Privacy Policy

1. Privacy at a glance

2. Who we are and what this policy covers

In this policy, "In2Digital", "we", "us" and "our" mean New Tech Digital Pty Ltd (ABN 38 643 245 247), trading as In2Digital Communications, of 2/30-32 Christensen St, Cheltenham VIC 3192. We are a Melbourne IT and communications provider. We supply managed IT and cyber security, Microsoft 365 and Google Workspace, business phone systems (VoIP), business NBN, websites and online stores, hosting and domain names, AI agents, hardware and IT projects.

This policy covers personal information we handle when you:

• visit in2digital.com.au, or contact us by form, email, phone, WhatsApp or social media
• become a client, or are a contact, user or staff member of a client
• use our client portal (portal.in2digital.com.au), our proposals and ordering site (order.in2digital.com.au) or our e-signature site (sign.in2digital.com.au)
• use or call a phone or NBN service we supply, including its voicemail and apps, and calls answered by an AI receptionist
• are a customer of, or visit the website or online store of, one of our clients whose systems we build, host or support (section 7 explains our role)
• join our partner (referral) program, or are referred to us by a partner
• work with us as a supplier or subcontractor.

"Personal information" means information or an opinion about an identified individual, or about an individual who is reasonably identifiable. Most of our clients are businesses, but the people we deal with are individuals. Sole traders are individuals too.

The laws we follow

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We apply the APPs, including the Notifiable Data Breaches scheme, to all the personal information we handle. For health information, we also follow the Health Privacy Principles in the Health Records Act 2001 (Vic), which apply to Victorian businesses of every size. Because we supply phone and internet services, the privacy rules in Part 13 of the Telecommunications Act 1997 (Cth) and the ACMA's telecommunications consumer rules also apply to those services (see section 8). We also follow the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth) for marketing.

This policy doesn't cover the websites of other organisations that we link to. It also doesn't cover how our clients handle personal information in their own systems, which is up to them (see section 7).

3. What personal information we collect

What we collect depends on how you deal with us. We only collect what we need for our services and business.

Our services are for businesses. We don't direct our website or advertising at children and don't knowingly collect personal information about children, apart from details that might appear incidentally in a client's systems.

4. Sensitive information

Sensitive information includes health information, racial or ethnic origin, religious beliefs, criminal records and biometric information. We don't ask for it unless we need it, and we only collect it with your consent or where the law allows. Examples:

• Hardship or safety. If you ask for financial hardship help, or tell us you are affected by domestic, family or sexual violence, you may tell us about your health or personal circumstances. We use it only to help you, keep it confidential and limit who can see it. We only ask for what we need to help you, and we don't ask for evidence unless we have to. Section 8 explains the extra protections for people affected by violence.
• Medical and security alarms. When we discuss an NBN service with you, we ask whether you have a medical or security alarm that uses your phone line, so you can check whether it will work with the NBN. A medical alarm can reveal health information.

Some of our clients, such as health and allied-health practitioners, keep sensitive information in systems we look after. We access it only when the work requires it and on the client's instructions (section 7). We handle any health information we hold under the Health Privacy Principles as well as the APPs.

5. How we collect it

• From you. We collect it when you fill in our form, email, call or message us, meet us, accept a proposal, sign an agreement, use a portal or pay us.
• From your organisation. When a client adds you as a contact or user, or asks us to set up an account, device, mailbox or phone extension for you.
• From systems we manage. Our monitoring and security tools (such as Action1, Sophos and the Microsoft 365 and Google Workspace admin centres) report device, user and security information to us automatically.
• From our suppliers. Wholesalers and vendors send us service, usage and billing information. Examples: call records from our phone carrier, NBN service and line test details from our NBN wholesaler, licence counts from distributors, and domain records from registries.
• From partners who refer you (section 10).
• From public sources, such as ABN Lookup, ASIC and your business website, for example to check .au domain eligibility or business details.
• Automatically on our website, through cookies and similar technology (section 11).

If we receive personal information we didn't ask for, we decide whether we could have collected it for our business. If not, we destroy or de-identify it where it is lawful and reasonable to do so.

6. Why we collect and use it

We collect, hold, use and disclose personal information to:

• answer enquiries and prepare quotes and proposals
• set up, supply, support, monitor, secure and maintain our services, and deliver projects and hardware
• order licences, phone numbers, NBN services and domain names for you from our suppliers. For example, Microsoft requires each customer to accept the Microsoft Customer Agreement, and domain rules require accurate registrant details
• check your identity before high-risk changes, such as porting a number away, changing the account holder or contacts, or giving out account details, as ACMA rules require (section 8)
• bill you, take payments, charge saved cards you have authorised, and follow up overdue accounts
• handle faults, outages, warranty claims and complaints, and tell you about outages that affect you
• run our client and partner portals and pay partner commissions
• keep our systems and yours secure, and detect fraud, spam and misuse
• meet our legal obligations, including tax, consumer and telecommunications law (IPND, emergency calls, law enforcement assistance and record keeping)
• understand how people use our website and improve our services
• send you service messages and, unless you opt out, news and offers about our services (section 17).

We only use or disclose personal information for another purpose if you agree, if you would reasonably expect it and it is related to the original purpose (directly related, for sensitive information), or if the law requires or allows it.

7. Information we handle for our clients

Many of our services involve looking after systems that belong to our clients: Microsoft 365 and Google Workspace accounts, email, files, computers, backups, websites and online stores, phone systems and AI agents. These systems can hold personal information about the client's staff, customers and others.

• The client controls that information and decides how it is used. We handle it only to supply, support and secure the services, on the client's instructions and under our agreement with them (see our Terms and Conditions).
• We access client data only when the work needs it, for example to fix a problem, restore a backup, move a mailbox or check a security alert.
• We don't use client data for our own purposes.
• We tell the client promptly if we suspect a data breach affecting its data (section 22).
• When a service ends, we return the client's data if asked and then delete our copies (section 19).
• For call recording, the client is responsible for lawful use and for telling callers.
• Websites and online stores. When we build, host or maintain a client's website or online store, we may see its customers' details, such as orders, accounts and form enquiries. We use test data where we can. If we copy live data for development (such as a staging site), we delete the copy when it is no longer needed for the work. We add analytics, advertising pixels, chat tools or forms only when the client asks. The client's website needs its own privacy policy that covers them, and we can help write it. Most websites on our hosting plans are hosted on our servers in Melbourne, and some are served through Cloudflare's global network. If a client chooses a platform such as Shopify, that platform holds the store's data in the client's own account, under its own terms.

If you work for, or are a customer of, one of our clients and have a question about your information in their systems, please contact that business first. We will help them respond.

8. Phone and NBN services (telecommunications information)

When we supply a phone (VoIP) or NBN service, we handle your service details (name, service address, phone numbers, NBN identifiers, equipment and IP addresses allocated), call detail records (numbers called and calling, date, time, duration and cost), and usage, fault, line-test and outage information. We don't listen to or record your calls, except when you turn on call recording in your own phone system or a call is handled by an AI receptionist (section 9). Voicemail messages left for you are stored on our phone platform and emailed to the address you choose (section 19).

Protected by the Telecommunications Act

Under Part 13 of the Telecommunications Act 1997 (Cth), carriage service providers such as us, and our staff and contractors, must not use or disclose information about your communications, your services or your affairs except where the Act allows. We disclose it only in those cases, for example:

• with your consent, or to supply, maintain and bill your service
• to other providers to connect calls, fix faults or port your number
• to the Integrated Public Number Database (IPND)
• to emergency services, including for a welfare check if an emergency call fails during a significant outage, or where we believe it is needed to prevent a serious threat to someone's life or health
• to law enforcement and national security agencies where the law authorises or requires it, for example under a warrant or an authorisation under the Telecommunications (Interception and Access) Act 1979 (Cth).

We keep a record of these disclosures as the Act requires, and the Office of the Australian Information Commissioner (OAIC) can inspect those records. Our subcontractors must follow the same rules.

IPND and phone directories

The law requires the name, service address and number of each phone service to be given to the Integrated Public Number Database (IPND) and kept up to date. Our voice provider lodges the IPND records for the numbers on its network. Please tell us if your details change. Telstra runs the IPND as a condition of its carrier licence. It is used by emergency services, to send emergency warnings to phones in an affected area, by law enforcement and national security agencies, and by approved publishers to produce phone directories. The ACMA can also authorise its use for approved research. Ask us if you want an unlisted (silent) number. An unlisted number isn't published in directories, but it can still be used by emergency services, for emergency warnings, by authorised agencies and for ACMA-authorised research.

Emergency calls (000)

Calls to 000 work on our phone services while your internet connection and power are working. They won't work during a power or internet outage, so keep a charged mobile phone handy for emergencies. When you call 000, the emergency call operator and emergency services can receive your phone number and the address listed for it in the IPND. Our internet phone services may not send your location automatically, so always tell the operator where you are, and keep your service address up to date with us.

Data retention

Australia's data retention law (Part 5-1A of the Telecommunications (Interception and Access) Act 1979) requires some providers to keep certain information about services and communications:

• subscriber and account details, for the life of the account plus 2 years
• information about communications, such as the source, destination, date, time, duration and type of a call or internet session, and the IP address allocated, for 2 years.

Where the law requires (for example the data retention law), we or our suppliers keep certain call and connection records for at least 2 years. The data retention law doesn't cover the content of calls or messages, or web browsing history. Retained data can be disclosed only to agencies the law authorises, and the Privacy Act applies to it for every provider, whatever its size.

Helping law enforcement

Like every carriage service provider, we must give authorities the help reasonably needed to enforce the law, protect public revenue and safeguard national security. We check that each request is lawful before acting, disclose only what it covers, and record the disclosure.

Identity checks and protecting you from fraud

To protect you from fraud, we confirm the identity of anyone who asks for a high-risk transaction on a phone or NBN account before we act, as the ACMA's identity rules require. High-risk transactions include porting a number away, changing the account holder, contacts or authorised representatives, adding a large charge, and giving out account or personal information, including in answer to a request for access to your information. We use multi-factor checks. For example, we ask for two details about you or your account, then send a one-time code to the email address registered on the account, or call you back on the number we hold. These checks are free. When you move a number to or from us, we give the other provider only the details needed to port it.

If you think your phone or internet service, or your account with us, has been used fraudulently, report it straight away to us and to your bank or other financial services provider.

If you're affected by domestic, family or sexual violence

If you, or someone who uses your service, is affected by domestic, family or sexual violence, tell us in whatever way is safe for you. We will:

• not disclose information that could identify or locate you, your contact details or your financial information to anyone without your consent, unless the law requires it
• agree with you how and when we contact you, and stick to it
• look at your information only when we need to manage your account, and protect it so a perpetrator can't get it
• not ask for evidence unless we have to. If we do need to see something, we record only the type of evidence we saw and don't keep a copy
• tell you and the ACMA within 2 days if your information is accessed or disclosed without authorisation, and give you the details of a support service.

Our bills don't list individual calls, so calls from our phone services to 1800RESPECT and the other support lines named in the ACMA's rules never appear on them. If you ask us for your call records, we leave out calls to those numbers. Our domestic and family violence statement explains how to get help from us and from support services.

9. AI receptionist and AI agents

When you call us

Calls to In2Digital are answered by our AI receptionist, which is a computer system, not a person. Every call it answers is recorded. It turns what you say into text, replies to you, and takes your details and message. After the call, it emails us a summary of the call, the transcript and a link to the recording. It can't transfer your call. If you'd like to speak to a person, tell it, and it will take your details so we can call you back.

• Deepgram turns speech into text and provides the receptionist's voice. The conversation is run by an OpenAI language model that Deepgram connects to. Deepgram processes calls outside Australia, most likely in the United States. OpenAI is in the United States.
• After the call, OpenAI writes the summary from the transcript. The email is sent from our Microsoft 365 account.
• Deepgram and OpenAI handle call information under their own terms. Deepgram may keep call audio and use it to improve its models.
• The recording stays on our phone platform in Melbourne. The email links to the recording, so we treat these emails as confidential. We haven't set an automatic deletion period for recordings yet. If you want the recording of your call deleted, ask us (section 25).

AI receptionists we run for clients

We also run AI receptionists for some of our clients. They work the same way. Every call is recorded on our phone platform, Deepgram and OpenAI process it as described above, and the summary, transcript and recording link are emailed to the people the client chooses, which can include us. These emails are sent from our Microsoft 365 account, which keeps a copy of each one in its sent mail. The client decides what its receptionist says and does, and we act on its instructions (section 7). The client chooses the greeting and is responsible for telling its callers that they are talking to an AI and that the call is recorded. A client can ask us to delete its recordings at any time.

If we build other AI agents for a client, they may use other AI providers, such as Microsoft, Anthropic or Google. We can tell the client which providers process its data and in which countries.

AI tools we use to run our business

We use AI tools, for example Anthropic's Claude, to help us build and maintain our systems. These tools can process information held in those systems, including personal information about our clients and their services. Anthropic is in the United States.

10. Partners and referrals

Our partner program pays a commission to businesses and individuals who introduce new clients to us.

• Partners. We use partners' details to manage the partner agreement, work out and pay commissions, and run the partner portal.
• People who are referred. A partner should give us your details only if you're happy for us to contact you. We use them only to contact you about the services you were referred for, and we don't send you marketing unless you agree to it.
• What partners receive. A partner only receives information about a referred client's services with that client's agreement. We work out commissions ourselves, and a person approves every payout. If you don't want a partner to see information about your services, tell us and we will stop sharing it.
• We pay partners commission only on services a referred client buys, not for contact details, and we don't buy contact lists.

11. Our website, cookies and tracking

Cookies are small files a website stores in your browser. Our website uses a few, all from the services described below. Australia has no separate cookie-consent law, but we treat the information these tools collect as personal information, and we keep it to a minimum.

Hosting and security (Cloudflare)

Cloudflare hosts and protects our website. It processes your IP address and request details to deliver the site and block attacks, and it may set a strictly necessary security cookie.

Google Analytics

Google Analytics 4 tells us how people use our site: the pages viewed, approximate location (city level), device and browser, how you arrived, and two kinds of action. It records when someone sends our contact form, together with the topic chosen but not their details, and when someone taps our phone, email or WhatsApp links. It sets the _ga and _ga_<ID> cookies, which last for 2 years from your most recent visit unless you delete them. Google says Google Analytics 4 does not log or store IP addresses. We keep the detailed data for no more than 14 months. You can opt out with the Google Analytics opt-out browser add-on, and control Google ads in My Ad Center.

Fonts, WhatsApp and social media

Our pages load the Inter font from Google Fonts, so Google receives your IP address and browser details when a page loads. If you message us on WhatsApp, Facebook or Instagram, Meta handles the message under its own terms and we see your name, number or profile and the message. Our social media pages are run by those platforms under their own privacy policies.

Your choices

You can block or delete cookies in your browser settings. Our website works without them, although we won't then know which pages helped you. We don't use any other cookies or tracking on our website.

12. Contact form collection notice

This notice explains what happens when you send the enquiry form on our Contact page.

• Who collects it: New Tech Digital Pty Ltd t/a In2Digital Communications. Contact details are in section 25.
• What we collect: your name, company (optional), email, phone (optional), the topic and your message. The form service also records your IP address and browser details.
• Why: to reply to you, give advice or a quote, and keep a record of your enquiry. We won't send you marketing unless you agree to it.
• If you don't give your details: we need your name, email, topic and message to reply. You can call us on 03 9114 2268 instead, and you can use just your first name or a business name.
• Who receives it: the form is processed by Web3Forms, which operates from India and uses infrastructure providers that may process data in other countries. Web3Forms may keep a copy of your submission under its own settings, and its current policy keeps submissions for a maximum of 3 years. To filter spam, it may send your IP address and email address to the spam-checking services CleanTalk and Akismet. The form then arrives in our Microsoft 365 mailbox. Google Analytics is told that a form was sent and the topic chosen, but not your details (section 11).
• Overseas: your enquiry is handled by Web3Forms in India and may be processed in other countries where its providers operate (section 16).
• Access, correction and complaints: see section 21 and section 23.

13. Payments, billing and accounts

• Card payments are processed by Stripe. Your card details go straight to Stripe, and we never see or store your full card number or security code. We keep the card brand, last four digits, expiry date and a Stripe payment token. Stripe may also use payment information to prevent fraud, under its own privacy policy.
• Saved cards and automatic charging. If you save a card and authorise us, our billing system charges it automatically, but only for invoices whose invoice email says it will. If the invoice is still unpaid, the first attempt is on the day after the due date or, if the due date falls after the 25th of a month, on the 26th of that month. If that is declined, we try again 3 days and 7 days after the first attempt, so there are no more than three attempts in total. We don't charge an invoice of more than $2,000 (including GST) automatically. We email a receipt for each payment and a notice if a payment is declined. You can change or remove a saved card in the client portal or by contacting us.
• Deposits and proposals. When you accept a proposal on our ordering site, you can pay a deposit or invoice by card through Stripe. Your card is saved for future invoices only if you choose to save it.
• Invoices. Renewal invoices are issued about 16 days before a service renews and are due 14 days after issue.
• Accounting. Invoices, payments and supplier records are kept in QuickBooks Online (Intuit). We may share them with our accountant or tax agent for tax and BAS purposes.
• Overdue accounts. If an invoice is overdue, we contact you about it. We never suspend a service automatically. Before we restrict or suspend a phone or NBN service for non-payment, we follow the notice and payment assistance steps that telecommunications rules require (see our Terms and Conditions).
• Credit reporting. We don't obtain credit reports about individuals from credit reporting bodies, and we don't report defaults to them.

14. Automated decisions

From 10 December 2026, the Privacy Act requires the businesses it covers to explain when computer programs make, or substantially help to make, decisions that could significantly affect you. We follow this rule. We use the following.

If you think an automated decision about you is wrong, contact us and a person will review it.

15. Who we share it with

We share personal information only as needed for the purposes in section 6. We may share it with:

• Our subcontractors (technicians and developers), who only get the access a job needs and must keep it confidential.
• Suppliers that provide your services, such as our NBN wholesaler and NBN Co, our phone carriers, Microsoft and Google (through our licence distributors), Sophos, Action1, domain registrars and registries, hardware distributors and manufacturers (for orders and warranty), and couriers.
• Providers that help us run our business, such as hosting, email, payment, accounting, analytics and AI services (section 16 lists those overseas).
• Our professional advisers, such as our accountant, lawyers and insurers.
• The partner who referred you, limited as described in section 10.
• Other phone and internet providers when you move a number or service to or from us.
• The IPND, emergency services and the Telecommunications Industry Ombudsman (TIO) (section 8).
• Government agencies, regulators and law enforcement (such as the ACMA, the OAIC, the ATO, police and national security agencies) where the law requires or authorises it.
• A buyer of our business, or of part of it, under confidentiality, if we sell it.
• Anyone you authorise, such as your IT manager, bookkeeper or new provider.

Public domain name lookups

Domain registries publish some registrant details in public lookup services (WHOIS or RDAP), as their rules require, so you must give accurate details to register a domain name.

• .au names: the public WHOIS shows the registrant's name, ABN or ACN and eligibility details, the contact names, the registrant and technical contact email addresses (on the web lookup), and the reseller's name (usually us). It doesn't show street addresses or phone numbers. You can give a role address, such as [email protected], as the contact email.
• Other domain names: registration details go to the registry operator for that extension, to ICANN and to ICANN's data escrow agent. Some of them may appear in public RDAP lookups, depending on the registry's rules and your privacy settings.

We don't sell personal information.

16. Overseas disclosure

We keep our core business systems in Australia, but some of the providers we use are based overseas or process data overseas. The table shows who they are, what they do for us and the countries where your information is likely to go.

Some of our services may also use other providers that store or process information overseas. If you want to know where a particular service keeps your information, ask us.

Kept in Australia: our business management system, client portal, partner portal, proposals site, e-signature system (which we run ourselves) and the client websites we host with Vultr are all on Vultr servers in Melbourne. Our cloud phone platform (including call recordings and voicemail) and our document store are on Amazon Web Services in Melbourne. Vultr and Amazon are US companies, but these servers are in Australia. Our NBN wholesaler, phone carriers and .au domain registrars are Australian businesses.

Before we use an overseas provider, we take reasonable steps to check that it will protect personal information in a way consistent with the APPs. We choose established providers that publish their security and privacy commitments, and we share only what each provider needs. We send health information overseas only where the Health Privacy Principles allow. We remain responsible for how these providers handle the information we give them.

17. Marketing and opting out

• We may send our clients occasional news, tips and offers about our services. We send marketing emails and other electronic messages only with your consent, which for existing clients may be inferred from our relationship.
• Every marketing message identifies us and includes an easy way to unsubscribe. We action unsubscribe requests within 5 working days.
• You can also opt out of all marketing by emailing [email protected] or calling us. You can ask us where we got your details, and we'll tell you unless that is impracticable or unreasonable.
• We don't make marketing calls to numbers on the Do Not Call Register unless you have agreed to receive them.
• If a partner refers you, we send you marketing messages only if you agreed to hear from us (section 10).
• Service messages continue after you opt out of marketing. These include invoices, receipts, payment notices, outage notices and security alerts.
• We don't run Meta ads, and we don't upload our client lists to advertising platforms or sell, rent or trade them.

18. How we store and protect it

We hold personal information electronically in the systems described in section 16, and very little on paper. We take reasonable technical and organisational steps to protect it from misuse, interference, loss, and unauthorised access, change or disclosure.

Technical measures

• Our business systems and client portal run on servers in Melbourne. Administrative access to them is restricted and encrypted.
• We protect our systems with access controls such as strong passwords and multi-factor authentication.
• Encryption in transit (HTTPS/TLS) for our website and portals, and encryption at rest for our document store.
• Admin access to client systems is limited to the people doing the work.
• Card details are held by Stripe, a PCI DSS Level 1 certified payment provider.

Organisational measures

• Only people who need personal information for their work can access it.
• Subcontractors only get the access a job needs and must keep it confidential.
• We check identity before high-risk changes to phone and NBN accounts (section 8).
• We remove access when it is no longer needed.

No system is completely secure. If you think your information with us has been put at risk, please contact us straight away.

19. How long we keep it

We keep personal information only as long as we need it for the purposes in this policy or as the law requires. Then we securely delete it or de-identify it. Some of our systems don't delete records automatically yet. Where that is the case, the table says so.

20. Dealing with us anonymously

You can browse our website without telling us who you are, and you can ask general questions without giving your name or by using a pseudonym. To quote for, supply or bill a service, we need to know who you are. Telecommunications identity rules, the Microsoft Customer Agreement and domain registration rules all require accurate customer details, so we can't supply those services anonymously.

21. Accessing and correcting your information

• You can ask for a copy of the personal information we hold about you. Contact us (section 25). We will confirm your identity before we give you anything. For information about a phone or NBN account, that means the multi-factor identity checks the ACMA's rules require (section 8).
• We respond within 30 days. Access is free. We will give you the information in the way you ask for if it is reasonable and practicable.
• If we can't give you access, or can only give part, we will tell you why in writing and how to complain, unless that would be unreasonable.
• If information we hold is wrong, out of date, incomplete or misleading, ask us to correct it. We will respond within 30 days, and if you ask, we will tell anyone we disclosed it to.
• If we don't agree to a correction, we will tell you why in writing. You can ask us to keep a statement with the information saying you believe it is wrong.

22. Data breaches

• If we suspect a data breach, we act quickly to contain it and assess it within 30 days, and much sooner where we can.
• If a breach is likely to cause serious harm to anyone, we notify the people affected and the OAIC, as the Notifiable Data Breaches scheme in the Privacy Act sets out.
• If information about someone we are helping because of domestic, family or sexual violence is accessed or disclosed without authorisation, we tell that person, using the contact method agreed with them, and the ACMA within 2 days (section 8).
• If a breach affects information we hold for a client, we tell the client as soon as practicable after we become aware of it. We help with its assessment and agree who will notify the people affected.

23. Privacy complaints

If you think we have mishandled your personal information, please tell us first so we can put it right.

1. Contact our Privacy Officer (section 25) by phone, email, post or through our contact form, with the details of your concern.
   • About a phone or NBN service we supply, including the privacy of your telecommunications information: we handle your complaint under our Complaints Handling Policy and the ACMA's complaints rules. We acknowledge it straight away if you speak with one of our people, or within 2 working days if you email, write or leave a message with our AI receptionist. We try to fix it on first contact. If we can't, we confirm a proposed resolution within 10 working days, or within 2 working days if it is urgent, when we also put the fix in place. Otherwise we complete the agreed fix within 5 working days of you accepting it, and we tell you as soon as we know of any delay, why it happened and the new timeframe.
   • About anything else: we handle it under the same Complaints Handling Policy, with the same timeframes, and in any case give you a written response within 30 days.
2. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, phone 1300 363 992, or post to GPO Box 5288, Sydney NSW 2001. The OAIC generally expects you to complain to us first and allow us 30 days to respond.
3. For phone and NBN services, including the privacy of your telecommunications information, you can also contact the Telecommunications Industry Ombudsman (TIO), a free and independent dispute resolution service: tio.com.au, phone 1800 062 058, or post to PO Box 276, Collins Street West VIC 8007.
4. For health information, you can also complain to Victoria's Health Complaints Commissioner: hcc.vic.gov.au, phone 1300 582 113.

If you are deaf, or have a hearing or speech impairment, you can contact us, the OAIC or the TIO through the National Relay Service. Making a complaint won't affect how we treat you.

24. Changes to this policy

We may update this policy as our services, providers or the law change. The date at the top shows when it last changed. Earlier versions are available on request.

25. Contact us

For privacy questions, access or correction requests, or complaints, contact our Privacy Officer:

This policy is free. Ask us and we will email it to you, post a printed copy or provide it in another format.