Privacy Policy

1. About This Policy

Trificta Pty Ltd ("Trificta", "we", "us", or "our") is committed to protecting the privacy of individuals who interact with us. This Privacy Policy explains how we collect, hold, use, and disclose personal information.

Trificta is a small business operator under the Privacy Act 1988 (Cth), so the Act does not currently require us to follow the thirteen Australian Privacy Principles (APPs) in Schedule 1 of that Act. We follow them anyway, and this policy explains how. We also follow the approach of the Notifiable Data Breaches scheme in Part IIIC of the Act, as section 6 describes.

Where we provide services to clients in the European Union, we also take reasonable steps to meet the requirements of the EU General Data Protection Regulation (GDPR) in respect of the personal data we handle on their behalf.

By using our website or engaging our services, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our website or services.

2. What Personal Information We Collect

We may collect the following types of personal information:

Contact and identity information

• Name (first and last)
• Email address
• Phone number
• Company name and job title
• Postal or business address

Technical and usage information

• IP address and browser type
• Pages visited and time spent on our website
• Referring website or search terms
• Device type and operating system

Business and service information

• Information provided in enquiries, contact forms, or support requests
• Details relevant to the delivery of our ICT services
• Communication records (email, phone notes)

Sensitive information

Apart from Onsitr (see below), we do not deliberately collect "sensitive information" as defined in section 6 of the Privacy Act (which includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and similar categories). In the rare event a client engagement requires us to handle such information, we will only do so with the individual's express consent and with additional safeguards appropriate to the category under APP 3.3.

Onsitr can hold sensitive information for the schools that use it, such as injury details in incident reports and whether a contractor has a Blue Card negative notice. The school decides what is collected and on what basis, and we handle it only to provide Onsitr to the school, under our agreement with it.

3. How We Collect Personal Information

We collect personal information in a number of ways, including:

• When you complete the contact form on our website
• When you email or call us directly
• When you engage us to provide services
• When you register for a Cofferdam licence, including the free Community edition
• When you apply for a position at Trificta
• Through website analytics tools (see section 8)
• From publicly available sources (e.g. LinkedIn, company websites)

We will only collect personal information by lawful and fair means. Where practicable, we collect personal information directly from the individual concerned.

4. Why We Collect and Use Personal Information

We collect and use personal information for the following purposes:

• To respond to enquiries and provide requested information
• To deliver and manage our ICT services to clients
• To issue and manage software licences, and to send the licence and security notices that go with them
• To communicate about projects, service updates, and support
• To process job applications and manage recruitment
• To comply with legal obligations
• To improve our website and service offerings
• To send relevant business communications (with your consent where required)

We will not use or disclose your personal information for purposes other than those described above without your consent, unless required or authorised by law.

5. Disclosure of Personal Information

We may disclose your personal information to:

• Our employees and contractors who need it to perform their duties
• Technology partners and subcontractors involved in delivering our services
• Professional advisers (legal, financial, accounting)
• Government or regulatory authorities where required by law

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

Data residency and overseas disclosure (APP 8)

The third-party platforms we rely on to host this website and run our business, and the regions where personal information you provide to us may be processed or stored, are:

• Australia: Microsoft Azure (Australia East & Australia Southeast) for our website infrastructure, client workloads, and our internal business systems; and servers we operate ourselves in Brisbane for the Cofferdam licence service.
• United States: cloud-based productivity and collaboration platforms, where a Trificta client's tenant is hosted in US regions.

Static content for this website is delivered via Azure's global content delivery network; edge servers worldwide cache pre-rendered files which contain no personal information.

Onsitr SaaS platform

Onsitr is Trificta's contractor management platform for Australian schools. Production customer instances are hosted in the Amazon Web Services (AWS) Sydney (Asia Pacific) region by default. All personal information captured by Onsitr (contractor onboarding records, on-site check-in events, permits-to-work, incident reports, and the associated audit logs) remains within Australia under this default deployment.

On written request as part of customer onboarding, an Onsitr instance can be provisioned in a different AWS region (for example the European Union, the United States, or another Asia-Pacific region) to meet a customer's data-residency requirements. The chosen region is recorded in the customer's service agreement and applies for the life of that engagement.

Cofferdam

Cofferdam is distributed as a self-hosted application. Customer data (racks, cables, IP assignments, environmental telemetry, audit logs) stays on the customer's own infrastructure, and Trificta does not host, process, or have access to data captured by self-hosted deployments, apart from the licence check-in described next.

A paid Cofferdam install that has a licence key stored contacts Trificta's licence service, hourly unless its update interval is set otherwise. It sends the licence key, an identifier for the install, the version it is running, whether it is a production or non-production instance and the number of sites it monitors, and we record the time and the IP address the request came from. The same details are sent when a paid install checks for an update or downloads one. We use them to confirm the licence is valid, to offer the right updates and to support the install, and we keep a summary for each install (customer, install identifier, version, when it was first and last seen, and site counts) in our support system. A Community install does not check in. When it checks for updates it sends only its licence key and the version it is running, and we record which licence asked, the version and the time, with no IP address and no install identifier. These records are held on servers Trificta operates itself in Brisbane, Australia. An install with no licence key stored sends nothing, an air-gapped licence switches the check-in off, and update checks can be switched off in the product.

On request, Cofferdam can also be provisioned as a managed SaaS service hosted by Trificta. Each managed customer receives a dedicated, single-tenant instance in the cloud region that best meets their data-residency requirements. Trificta does not operate shared-tenancy Cofferdam environments; every customer's data is isolated to its own instance and its own region of choice.

Registering for a Cofferdam licence, including the free Community edition, gives us your name, work email address, company, job title, phone number and country, what you plan to use Cofferdam for and, if you choose to say, the size of your environment. Registration happens in our client portal. Once you have confirmed your email address you choose a password, which we store only as a salted hash. Your network address is used briefly to limit how many registrations one visitor can make and is not stored. We use these details to issue your licence key and to send licence and security notices for the software you registered. We send product news only if you asked for it, by ticking the box when you registered or by switching it on in your client portal account. Every issue carries your own unsubscribe link, which needs no sign-in, and you can also switch product news off in your account or by emailing support@trificta.com.au. Product news is sent by our own support system from that address: no mailing service is involved, and the emails are plain text with no tracking of opens or clicks. Licence and security notices continue for as long as you hold a licence. Registrations are held in our support system, on servers Trificta operates itself in Brisbane. A registration that is never verified is deleted after 7 days. A verified account is kept for as long as it is open, because it is how you receive updates, and a Community licence does not expire. When an account is closed or its licence ends, your details are kept for 24 months and then removed. The verification and licence emails come from support@trificta.com.au, and a reply to one opens a support ticket.

Where we disclose personal information to an overseas recipient we take reasonable steps to ensure they handle it in accordance with the Australian Privacy Principles or a substantially similar regime.

6. Data Security and Data Breaches

We take reasonable steps under APP 11 to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

• TLS 1.2+ encryption in transit for all website traffic and client integrations
• Encryption at rest for systems that store personal information
• Role-based access controls, multi-factor authentication, and least-privilege service accounts
• Regular patching, vulnerability scanning, and staff security awareness training
• Logging and monitoring of access to systems containing personal information
• Secure destruction or de-identification of information that is no longer required

If Trificta becomes aware of a data breach that is likely to result in serious harm to an affected individual, and we are unable to remediate the breach before that harm occurs, we will follow the approach of the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, although the scheme does not currently apply to us. We will notify each affected individual as soon as practicable, describing the breach, the kinds of information involved and the steps we recommend they take, and we will also notify the Office of the Australian Information Commissioner (OAIC).

No method of transmission over the internet is completely secure. While we apply the safeguards above, we cannot guarantee absolute security of information transmitted to us online.

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Typical retention periods are:

• Website enquiries and contact-form submissions: 24 months from last contact, then deleted unless converted into an active client engagement.
• Client business records (contracts, invoices, project documentation): 7 years from end of engagement, to meet Corporations Act and ATO record-keeping obligations.
• Unsuccessful job applications: 12 months from the date of application, then deleted (we may ask for consent to keep your details on file for longer).
• Employee records: for the duration of employment and 7 years afterwards, as required by the Fair Work Act and related regulations.
• Cofferdam licence check-in history (each check-in, update check and download, with any IP address recorded): deleted after 12 months. Licence records and the summary we keep for each install are client business records.
• Website analytics and security logs: deleted after 90 days. Analytics records no IP addresses; the security logs for our contact form can record a sender's IP address when our rate limiting is triggered.

When personal information is no longer needed for any purpose permitted by APP 11.2, we take reasonable steps to destroy or de-identify it.

8. Cookies and Website Analytics

Our website sets no cookies. Its use of browser storage, grouped by purpose:

• Strictly necessary: none. The contact form submits via plain HTTPS POST to our own backend (Azure Static Web Apps Function) and does not require a session cookie.
• Preferences: none. The site reads your device's reduced-motion setting directly and stores nothing.
• Analytics: we measure page performance and aggregate usage with Azure Application Insights, running under our own Azure subscription and configured cookie-free. It sets no cookies and keeps nothing in your browser between visits: while a page is open it uses temporary session storage to queue measurements before sending them, and that storage clears when you close the tab. Client IP addresses are discarded at ingestion. We see aggregate patterns (pages viewed, how long a page was in view, how far it was scrolled, load times, script errors, and counts of contact forms sent and of clicks through to Cofferdam registration, neither holding anything you entered), not a profile of you, and nothing is shared with advertisers or data brokers.

The website does not use cookies, and blocking browser storage does not affect how it works.

8A. Direct Marketing (APP 7)

We do not send unsolicited marketing messages. If, in the course of a business engagement, we send you service updates or information relevant to your account, you can unsubscribe at any time by replying to that message or emailing privacy@trificta.com.au. We will action opt-outs within five business days, consistent with the Spam Act 2003 (Cth).

9. Accessing and Correcting Your Personal Information

You have the right to request access to the personal information Trificta holds about you, and to request that we correct any inaccurate, out-of-date, or incomplete information. To make such a request, please contact us using the details in section 11.

We will respond to access requests within a reasonable timeframe. In some circumstances we may be unable to provide access (for example, where it would unreasonably impact the privacy of another individual), and we will advise you of the reasons.

10. Complaints

If you believe Trificta has handled your personal information in a way that breaches the Australian Privacy Principles, please contact us using the details below. We will acknowledge your complaint within 7 days and provide a substantive response within 30 days.

Because the Privacy Act does not currently apply to us, the Office of the Australian Information Commissioner (OAIC) may not be able to deal with a complaint about us, so please raise any concern with us first. If you are not satisfied with our response, you can still contact the OAIC for advice:

• Online: www.oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

11. Contact Us

For any privacy-related questions, requests, or complaints, please contact us:

• Email: privacy@trificta.com.au
• Phone: 07 2146 9409
• Post: Trificta Pty Ltd, Queensland, Australia

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The current version will always be available at trificta.com.au/privacy. We encourage you to review this policy periodically.