Privacy policy

Found To Fixed Pty Ltd, ACN 695 696 514, Sydney, Australia. Version 1.1, 4 October 2026. Next review before 10 December 2027.

Summary#

Found To Fixed assesses cyber security controls for Australian space companies. This policy sets out the personal information we hold, why we hold it, who sees it, and how you can access it, correct it, or complain.

We hold business contact details for clients, prospective clients, event contacts, and suppliers, and working information about people inside a client organisation while we assess its controls.
We ask clients for evidence that a control operates, such as the date a screening check was completed. We do not ask for police check results, security vetting files, or medical information.
Two assessors see engagement evidence. A subcontracted specialist sees it only when the client agrees in writing.
Our reports refer to roles in place of names wherever the finding allows.
We use cloud services to store email, documents, and accounts. Some of them hold data in the United States.
We do not sell personal information. No computer program we use makes decisions about individuals.
Write to privacy@foundtofixed.com to see or correct your information, or to complain. We reply within 30 days. If our answer does not resolve it, you can complain to the Office of the Australian Information Commissioner.

1. Who we are and what this policy covers#

Found To Fixed Pty Ltd, ACN 695 696 514, is a Sydney company. In this policy, "we", "us", and "our" mean the company.

The policy covers personal information: information or an opinion about an identified individual, or an individual who is reasonably identifiable. It applies whether the information is true or not, and whether it is recorded on paper, in email, or in a system.

When we deliver services under a contract, the privacy terms in that contract also apply.

2. Whose information we hold, and why#

Who you are	What we hold	Why we hold it
A client or prospective client, such as a founder, CTO, engineering lead, CISO, or director	Name, title, organisation, work email and phone, notes of meetings and calls, the security requirements you describe to us, billing contact	To scope, quote, contract, deliver, and invoice an engagement, and to contact you at the next design or launch gate
A staff member or contractor named in a client's assessment evidence	Name, role, work email, system accounts and access rights, log entries, training completion, screening completion dates, responsibilities recorded in policies and registers	To test whether a control operates and who owns it
A founder or operator we interview for market research	Name, organisation, role, interview notes	To test whether our services meet a real need
A person who attends our training, talks, or events, or subscribes to updates	Name, organisation, role, email, attendance, and any accessibility needs you choose to tell us	To run the event, send material you asked for, and tell you about future events
A person who contacts us or visits our website	What you send through the contact form: name, email, organisation, and message. It is stored in HubSpot, our customer relationship management system. When you submit the form, Cloudflare Turnstile processes your IP address and browser signals to screen out spam.	To answer you. The website runs no analytics.
A supplier, subcontractor, or adviser	Name, contact details, ABN, bank account for payment, and for subcontractors, qualifications, insurance, and confidentiality undertakings	To engage and pay you

Sensitive information#

The Privacy Act gives extra protection to sensitive information, which includes health information, criminal records, racial or ethnic origin, political opinions, and union membership. An assessment of security controls does not need it, and we take four steps to keep it out of our records:

Our evidence requests ask for completion dates and currency, such as the date a background check was done and whether it is still valid.
Before evidence arrives, we tell the client to redact health details, criminal record content, and vetting files.
If sensitive information reaches us anyway, we delete it within 5 business days and ask for a redacted copy.
We collect accessibility or dietary needs for training only with your consent, and delete them after the event.

3. How we collect it#

Most information comes directly from you, through email, calls, meetings, forms, and contracts.

When your employer engages us, it supplies evidence that names you. We ask every client to tell its staff that assessors will see this evidence.

Before we contact a prospective client or partner, we read public sources: company websites, LinkedIn profiles, conference programs, and the ASIC register. People who introduce us, including contacts through industry bodies, also pass on names and contact details.

4. How we use it#

To deliver engagements: scoping, assessment, peer review, the report, the walkthrough, and follow-up work at later design and launch gates.
To run the company: invoicing, accounting, insurance, and legal advice.
To improve our assessment method. Each engagement keeps a log of lessons for the next framework revision. We remove names and client identifiers before any lesson enters the framework.
To tell business contacts about our services, training, and publications. Every marketing email carries an unsubscribe link, as the Spam Act 2003 requires.
To comply with the law, respond to lawful requests, and deal with claims.

We use personal information for another purpose only with your consent, or where the Privacy Act permits it.

The client that engaged us receives the report for its own engagement.
A subcontracted specialist, such as an operational technology assessor, receives engagement evidence only when the client agrees in writing, and only under confidentiality terms.
Our accountant, lawyer, and professional indemnity insurer receive what they need to advise us or respond to a claim.
Service providers store or process information for us: email and document storage, accounting software, customer relationship management (HubSpot), website hosting and spam screening for the contact form (Cloudflare), and AI drafting tools.
A regulator, court, or law enforcement body receives information where the law requires or authorises it.

We do not sell, rent, or trade personal information.

6. Information stored or sent overseas#

Some of our service providers store data outside Australia. The country most likely to hold it is the United States.

Where a provider offers Australian hosting, we select it. Client engagement evidence stays in Australian-hosted storage. Before we use an overseas provider, we check its contract terms so that it handles personal information to a standard consistent with the Australian Privacy Principles.

7. How we use AI tools#

We use commercial AI assistants to help analyse information, manage information, draft and edit documents, including proposals and reports. We apply three rules:

We use business accounts whose terms exclude our inputs from model training.
We remove names, contact details, and account identifiers from client material before any of it goes into an AI tool.
An assessor checks every AI-assisted output before it leaves the company, and assessors sign every report.

8. Automated decisions#

From 10 December 2026, the Privacy Act requires us to tell you if a computer program uses your personal information to make, or substantially help make, a decision that could significantly affect your rights or interests.

Our assessment workbook calculates maturity levels for an organisation's security controls. An assessor reviews every result before it enters a report, and no result decides anything about a person's employment, access, or entitlements. We will update this section before we use any program that does.

9. How we protect and keep it#

Every account that holds personal information requires multi-factor authentication.
Our storage services encrypt data in transit and at rest.
Each client's evidence sits in one named location.
Our laptops and phones use full-disk encryption and automatic screen locks.

Record	How long we keep it
Engagement evidence supplied by a client	Returned or destroyed 90 days after the final report, unless the client asks in writing for a longer period.
Final reports and working papers	7 years from the final report, to meet professional indemnity insurance requirements.
Financial records, including invoices	7 years, as the Corporations Act 2001 requires.
Prospect, interview, and event contacts	Reviewed every 2 years.

10. Data breaches#

If we have a data breach that is likely to cause serious harm, we notify the affected individuals and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

When the breach involves a client's engagement information, we also tell the client within 48 hours of confirming it.

11. Dealing with us without giving your name#

You can ask general questions, attend public talks, and read our publications without identifying yourself. If you take part in a market research interview, we can record the notes against a code in place of your name.

To quote, contract, invoice, or deliver an assessment, we need the names and contact details of the people we deal with.

12. Accessing and correcting your information#

You can ask for a copy of the personal information we hold about you, and ask us to correct anything inaccurate, out of date, or incomplete. Email the Privacy Officer at the address in section 15.

We confirm your identity, asking only for what we need to do that, and respond within 30 days. There is no charge.

The Privacy Act sets out limited grounds for refusing access or correction. If we rely on one, we tell you which ground in writing, and how to complain.

13. Complaints#

If you think we have mishandled your personal information, write to the Privacy Officer. We acknowledge your complaint within 5 business days and give you a written response within 30 days.

If our response does not resolve your complaint, you can take it to the Office of the Australian Information Commissioner. The OAIC generally expects you to complain to us first.

Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5288, Sydney NSW 2001

14. Changes to this policy#

We review this policy every year, and whenever the way we handle personal information changes. The version number and date sit at the top. When a change affects how we use or share your information, we note it on our website and email current clients.

15. Contact#

Privacy Officer, Found To Fixed Pty Ltd

Email: privacy@foundtofixed.com

We will provide this policy in another format, such as a printed copy or large print, on request.