain, monitor and support the services our clients engage us to deliver;
(c) verify the identity and authority of people requesting support or changes to managed systems;
(d) administer accounts, issue invoices and collect payment;
(e) maintain the security of systems under our management, and detect, investigate and remediate security incidents;
(f) issue service notifications, maintenance advices and security advisories;
(g) improve our website and services;
(h) assess applications for employment;
(i) meet our obligations under law, under contract and to our insurers, and to establish, exercise or defend legal claims; and
We do not use personal information for unrelated purposes without your consent, unless the law permits or requires it.
7. Marketing
We may send you information about our services where you have consented or would reasonably expect to hear from us. Every marketing email identifies us as the sender and contains a working unsubscribe facility, as the Spam Act 2003 (Cth) requires. You can also opt out by contacting us using the details in section 14, and we will action it promptly and at no cost. We do not sell personal information and we do not supply it to third parties for their own marketing.
8. Who else sees it
8.1 We may disclose personal information to:
(a) our personnel and contractors, on a need-to-know basis;
(b) the third party platforms through which we operate and deliver services, including professional services automation, remote monitoring and management, ticketing, backup and disaster recovery, security monitoring, accounting, and cloud productivity and email;
(c) our clients, where you are an authorised contact or user within their organisation;
(d) our accountants, auditors, insurers and legal advisers;
(e) courts, tribunals, regulators and law enforcement agencies, where required or authorised by law; and
(f) an actual or proposed purchaser of our business or assets, subject to appropriate confidentiality arrangements.
8.2 Where we engage third party service providers, we seek to ensure, through our agreements with them or the terms on which their services are supplied, that personal information is protected and used only for the purposes for which it was disclosed.
8.3 We do not sell personal information.
9. Information stored overseas
9.1 Some of the platforms we rely on store or process data outside Australia. The countries involved are: United States, New Zealand, Ireland and other EU member states, Singapore, Philippines.
9.2 When selecting and reviewing those providers we consider their privacy commitments, security posture and the contractual terms on which they supply their services. The extent to which we can negotiate those terms varies, and with large platform vendors it is generally limited to accepting or declining their standard terms.
10. Security and retention
10.1 We take steps that are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The measures depend on the sensitivity of the information and the system holding it, and may include technical controls such as access restrictions, authentication requirements, encryption, endpoint protection, patching and security monitoring, together with organisational measures such as confidentiality obligations, training, and internal handling policies.
10.2 Clients and prospective clients conducting due diligence may request further detail about the controls applying to their services, and we will respond to reasonable requests. Specific security commitments, where required, belong in the services agreement rather than in this Policy.
10.3 Our security measures are reviewed periodically and change as systems, threats and available controls evolve. Nothing in this Policy warrants that a particular control applies to a particular system at a particular time.
10.4 No method of transmission or electronic storage is entirely secure, and we cannot guarantee absolute security.
10.5 We keep personal information only while we need it for the purposes in section 6, or while we are required to retain it by law or under a services agreement. Financial and tax records are generally retained for seven years. When information is no longer needed we destroy it or remove the identifying parts.
11. If something goes wrong
11.1 The Notifiable Data Breaches scheme in Part IIIC of the Privacy Act does not currently apply to us, for the reason given in section 1.1. We nonetheless take unauthorised access to or loss of personal information seriously.
11.2 If we become aware of a breach involving personal information we hold, we will investigate it, take reasonable steps to contain it and limit the harm, and consider what notification is appropriate. Where we assess that a breach is likely to result in serious harm to an individual, our intention is to notify the individuals affected and, where appropriate, the Office of the Australian Information Commissioner, in substance as the Notifiable Data Breaches scheme contemplates.
11.3 Where a breach affects information we hold in the capacity described in section 2.2, we will notify the affected client promptly after becoming aware of it and provide reasonable cooperation with any assessment or notification the client is required to make. Timeframes and procedures for that notification are those set out in the services agreement.
12. Access and correction
12.1 You may ask us for a copy of the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. Contact details are in section 14.
12.2 We will verify your identity before releasing anything, and we aim to respond within 30 days. We do not charge for making a request. If a request requires substantial work to fulfil we may charge a reasonable fee for retrieval, and we will tell you the amount before starting.
12.3 There are circumstances in which we may decline a request, including where it would unreasonably affect another person's privacy, where the information relates to anticipated legal proceedings, or where releasing it would compromise the security of a system we manage. If we decline, we will explain why and tell you how to raise a complaint about it.
12.4 Requests about information held within a client's systems are handled under section 2.3.
13. Complaints
13.1 If you think we have mishandled your personal information, contact our Privacy Officer using the details in section 14. Set out what happened and the outcome you are looking for.
13.2 We will acknowledge your complaint and investigate it, and we aim to provide a substantive response within 30 days. Where a complaint is complex or involves a third party, more time may be needed, and we will keep you informed of progress and the reason for any delay.
13.3 Because we are not currently an APP entity, the Office of the Australian Information Commissioner is generally unable to investigate a privacy complaint against us. Depending on the circumstances, other avenues may be available to you, including a State or Territory health privacy regulator where health information is involved, a State fair trading authority, or a court. Nothing in this Policy affects any right you have to take a matter further.
14. Contact us
Privacy Officer
Elscomm
PO Box 403, Brighton-Le-Sands NSW 2216
Email: privacy@elscomm.com.au
Telephone: +61 2 8188 9777
15. Links to other websites
Our website may link to sites operated by others. We are not responsible for their privacy practices or content, and this Policy does not apply to them.
16. Changes to this Policy
We may update this Policy to reflect changes in our practices, our systems or the law. The current version is available at elscomm.com.au/privacy and takes effect from the date shown at the top. Where changes are material we will take reasonable steps to bring them to the attention of affected clients.