NarwhAI Back to site

Privacy policy

This policy explains what personal information NarwhAI collects, why we collect it, who we share it with, and how you can access, correct or complain about it.

Last updated: 1 October 2026

1. Who we are

NarwhAI (ABN 12 126 499 242) is a small consultancy based in Canberra, ACT, providing digital risk and compliance assessments to businesses across Australia. In this policy, “we”, “us” and “our” mean NarwhAI.

Privacy enquiries: hello@narwhai.com.au

2. Our approach

We handle personal information in accordance with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We apply the APPs to everything we do, whether or not the small business exemption would otherwise apply to us. Given the nature of our work, we think that is the only defensible position.

3. What we collect

Information you give us

When you use the enquiry form on this website, we collect:

  • your name;
  • your email address;
  • your business name;
  • your website address, if you choose to provide it; and
  • the service area you select, if you choose to select one.

If you contact us by email or phone, or engage us for work, we also collect the information in that correspondence, and the information reasonably necessary to deliver and invoice the engagement.

Information collected automatically

This website is hosted on Cloudflare. Cloudflare processes technical information about each request, including your IP address, browser type and the page requested, to serve the site and protect it from attack. Cloudflare may also set a strictly necessary cookie for security and bot detection.

We use Cloudflare Web Analytics to count visits. It does not use cookies, does not fingerprint your device, and does not track you across other websites.

This website sets no cookies of its own, and stores nothing in your browser. There is no advertising, no social media tracking and no third-party marketing script on this site.

Sensitive information

We do not seek sensitive information (such as health information) through this website, and ask that you not include it in the enquiry form. If you need to discuss something sensitive, contact us and we will arrange a more appropriate channel.

4. Information we encounter during an engagement

Assessment work may give us access to systems, documents or records that contain personal information about your customers, staff or others. Where that happens:

  • we access only what is necessary to perform the assessment;
  • we handle that information solely to deliver the engagement, and for no other purpose;
  • we do not disclose it to anyone outside the engagement without your instruction, unless required by law;
  • we keep it confidential on the terms in our engagement documents; and
  • we return or securely destroy it when it is no longer required.

Where we handle personal information on your behalf, you remain the entity responsible for it under the Privacy Act, and our handling is governed by the engagement terms agreed with you.

5. Why we collect it, and how we use it

We collect and use personal information to:

  • respond to your enquiry;
  • carry out the free check you request;
  • prepare quotes and deliver engagements;
  • issue invoices and keep financial records;
  • maintain records of the work we have performed; and
  • meet our legal and regulatory obligations.

We do not sell personal information. We do not use it for automated decision-making that produces legal or similarly significant effects.

6. Who we share it with

We disclose personal information only to the service providers we need to run the business, and only to the extent necessary:

  • Cloudflare, Inc. – website hosting, DNS and security. Processes request data globally.
  • Formspree, Inc. – processes submissions from the enquiry form and forwards them to us. Located in the United States.
  • Zoho Corporation – our email. Our mailbox is hosted in Zoho’s Australian data centre.
  • Google LLC – where enquiry notifications are received in a Google-hosted mailbox. Located in the United States.
  • Specialist advisers – where an engagement needs sector knowledge, for example in healthcare or engineering. They are based in Australia, are given access only to what that engagement requires, and are bound by written confidentiality obligations.
  • Our accountant and the Australian Taxation Office – for invoices and financial records, as required.

We may also disclose personal information where we are required or authorised to do so by law.

7. Overseas disclosure

Some of the providers above store or process information outside Australia, principally in the United States, and Cloudflare processes request data in whichever region serves your connection. By using the enquiry form or corresponding with us, you consent to that disclosure. We take reasonable steps to use providers with appropriate security and contractual protections, but overseas recipients are not always subject to the Privacy Act.

If you would prefer that your information is not sent through an overseas provider, contact us directly by phone instead of using the form.

8. Direct marketing

We do not send marketing email. If we later offer a mailing list, it will be opt-in, and every message will carry an unsubscribe link. Responding to your enquiry is not marketing.

9. How we protect it

We take reasonable steps to protect personal information, including:

  • encryption in transit (this site is served over HTTPS only);
  • multi-factor authentication on the accounts we use;
  • access limited to the people working on your engagement, on a need-to-know basis, each bound by written confidentiality obligations; and
  • prompt deletion of information we no longer need.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

10. How long we keep it

  • Enquiries that do not become engagements: up to 24 months, then deleted.
  • Engagement records, reports and correspondence: 7 years from the end of the engagement, which reflects our record-keeping and tax obligations.
  • Client data accessed during an assessment: returned or destroyed on completion, unless you ask us to retain it.

We may keep de-identified findings indefinitely to illustrate our work. De-identified means the client, individuals and any identifying detail are removed, as in the sample finding on our home page.

11. Accessing and correcting your information

You can ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing hello@narwhai.com.au. We will respond within 30 days. There is no charge. We may need to verify your identity first.

If we refuse a request, we will tell you why in writing, and explain how to complain.

12. Complaints

If you think we have mishandled your personal information, email hello@narwhai.com.au with the details. We will acknowledge your complaint promptly and respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au, or 1300 363 992.

13. Changes to this policy

We may update this policy as our services or obligations change. The current version is always on this page, with the date it was last updated at the top. Material changes will be noted here.

14. Contact us

NarwhAI · ABN 12 126 499 242 · Canberra, ACT
Email: hello@narwhai.com.au
Phone: 0414 270 214