Legal

Privacy Policy

Last updated: 23 September 2026

Agentum Pty Ltd (ACN 691 386 713, ABN 13 691 386 713) (Agentum, we, us, our) is an Australian AI consultancy based in Sydney, New South Wales. This Privacy Policy explains how we collect, hold, use and disclose personal information, how you can access or correct it, and how to contact us or make a complaint. We handle personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs).

1. Information we collect

We collect personal information that is reasonably necessary for our business activities. Depending on how you deal with us, this may include:

  • Identity and contact details: name, job title, organisation, email address and phone number of clients, prospective clients, suppliers, partners and event contacts.
  • Enquiry and booking information: details you submit through the form on our website, including your organisation, the service you are interested in and your message.
  • Diagnostic and tool information: information you enter into any interactive tools we offer, such as business type, team size and descriptions of manual work.
  • Engagement information: correspondence, session and meeting notes, workshop outputs, and information you or your organisation provide during an engagement.
  • Website and technical information: IP address, device and browser type and similar information your browser sends when you visit our website.
  • Billing information: details needed to invoice you and receive payment. We do not store full payment card details.
  • Recruitment information: if you apply to work with us.

Sensitive information. We do not seek to collect sensitive information, such as health information. If sensitive information is provided to us, or is held in client systems we access during an engagement, we handle it only with consent or as otherwise permitted by law, and only to the extent the engagement requires.

Anonymity. You can make a general enquiry without identifying yourself or by using a pseudonym. We will generally need your name and contact details to provide our services.

2. How we collect personal information

We collect personal information directly from you where reasonably practicable: when you contact us, complete a form, use a tool on our website, attend a session or event, or engage us. We may also collect it from your organisation (for example, when it nominates people to attend a session), from publicly available sources such as your organisation's website or professional networking profiles, and from our service providers. If we receive personal information we did not ask for, we deal with it as the APPs require.

3. How we use personal information

We use personal information to:

  • provide, administer and improve our services, including preparing proposals, reports and other deliverables;
  • respond to enquiries and arrange sessions and meetings;
  • manage our relationships with clients, suppliers and partners;
  • arrange and manage software licences you purchase through us;
  • issue invoices and keep business records;
  • send you information about our services, which you can opt out of at any time, in line with the Spam Act 2003 (Cth);
  • operate, secure and improve our website;
  • comply with our legal obligations; and
  • manage recruitment.

We use personal information only for the purpose for which it was collected, or a related purpose you would reasonably expect, unless you consent or the law permits otherwise.

4. Personal information in client engagements

Client systems. In delivering consulting and implementation services, we may access personal information held in a client's own systems, such as contact records in accounting, practice management or productivity software. When we do, we act on the client's instructions, access only what the engagement requires using scoped, least-privilege and logged access, and do not copy that information into our own systems unless the engagement requires it.

Engagement records. We keep our own records of each engagement, such as session notes, workload inventories, scoring workbooks, reports and proposals. These are held in our systems and handled under this policy and the engagement terms.

Sessions and workshops. Where we facilitate sessions with a client's staff, we record ideas, findings and current use of tools, including the use of unapproved AI tools, against roles or teams rather than named individuals wherever practicable.

Managed services. Where a client engages us to operate a solution on its behalf, we may hold client data in systems we manage. The data involved, where it is stored and how it is protected are set out in the engagement documents.

Each client remains responsible for its own privacy obligations to its customers and staff. Our engagement terms set out how we support those obligations.

5. Artificial intelligence services

We use AI services from established enterprise providers in delivering our work and running our business. Where personal information is processed through these services:

  • we use business or commercial service terms under which the provider does not use our inputs or outputs to train models made available to others;
  • we use Australian data centres where the service offers them and the engagement requires it, and where processing occurs outside Australia, section 8 applies; and
  • AI-generated output is reviewed by a person before it is relied on or sent outside our business.

Where practicable, client work is carried out in the client's own AI accounts and systems, under the client's settings. The configuration for each engagement, including where data is stored and processed, is recorded in the engagement documents.

6. Automated decision-making

We do not use computer programs to make decisions about individuals that could reasonably be expected to significantly affect their rights or interests, and we do not use them to do things substantially and directly related to making such decisions.

Enquiries sent through our website are delivered to a person, who reads and responds to them. No enquiry is accepted or declined by a computer program. Any diagnostic or estimating tools we offer produce indicative information about an organisation's workloads and possible time savings, and do not make decisions about individuals.

If this changes, we will update this policy to describe the kinds of personal information used and the kinds of decisions involved, as the APPs require.

7. Disclosure

We may disclose personal information to:

  • service providers that support our business, such as cloud hosting, productivity, email, AI, website, booking, accounting and payment providers, under confidentiality and data protection obligations;
  • our professional advisers, insurers and auditors;
  • software vendors and their authorised distributors, where you purchase software licences through us, so the licences can be provisioned and managed;
  • subcontractors engaged on a client engagement, with the client's agreement;
  • anyone we are required or authorised by law to disclose it to, including regulators and law enforcement; and
  • other parties, with your consent.

We do not sell personal information, and we do not disclose it to others for their own direct marketing.

8. Data location and overseas disclosure

Where practicable and where the service allows, we store personal information in Australian data centres. Some of our service providers store or process information outside Australia, or may access it from outside Australia for support and security purposes. The countries where this is likely to occur include the United States. For example, messages sent through our website form are processed by our website hosting provider and delivered to us by an email delivery service, either of which may process them outside Australia. Some AI services also process inputs overseas even where the related files are stored in Australia.

Where a client engagement requires Australian data residency, we configure services to use Australian data centres where they are available, and we tell the client in writing about any processing that still occurs outside Australia.

Before disclosing personal information overseas, we take reasonable steps, including through contract terms, to ensure the recipient handles it consistently with the APPs.

9. Security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include encryption in transit and at rest where supported, multi-factor authentication, least-privilege access, encrypted credential storage, audit logging, separation of client engagement records from other business systems, and confidentiality obligations on anyone who works with us. No system is completely secure, and we review our controls as our business and the risks change.

10. Retention

We keep personal information only for as long as we need it for the purposes in this policy, or as long as the law requires, for example for tax and financial records. Engagement records are kept in line with the engagement terms. When we no longer need personal information, we take reasonable steps to destroy or de-identify it.

11. Data breaches

We maintain a data breach response process. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme. Where a breach affects a client's data, we will also notify the client as set out in the engagement terms.

12. Access and correction

You may ask to access, or correct, the personal information we hold about you by contacting us using the details below. We may need to verify your identity. We will respond within 30 days. We do not charge for making a request. If we refuse a request, we will tell you why in writing and how you can complain.

13. Complaints

If you have a concern about how we have handled your personal information, please contact us first. We will investigate and respond within 30 days. If you are not satisfied with our response, you can complain to the OAIC at www.oaic.gov.au or on 1300 363 992.

14. Cookies and website technologies

We do not currently use analytics, advertising or tracking cookies on our website. Our website loads fonts, icons and page scripts from third-party content delivery networks, which receive your IP address and browser information when your browser requests them. Our website hosting provider may set strictly necessary cookies to protect the site from abuse. You can control cookies through your browser settings. If we introduce analytics, we will update this section first.

Our website may link to third-party sites, such as professional networking platforms, whose privacy practices we do not control.

15. Contact us

Privacy enquiries: info@agentum.com.au

Agentum Pty Ltd, Sydney, New South Wales

ACN 691 386 713 · ABN 13 691 386 713

16. Changes to this policy

We may update this policy from time to time. The current version is always available at agentum.com.au/privacy/, and the date at the top shows when it was last changed.