Privacy Policy.
Your data, handled with care.

• Respond to enquiries, arrange consultations and scoping calls, and prepare quotations and proposals;
• Deliver cybersecurity services, including VAPT, compliance support, SOC and SIEM, DevSecOps, threat modelling, security architecture and incident response;
• Communicate findings, escalate critical risks, support remediation, retest and issue agreed reports and attestations;
• Operate, secure and improve the Site and our systems, and detect fraud, misuse and security incidents;
• Manage contracts, billing, accounting, audit and insurance records;
• Assess job applications and manage recruitment;
• Send service updates, and marketing communications where you have requested them or the law permits; and
• Comply with legal obligations and establish, exercise or defend legal claims.

If we need to use personal data for a materially different and incompatible purpose, we will provide an additional notice and obtain consent where required by law.

Woollemia Infosec handles Client Data under the applicable proposal, statement of work, rules of engagement, data-processing terms, non-disclosure agreement and client instructions. We test only authorised targets, restrict access to personnel with a business need, and share findings only with contacts approved by the client.

We use secure channels for sensitive information and follow the agreed retention or deletion schedule. We never name a client or disclose its vulnerabilities, systems, findings or results without permission. Any de-identified material used for methodology improvement or case studies remains subject to contractual safeguards against re-identification.

Clients must share only data they are authorised to share and must flag any special handling requirements before transfer. Where we act as a processor or service provider, individuals' requests may need to be directed to the client that controls the data.

We apply reasonable administrative, technical and physical safeguards against unauthorised access, use, alteration, disclosure, loss or destruction. Depending on the risk, these may include access controls, least-privilege permissions, strong authentication, encryption in transit and at rest, secure transfer channels, logging and monitoring, backups, vulnerability management and vendor oversight.

No internet transmission or storage system is completely secure. If a personal-data breach occurs, we will investigate, contain and remediate it, and notify affected individuals and authorities where the law requires.

Other laws may provide additional rights, such as restriction, objection, data portability or the right to complain to a regulator.

To make a request, email info@woollemia.com with the subject line "Privacy Request". We may ask you to verify your identity and authority, and we will respond within the period required by law. We may decline a request that affects another person's rights, exposes confidential or security-sensitive information, conflicts with the law or an investigation, or is manifestly unfounded or excessive.

Please use our grievance process before escalating a complaint. Where the Digital Personal Data Protection Act 2023 and its rules are in force and apply, you may also approach the Data Protection Board of India after using the grievance-redressal process.