Website Privacy Policy

1. WHO WE ARE

HackHouse Pty Ltd (ABN 38 620 566 430) ("HackHouse", "we", "us", "our") is an Australian offensive security company. This policy explains how we handle personal information collected through our public website at www.hackhouse.com (the "Website") and through the email addresses and forms published on it.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles in Schedule 1 of that Act.

This policy covers the Website only. Our Privacy Policy, which applies to clients and their representatives, job applicants, employees and anyone else whose personal information we handle in the course of our business, is available from our Privacy Contact on request. Where you become a client, or apply to work with us, that Privacy Policy applies to the personal information we handle in that relationship, and any contract you have with us applies to the information handled under it.

2. WHAT WE COLLECT

We collect personal information through the Website in three ways.

(a) Information you give us. When you contact us through the contact form on the Website or by email, we collect the information you provide, which usually includes your name, your organisation and role, your email address and telephone number, and the content of your message. If you ask us about our services, this may include information about your organisation's systems and security concerns. If you send us your resume, as the careers section of the Website invites, we collect the information in it, which may include your employment history, qualifications, certifications and referees. Our Privacy Policy applies to the personal information of job applicants from that point.

(b) Information collected automatically. When you visit the Website, the servers that host it record technical information that may include your IP address, the pages you requested, the date and time of your visit, the website that referred you, and your browser and device type. This information is used to operate and secure the Website. We do not currently use a website analytics service. Section 6 describes cookies and what will happen if we introduce analytics.

(c) Vulnerability reports. If you report a security vulnerability in our systems under section 8, we collect your contact details and the content of your report.

You can browse the Website without giving us personal information, and you may contact us anonymously or under a pseudonym where it is practicable for us to deal with you that way. We will usually need your name and a contact address to respond to an enquiry or to engage with you about our services.

We do not collect sensitive information through the Website, and we ask that you do not send it to us unless we have asked for it for a specific purpose. If a security concern you raise involves personal information about other people, please describe it rather than sending the information itself.

3. WHY WE COLLECT IT

We collect and use personal information from the Website to:

respond to your enquiry and communicate with you about it;
scope, propose and, if engaged, deliver our services;
consider a resume or application you send us for a current or future role;
investigate and remediate a security vulnerability you report, and acknowledge your report;
operate, secure and improve the Website, including detecting and investigating misuse;
comply with our legal obligations; and
with your consent, contact you about HackHouse services, events or publications. Every marketing message we send will tell you how to opt out, and we act on an opt-out promptly.

We use personal information only for the purpose for which it was collected, a directly related purpose you would reasonably expect, a purpose you have consented to, or as otherwise required or authorised by law.

Automated decision-making. HackHouse does not use computer programs to make, or to substantially and directly support, a decision that could reasonably be expected to significantly affect an individual's rights or interests. Ordinary administrative automation, such as spam filtering on our enquiry inbox, is not such a decision. If HackHouse introduces automated decision-making of that kind, it will update this policy to describe the information used and the decisions involved.

4. WHO WE DISCLOSE IT TO

HackHouse does not sell personal information. We disclose personal information collected through the Website only:

(a) to the service providers we use to run our business, as described below;
(b) where required or authorised by law, including under a court order, subpoena or a lawful request from a regulator or law enforcement agency;
(c) where disclosure is necessary to prevent or lessen a serious threat to the life, health or safety of a person or to public safety; or
(d) with your consent.

Service providers and overseas disclosure. We run our business and deliver our services using technology service providers, including email and collaboration, cloud hosting and storage, software-as-a-service, website hosting, and artificial intelligence services provided by Microsoft, Amazon Web Services, Google (including Google Workspace), Anthropic and OpenAI. These providers may store or process personal information outside Australia, including in the United States and in other countries where they operate data centres. Personal information you give us through the Website can reach these providers when it is contained in our records and communications. We make reasonable efforts to mask personal information before it is provided to an artificial intelligence service.

Before disclosing personal information to an overseas recipient, HackHouse takes reasonable steps to ensure the recipient does not breach the Australian Privacy Principles in relation to it, and remains accountable for that information under the Privacy Act, except where you have consented to the disclosure after being told those steps will not be taken, or the disclosure is required or authorised by law. Other than as described in this section, HackHouse does not disclose personal information to overseas recipients.

5. HOW WE STORE AND PROTECT IT

HackHouse takes reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our measures include encrypted storage on company systems and approved cloud services, access controls that limit personal information to the people who need it, confidentiality obligations on everyone who works for us, and secure destruction when information is no longer needed, in accordance with our Data Handling and Destruction Policy.

We keep enquiry correspondence for as long as we need it to deal with your enquiry and any engagement that follows, and for as long as the law requires. Where no legal period applies, we destroy or de-identify it once it is no longer needed. We keep a resume you send us while we are considering you for a current or future role, and destroy it when we are not. Records of a vulnerability report are kept for at least 3 years.

No transmission over the internet is completely secure. If you are concerned about sending confidential information by email, contact us and we will agree a secure channel with you.

6. COOKIES AND ANALYTICS

The Website may set cookies, which are small data files stored on your device, where they are needed for the Website to work, for example to keep the contact form working or to protect it from automated abuse. These may be session cookies, which expire when you close your browser, or persistent cookies, which remain until they expire or you delete them. You can disable cookies through your browser settings, although parts of the Website may then not work as intended.

We do not currently use a website analytics service or any tracking cookies. We plan to introduce website analytics in future. If we do, we will update this policy before the analytics start, and the analytics data (page views, referrer information and approximate location) will be used in aggregate to improve the Website and not to identify individuals. We do not use, and will not introduce, tracking technologies for targeted advertising, and we do not share Website activity data with advertising networks.

The Website may contain links to other websites. This policy does not apply to those websites, and we are not responsible for their privacy practices.

7. NOTIFIABLE DATA BREACHES

HackHouse is subject to the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we suspect that personal information we hold has been accessed or disclosed without authorisation, or lost, in a way that is likely to result in serious harm, we will contain the breach and carry out a reasonable and expeditious assessment within 30 days of becoming aware of the suspected breach. Where there are reasonable grounds to believe an eligible data breach has occurred, we will notify the Office of the Australian Information Commissioner and the affected individuals as soon as practicable, using the statement the Privacy Act requires.

8. REPORTING A SECURITY VULNERABILITY

If you believe you have found a security vulnerability in the Website or in another HackHouse system, please report it to security@hackhouse.com. We acknowledge every report within 5 business days. Our Website Terms and Conditions set out the conditions under which we treat good-faith research against our own systems as authorised, and what we ask of you in return.

We use the personal information in a vulnerability report only to investigate and remediate the issue, to communicate with you about it, and to keep the records our policies require. We will not publish your name without your permission.

9. ACCESS AND CORRECTION

You may ask us for access to the personal information we hold about you, and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact our Privacy Contact at privacy@hackhouse.com. We will respond within 30 days. In some circumstances the Privacy Act permits us to refuse access, for example where giving access would unreasonably affect another person's privacy. If we refuse a request, we will give you written reasons and tell you how you can complain.

10. COMPLAINTS

If you believe HackHouse has breached the Australian Privacy Principles in relation to your personal information, please contact our Privacy Contact at privacy@hackhouse.com in the first instance. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

Website: www.oaic.gov.au
Phone: 1300 363 992

11. CHANGES TO THIS POLICY

We may update this policy to reflect changes in the Website, our practices or the law. The current version is published on the Website, and the version number and effective date at the top of this policy identify it. Where a change is material, we will draw attention to it on the Website.

12. CONTACT

Organisation: HackHouse Pty Ltd
ABN: 38 620 566 430
Privacy Contact: privacy@hackhouse.com
Security reports: security@hackhouse.com
Postal address: Unit 155, 248 Osborne Ave, Clayton South VIC 3169, Australia