Privacy Policy.

Aegentra is a trading name of HansDivisionGroup Pty Ltd (ABN 84 678 444 463; ACN 678 444 463), an Australian proprietary company registered in Victoria.

In this policy, "we", "us", "our" and "Aegentra" refer to HansDivisionGroup Pty Ltd. "You" refers to any person whose personal information we collect — including visitors to aegentra.com.au, prospects, clients, and contractors.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where applicable, we also comply with the EU General Data Protection Regulation (GDPR) for visitors and clients in the European Economic Area.

We collect only the personal information needed to deliver our services and run our business. The categories below cover the information we handle, including recruitment applications described below:

• Identity & contact data — name, business email address, phone number, job title, employer.
• Engagement data — the contents of enquiries you submit, scoping conversations, project notes, and correspondence with our team.
• Technical data — IP address, browser type, device information, pages visited, referring URL, and approximate location (city-level) collected via standard web server logs and analytics.
• Tenant assessment metadata — Aeges assessments can collect supported configuration and evidence metadata. Before access is approved, confirm the data categories, permissions, processing and storage locations, report destination and retention arrangements in the engagement scope.

We do not deliberately collect sensitive information (as defined under the Privacy Act). If you submit sensitive information voluntarily — for example in an email about a health-sector engagement — we will handle it under the same principles as the rest of this policy.

When you apply for a role, we collect your name, city and resume. A cover letter is optional. We use these details and the contact information you include in your documents to assess your application and communicate with you about recruitment. Without the required information, we cannot assess an on-page application.

Our website host, Vercel, processes your submission. Resend delivers the application and any attachments to Aegentra at careers@aegentra.com.au. The form does not collect a separate email address or send an automatic acknowledgement email. These providers and email systems may process information outside Australia. Application attachments are sent privately by email; they are not published or offered through public download links.

We exclude the careers application flow from analytics and session replay. Application submission does not subscribe you to marketing. We do not send application material to AI services or use automated candidate scoring in this application flow.

Keep examples de-identified. Do not submit client reports, credentials, confidential evidence, identifiable third-party information, identity documents or police-check reports at this stage. Contact us to discuss recruitment adjustments, access or correction requests, or questions about handling and disposal of your application.

We collect personal information:

• Directly from you — when you fill in a contact form, send us an email, book a discovery call, or sign a service agreement.
• Automatically — when you visit aegentra.com.au our servers and analytics tools record technical data (see Cookies Policy).
• From third parties — where you have consented (e.g. a referral, a LinkedIn introduction, or a verifiable business registry).

We use personal information to:

• Deliver, scope, and improve the services you have engaged us for, or are evaluating us for.
• Respond to enquiries and provide ongoing support to clients on retainer.
• Comply with our legal obligations — including financial, taxation, and audit-trail requirements under Australian law.
• Operate, secure, and improve aegentra.com.au and the tools we use to run our business.
• Where you have explicitly consented, send you occasional updates about Aegentra services. You can unsubscribe at any time.

We do not sell, rent, or trade personal information. We use Google Ads and, when you consent, Microsoft Advertising to attribute confirmed enquiries to ad clicks. See our Cookies Policy for how Consent Mode, analytics storage and hashed contact matching work.

Assessment reads supported Microsoft 365 configuration. Writing reports to an agreed SharePoint location is a separate permission and action; read-only assessment does not mean no report writes. Before access is approved, confirm the data categories, permissions, processing and storage locations, report destination and retention arrangements in the engagement scope.

Operational records (CRM, finance, our internal helpdesk) are hosted in Australian regions of reputable cloud providers (Microsoft 365 Australia, our Australian Microsoft Azure tenant). Where any service provider stores data outside Australia, we ensure it is bound by enforceable contractual privacy obligations equivalent to APP 8.

We may share personal information with the following parties, only as necessary:

• Service providers — Microsoft, our hosting and email providers, our accounting and CRM platforms — each under written terms aligned with this policy.
• Google — Google Analytics 4 and Google Ads receive page and confirmed-conversion measurements subject to your Consent Mode choice. If you accept and submit a confirmed contact enquiry, the Google tag may normalise and hash your email address in the browser for Enhanced Conversions. If you reject, the site does not provide your email address to Google for ad matching.
• Microsoft — Microsoft Advertising UET and Clarity load only after you accept non-essential processing. They receive page, usability and conversion events. For a confirmed contact enquiry, the site may transmit a browser-generated SHA-256 hash of your email address so Microsoft can match the enquiry to an ad click. Microsoft does not receive the plaintext email from this code path.
• Professional advisers — our lawyers, auditors, and insurers, on a confidential basis.
• Authorities — where required by Australian law, court order, or regulator request.

These providers may process data outside Australia under their own privacy frameworks. We do not disclose personal information to other overseas recipients except as expressly described in this policy, and we do not sell personal information.

Cybersecurity is our core competency. We secure personal information using the controls we recommend to our clients — including multi-factor authentication, conditional access, least-privilege role assignments, encrypted-at-rest and in-transit storage, audit logging, and tenant-level Data Loss Prevention.

No system is perfectly secure. We will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) within the timeframes required under the Notifiable Data Breaches scheme if a qualifying breach occurs.

You have the right to:

• Request access to the personal information we hold about you.
• Ask us to correct information that is inaccurate or out of date.
• Withdraw consent for marketing communications at any time.
• Lodge a complaint with the Office of the Australian Information Commissioner (oaic.gov.au) if you believe we have mishandled your information.

Email Contact@Aegentra.com.au and we will respond within 30 days.

We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated to clients on retainer directly and posted on this page.