Privacy policy — Stanfield IT Tools
Draft. This document is written in plain English against the Australian Privacy Principles and is awaiting legal review — a go-live gate before any public launch (09 §6).
The short version
You can complete an assessment without telling us who you are. Answers are encrypted, stored in Australia, and anonymous assessments are deleted after 90 days. We only ask for your email if you want the PDF report, and we only use it for what you asked for — anything more needs your explicit, unticked-by-default consent.
What we collect, and why
- Assessment answers — to produce your results and report. Encrypted at the field level before they reach our database. Never sold, never disclosed individually, never used for marketing.
- Optional context (industry, headcount, IT model, state) — to personalise your report. Every field is skippable.
- Contact details (email required; name, company, phone optional) — only collected at the report gate, to deliver your PDF and, if our team can help, to follow up on that request.
- Consented research data — if (and only if) you tick the benchmarking box, an anonymised summary of your results (no name, no email, no free text) joins our aggregate statistics. These are only ever reported in groups of 10 or more businesses.
Where your data lives
In Australia. Local development and production hosting both keep data onshore (production: Microsoft Azure, Australia East region, Sydney). No overseas disclosure — by design (APP 8).
How long we keep it
- Anonymous assessments, answers and results: deleted 90 days after they start.
- Report PDFs: deleted after 30 days (we regenerate on request).
- Lead details: kept as a normal business record, reviewed annually, deleted on request.
- Anonymised aggregate statistics: kept indefinitely (they contain no identifiers).
Your rights (APP 12 & 13)
Email privacy@stanfieldit.com to access or correct your data, or to have it deleted. We verify the request and respond within 30 days.
Security
Answers are encrypted with AES-256-GCM before storage; resume links are unguessable 128-bit tokens stored only as hashes; every input is validated; logging strips personal information at write time; the tool runs no third-party analytics or trackers — at all.
Contact
Privacy queries: privacy@stanfieldit.com. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).