PRIVACY POLICY

Last updated: 06/08/2026

Version: 1.0

INTRODUCTION

Crennotech Pty Ltd (ABN 51 631 145 072) (“Crennotech“, “we“, “us“, “our“) is an Australian technology company providing custom software development, system integration, and IT consulting services to clients in Australia and internationally.

We are committed to protecting the privacy and security of personal information we collect, hold, use, and disclose in the course of our business. This Privacy Policy explains how we manage personal information in accordance with:

• the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs); and
• ISO/IEC 27001 (Information Security Management) and ISO/IEC 27701 (Privacy Information Management) frameworks, which govern our internal information security and privacy governance practices.

This Policy applies to all personal information we handle in connection with our business activities.

1. ABOUT THIS POLICY
   • This Privacy Policy applies to Crennotech’s collection, holding, use, and disclosure of personal information in connection with:
     • the provision of software development, system integration, and IT consulting services;
     • our website(s), client portals, and digital platforms;
     • our employment and contractor engagement activities; and
     • our general business operations.
   • By engaging our services, visiting our website, or providing us with personal information, you acknowledge that you have read and understood this Privacy Policy.
   • We review and update this Policy at least annually, or sooner where required by changes in law or our practices. The current version is always available on our website free of charge.
2. DEFINITIONS
   • In this Policy:
     • “Personal information” has the meaning given in the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in a material form or not.
     • “Sensitive information” has the meaning given in the Privacy Act 1988 (Cth), including health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, and biometric data.
     • “Processing” means any operation performed on personal information, including collection, recording, storage, use, disclosure, and deletion.

3. PERSONAL INFORMATION WE COLLECT AND HOLD
   • We may collect and hold the following kinds of personal information:
     • Identity and contact information: full name, job title, employer, business address, email address, telephone number;
     • Account and authentication information: usernames, passwords (stored in hashed form), access credentials, and multi-factor authentication data;
     • Professional and business information: company details, ABN/ACN, industry, project requirements, and service preferences;
     • Technical and usage data: IP addresses, browser type, device identifiers, log files, cookies, and usage analytics from our websites and platforms;
     • Communications data: emails, messages, meeting notes, and records of correspondence with us;
     • Financial information: billing details, payment records, and invoicing information (payment card data is processed by our payment processors and not stored by us);
     • Employment and recruitment data: CVs, qualifications, references, background check results, and employment history for job applicants and employees; and
     • Client-provided data: personal information contained in systems, databases, or files provided to us by clients for the purpose of delivering contracted services.
   • We do not intentionally collect sensitive information unless it is reasonably necessary for our services or required by law, and we have obtained the individual’s consent or another lawful basis applies.
4. HOW WE COLLECT PERSONAL INFORMATION
   • We collect personal information by lawful and fair means, and only by such means. We collect personal information:
     • directly from individuals when they contact us, engage our services, apply for employment, or interact with our website or platforms;
     • from our clients, where personal information is provided to us as part of a service engagement;
     • automatically through our websites and platforms using cookies, log files, and analytics tools (see clause 10);
     • from publicly available sources, including professional networking platforms and business registries; and
     • from third parties such as recruitment agencies, referees, and background check providers, where applicable.
   • Where it is reasonable and practicable to do so, we collect personal information directly from the individual concerned.
   • Where we collect personal information from a third party or a publicly available source, we take reasonable steps to notify the individual of the collection as soon as practicable, unless an exception under the APPs applies.
5. PURPOSES FOR COLLECTION, USE, AND DISCLOSURE
   • We collect, hold, use, and disclose personal information for the following primary purposes:
     • providing, managing, and improving our software development, integration, and consulting services;
     • communicating with clients, prospective clients, and other stakeholders about our services, proposals, and projects;
     • processing payments and managing billing and accounts;
     • recruiting, onboarding, and managing employees and contractors;
     • complying with our legal and regulatory obligations, including under the Privacy Act 1988 (Cth), the Corporations Act 2001 (Cth), and applicable tax laws;
     • managing and improving our information security posture in accordance with our ISO 27001 Information Security Management System (ISMS) and ISO 27701 Privacy Information Management System (PIMS);
     • responding to enquiries, complaints, and requests; and
     • conducting internal analytics, quality assurance, and business improvement activities.
   • We will not use or disclose personal information for a secondary purpose unless:
     • the individual has consented;
     • the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the use or disclosure; or
     • another exception under APP 6 applies.

6. DISCLOSURE OF PERSONAL INFORMATION
   • We may disclose personal information to:
     • our employees, contractors, and subcontractors who need access to perform their roles, subject to confidentiality obligations;
     • our clients, where personal information is processed on their behalf and disclosure is necessary to deliver contracted services;
     • third-party service providers engaged to support our operations, including cloud infrastructure providers, IT support, payment processors, and professional advisors;
     • regulatory and law enforcement bodies, where required or authorised by law; and
     • successors in the event of a business sale, merger, or restructure, subject to appropriate confidentiality protections.
   • We do not sell personal information to third parties.
   • We take reasonable steps to ensure that third parties to whom we disclose personal information handle it in accordance with the APPs.
7. OVERSEAS DISCLOSURE
   • Crennotech operates with offices in Australia (Queensland) and Hyderabad, India. We may transfer or disclose personal information to recipients located outside Australia, including in:
     • India — for software development and IT operations conducted through our Hyderabad office;
     • United States — where we use cloud infrastructure or SaaS platforms hosted in the US (including Microsoft Azure); and
     • Other countries — as required by the nature of a specific client engagement.
   • Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient does not breach the APPs in relation to that information, in accordance with APP 8.
   • Details of the safeguards applicable to specific overseas transfers are available on request.
8. DATA RETENTION
   • We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
   • Our standard retention periods are:
     • Client and project records: 3 years from the end of the relevant engagement, or as required by applicable law;
     • Employee and contractor records: 7 years from the end of employment or engagement, or as required by applicable law;
     • Recruitment records (unsuccessful applicants): 7 years from the date of the recruitment decision;
     • Website and platform logs: 3 years from the date of collection; and
     • Financial and tax records: 7 years from the end of the relevant financial year, as required by the Income Tax Assessment Act 1997 (Cth).
   • When personal information is no longer required, we take reasonable steps to destroy or de-identify it in accordance with APP 11.2.
9. SECURITY OF PERSONAL INFORMATION
   • We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure, in accordance with APP 11.
   • Our information security practices are governed by our Information Security Management System (ISMS), which is designed and maintained in accordance with ISO/IEC 27001, and our Privacy Information Management System (PIMS), designed in accordance with ISO/IEC 27701.
   • Our security measures include, but are not limited to:
     • encryption of personal information in transit (TLS 1.2 or higher) and at rest;
     • role-based access controls and the principle of least privilege;
     • multi-factor authentication for access to systems holding personal information;
     • regular vulnerability assessments, penetration testing, and security audits;
     • documented incident response and data breach notification procedures;
     • staff training on privacy and information security obligations; and
     • physical security controls at our premises.
   • We conduct regular risk assessments and privacy impact assessments (PIAs) for new projects or systems that involve the processing of personal information, consistent with our PIMS.
10. AUTOMATED DECISION-MAKING
    • Where we use computer programs or algorithms to make decisions using personal information that could reasonably be expected to significantly affect an individual’s rights or interests, we disclose this in accordance with APP 1.7–1.9 (operative from 10 December 2026).
    • Current automated decision-making activities:

As at the date of this Policy, Crennotech does not use automated decision-making processes that significantly affect individuals’ rights or interests.

• Where we do use automated decision-making that significantly affects individuals, we will:
  • disclose the types of personal information used and the kinds of decisions made;
  • provide individuals with the right to request human review of automated decisions, where required by law; and
  • implement appropriate safeguards to protect individuals’ rights and freedoms.

11. COOKIES AND TRACKING TECHNOLOGIES
    • Our websites and platforms may use cookies, web beacons, and similar tracking technologies to collect technical and usage data.
    • We use the following categories of cookies:
      • Strictly necessary cookies: required for the operation of our website and cannot be disabled;
      • Performance and analytics cookies: used to understand how visitors interact with our website (e.g. Google Analytics);
      • Functional cookies: used to remember preferences and settings; and
      • Marketing cookies: used to deliver relevant advertising, where applicable.
    • You can manage your cookie preferences through your browser settings.
    • For more information about the cookies we use, please see our Cookie Policy / Cookie Notice.
12. ACCESS AND CORRECTION
    • Individuals have the right to request access to personal information we hold about them, and to request correction of information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
    • To make an access or correction request, please contact our Privacy Officer using the details in clause 15.
    • We will respond to access and correction requests within a reasonable time, and in any event within 30 days of receiving the request.
    • We may charge a reasonable fee for providing access, where permitted by the APPs. We will not charge for making a correction request.
    • If we refuse an access or correction request, we will provide written reasons and information about how to complain.
13. NOTIFIABLE DATA BREACHES
    • We are subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).
    • If we have reasonable grounds to believe that an eligible data breach has occurred, we will:
      • conduct a prompt assessment of the suspected breach;
      • notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable, where required; and
      • take remedial action to contain and address the breach.
    • Our data breach response procedures are documented within our ISMS and PIMS in accordance with ISO/IEC 27001 and ISO/IEC 27701.
14. COMPLAINTS
    • If you believe we have breached the APPs or this Privacy Policy, you may lodge a complaint with our Privacy Officer using the details in clause 15.
    • We will acknowledge your complaint within 7 days and aim to resolve it within 28 days.
    • If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.
15. CONTACT — PRIVACY OFFICER
    • Our Privacy Officer is responsible for overseeing compliance with this Policy and handling privacy enquiries and complaints.

Privacy Officer

Crennotech Pty Ltd

Kiran Vilasagaram

Position: Director

POBox 918, North Lakes, 4509

Email: contact@crennotech.com

Phone: +61 2 8664 3962

16. CHANGES TO THIS POLICY
    • We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or business operations.
    • We will notify individuals of material changes by posting the updated Policy on our website and, where appropriate, by direct notification.
    • The date of the most recent update is shown at the top of this Policy.

This Privacy Policy was prepared in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the ISO/IEC 27001 and ISO/IEC 27701 frameworks.