Last updated: 12 September 2026

1. Who we are

Cloddy Pty Ltd (ABN 42 640 359 235, ACN 640 359 235) supplies services under the trading names Cloddy and Good Cause Tech. Good Cause Tech is not a separate legal entity. In this policy, Cloddy, Good Cause Tech, we, us and our all mean Cloddy Pty Ltd.

This policy applies to personal information handled through:

the Cloddy and Good Cause Tech websites
enquiries, proposals, orders, customer relationships and account administration
managed IT, helpdesk, cybersecurity, cloud, telecommunications, consulting, project and training services
interactions with suppliers, contractors, business contacts and prospective employees.

2. Our privacy commitment and applicable law

We are committed to handling personal information openly and responsibly and in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Notifiable Data Breaches scheme and other privacy, telecommunications, surveillance, health-records or sector-specific laws to the extent they apply.

We commit to handling personal information consistently with this policy, applicable law and any specific contractual privacy or data-processing obligations we accept in writing. Our Terms and Conditions are the principal commercial terms governing services supplied by Cloddy and Good Cause Tech and incorporate this policy for personal-information handling. This policy therefore forms part of the service agreement to the extent stated in those terms, subject to the agreement's document-priority provisions.

Nothing in this policy excludes, restricts or modifies a right or obligation that cannot lawfully be excluded, restricted or modified. This policy describes our practices; it is not a guarantee that a security incident can never occur and does not expand liability beyond applicable law or an agreed contract.

3. When we act for a customer organisation

Managed technology services may give us administrative or incidental access to personal information held by a customer, including information about the customer's employees, clients, patients, participants, donors, members or suppliers. For that information:

the customer ordinarily decides why the information is collected and how it is used
the customer remains responsible for its privacy notices, collection authority, consents, data quality, retention decisions and lawful instructions
we handle the information to provide the contracted services, follow lawful authorised instructions, protect the environment, meet legal obligations and exercise contractual rights
access does not transfer ownership of the customer's information to us.

An individual seeking access to or correction of information controlled by one of our customers should ordinarily contact that customer first. We will provide reasonable assistance as required by law and the applicable customer agreement.

4. Meaning of personal and sensitive information

Personal information is information or an opinion about an identified individual or an individual who is reasonably identifiable, whether the information is true or recorded in a material form.

Sensitive information includes health and genetic information, biometric information used for identification, racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, trade-union membership and criminal records. Sensitive information generally receives a higher level of protection.

5. Personal information we may collect

Depending on the relationship and service, we may collect or hold:

identity and contact details — name, role, employer, business and postal address, email address, telephone number and authorised-contact status
enquiry and relationship details — organisation type, sector, team size, locations, requested services, preferred timing, proposals, meeting notes and communications
account and commercial records — orders, contracts, licence assignments, billing contacts, transaction records, payment status, credit information and limited payment details
support and service records — support tickets, emails, chat transcripts, call details, authorised instructions, device and user identifiers, configuration information, asset records, audit trails, session metadata and troubleshooting material
technical and security information — IP address, login and authentication events, system alerts, device health, installed software, patch status, network information, malware or security events and backup status
website and analytics information — browser and device type, approximate location derived from IP address, referring page, pages viewed, session events, cookie identifiers and form-submission metadata
telecommunications information — service address, contact details, telephone numbers, service identifiers, usage and fault information where required to arrange or manage a service
feedback and complaint information — survey responses, service feedback, complaint details and investigation records
recruitment and personnel information — employment history, qualifications, references and other information supplied in connection with work or contracting opportunities
any other information an individual, customer or authorised third party provides that is reasonably necessary for our functions or activities.

6. Sensitive information and information you should not send through the website

We collect sensitive information only where it is reasonably necessary for our functions or activities and the individual has consented, or where collection is otherwise permitted or required by law. During managed IT work, we may incidentally encounter sensitive information held within a customer's systems. We limit access to what is reasonably necessary for the authorised task and applicable security, legal or contractual requirements.

Do not submit passwords, multi-factor authentication codes, private keys, payment-card details, tax file numbers, identity documents, health records, participant or patient records, or other highly sensitive information through a public website form or live chat. Contact us so that an appropriate secure method can be arranged. If unsolicited sensitive information is received, we will assess whether we are permitted to retain it and may securely destroy or de-identify it where lawful and reasonable.

7. How we collect personal information

We may collect personal information:

directly from an individual through a form, email, telephone call, meeting, live chat, support request, portal or service interaction
from a customer organisation, employer, authorised representative, referrer or another person acting with authority
through service-delivery tools, remote monitoring, endpoint management, security products, cloud platforms, backup systems, ticketing systems and telecommunications providers
from distributors, vendors and service providers where necessary to quote, provision, support, secure, bill or renew a product or service
from publicly available professional or business sources where collection is lawful and reasonably expected
automatically when a website or online service is used.

We will generally collect personal information directly from the individual where it is reasonable and practicable to do so.

8. Anonymity and pseudonyms

You may browse our public websites without identifying yourself. Where lawful and practicable, you may make a general enquiry anonymously or using a pseudonym.

We may need accurate identity and contact information to provide a quote or service, verify authority, give system access, investigate an incident, manage an account, comply with law or protect a customer and its systems.

9. Why we collect, use and disclose personal information

We may handle personal information to:

respond to enquiries and arrange meetings or discovery calls
assess requirements, prepare proposals, enter into and administer agreements
supply, configure, monitor, secure, support, maintain and improve technology services
verify identity, authority, access rights and instructions
manage users, licences, devices, telecommunications, domains, cloud platforms and vendors
investigate and respond to faults, cyber incidents, misuse, complaints and disputes
communicate service notices, outages, renewals, security information, invoices and account updates
process payments, recover debts, keep business and taxation records and manage insurance
maintain service quality, capacity, business continuity, internal administration and training
conduct analytics, understand website use and improve content and user experience
recruit personnel and manage supplier, contractor and professional relationships
send direct marketing where permitted and manage marketing preferences
prevent fraud, enforce agreements, protect legal rights and comply with law, court orders and regulator requirements
support a proposed or completed business restructure, financing, merger, acquisition or asset transfer under appropriate confidentiality controls
perform another purpose disclosed at collection, authorised by the individual or required or permitted by law.

We may use de-identified or aggregated information for analytics, reporting, security research, service improvement and business planning where individuals are not reasonably identifiable.

10. Administrative and remote access

Our services may require privileged, remote or on-site access to customer systems. We use that access only for authorised service delivery, security, maintenance, investigation, legal compliance and related purposes permitted by the customer agreement.

Remote-management, support and security agents installed on in-scope systems may automatically collect device, user, software, performance, alert and activity information. Depending on the agreed service and configuration, authorised technicians may establish interactive or unattended remote sessions. Those sessions may generate timestamps, technician actions, connection details, system logs or recordings. If a call or support session is to be recorded, we will provide notice where required by applicable law.

Customers are responsible for ensuring that their personnel and other affected individuals receive any notices and provide any permissions required for Cloddy to access, monitor or process information through the agreed services.

11. Who we may disclose personal information to

Where reasonably necessary for the purposes in this policy, we may disclose personal information to:

our employees, officers and contractors who require access for their duties
the relevant customer organisation and its authorised representatives
hosting, cloud, email, collaboration, remote-management, cybersecurity, backup, ticketing, analytics, live-chat and form-processing providers
software vendors, distributors, equipment suppliers, payment providers, accountants, insurers, auditors, lawyers and other professional advisers
telecommunications carriers, wholesalers and service providers
regulators, law-enforcement bodies, courts, tribunals and government agencies where required or permitted by law
a proposed purchaser, financier, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and due-diligence controls
another party with the individual's consent or at their direction.

We do not sell or rent personal information to data brokers as part of our ordinary business activities.

12. Key website and technology providers

Our providers may change as our services evolve. Providers currently relevant to our websites or managed services include:

Formspree for processing website form submissions
Google for Google Analytics and related website measurement
tawk.to for website live chat and associated visitor and conversation information
Microsoft for email, cloud, identity, collaboration and customer technology services
Atera for remote monitoring, management, support and service-desk functions
telecommunications, connectivity, cloud, security, backup, payment and accounting providers selected for the relevant service.

These providers may collect information directly through their technology and handle it under their own terms and privacy documentation. We take reasonable steps when selecting and managing providers, but we do not control the independent privacy practices of a provider acting outside our instructions.

13. Overseas storage and disclosure

Some providers, their related entities and subprocessors operate or store information outside Australia. Depending on the selected service, likely locations may include the United States, United Kingdom, European Economic Area, Israel, Singapore and other countries in which a provider or its subprocessors operate. Hosting and support locations can change over time.

Where required, we take reasonable steps before an overseas disclosure to assess the recipient, apply appropriate contractual or technical protections and require information to be handled consistently with applicable privacy obligations. Overseas recipients may be subject to different laws, and foreign governments or authorities may have lawful access rights in their jurisdiction.

Contact us before ordering a service if Australian-only data residency is required. Australian-only residency must be expressly agreed in writing and may not be available for every product, support function, telemetry stream or supplier.

14. Websites, cookies, analytics and live chat

Our websites use cookies, pixels, scripts and similar technologies. These may collect IP address, browser and device information, approximate location, referral source, pages viewed, interactions, session timing and identifiers.

In particular:

Google Analytics helps us understand website traffic and use
tawk.to enables live chat and may collect visitor, device, session and conversation information
Formspree processes information submitted through our enquiry forms
essential technologies help deliver, secure and operate the websites.

Browser settings can block or delete cookies, although doing so may reduce functionality. You can also use Google's Analytics opt-out browser add-on. If you do not want a live-chat provider to process a conversation, contact us by telephone or email instead. Browser privacy controls do not necessarily prevent server logs or information required to operate and secure a service.

15. Direct marketing

We may send relevant information about our services where the recipient has consented or where applicable law otherwise permits it and the communication would reasonably be expected. We will identify the sender, include required contact information and provide a simple way to opt out of electronic marketing.

You may opt out at any time by using the unsubscribe facility or contacting us. We will action electronic-marketing unsubscribe requests within five business days or any shorter period required by law. Opting out of marketing does not prevent operational, security, billing, legal or other non-promotional service communications.

We do not use sensitive information for direct marketing without consent where consent is required by law. On request, and where required, we will take reasonable steps to identify the source of personal information used for direct marketing.

16. Data quality

We take reasonable steps to ensure personal information we collect, use or disclose is accurate, current, complete and relevant for its purpose. Customers and individuals should promptly tell us when contact, authority, billing or other material details change.

17. Security

We take reasonable technical, organisational and physical steps appropriate to the nature of the information and the risks to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include:

role-based access controls and least-privilege practices
multi-factor authentication and credential controls where appropriate
encryption in transit and, where supported and appropriate, at rest
endpoint, email, network and security monitoring
logging, backup, patching and vulnerability-management processes
personnel confidentiality obligations, awareness and access review
supplier assessment, contractual safeguards and incident-response procedures
secure disposal or de-identification practices.

No internet transmission, cloud platform, security product or storage system is completely secure. Customers and users must protect their own credentials and devices, use agreed security controls and promptly report suspected compromise. We do not ask for passwords or authentication codes through unsolicited email or website chat.

18. Data incidents and notification

If we become aware of a suspected data incident, we will take reasonable steps to contain it, assess the circumstances, reduce harm, preserve necessary evidence and remediate identified weaknesses.

Where the Notifiable Data Breaches scheme or another law applies, we will assess whether the incident is likely to result in serious harm and notify affected individuals, the Office of the Australian Information Commissioner (OAIC) or another regulator when legally required. Not every security incident is legally notifiable.

Where an incident concerns information we handle for a customer, we will notify and assist that customer in accordance with applicable law and the customer agreement. The parties will reasonably coordinate notifications so information is accurate and affected individuals receive clear guidance.

19. Retention, destruction and de-identification

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or a permitted related purpose, including service delivery, security, audit, continuity, insurance, taxation, dispute resolution and legal compliance.

Retention depends on the record and context. For example:

accounting, transaction and contract records may generally be retained for at least seven years or a longer period required by law
customer, support, configuration, security and audit records may be retained for the service term and a reasonable period afterwards to support continuity, investigation, warranty, insurance and legal needs
enquiry and prospective-customer records are periodically reviewed and may be retained while a genuine business relationship or follow-up purpose continues
unsuccessful recruitment records may be retained for a reasonable period for future opportunities, legal obligations and claims
provider-held logs, analytics and submissions are retained according to our settings, contract and the provider's applicable retention processes
deleted information may remain in protected backups until the relevant backup cycle expires.

When personal information is no longer required and no law, dispute, security hold or legitimate business need requires retention, we take reasonable steps to destroy it securely or de-identify it. We may retain de-identified information where individuals are not reasonably identifiable.

20. Access to and correction of personal information

You may request access to personal information we hold about you or ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

We may need to verify identity and authority before acting. Access may be refused or limited where an exception under applicable law applies, including where access would unreasonably affect another person's privacy, reveal commercially sensitive evaluative information, prejudice legal proceedings or security, or be unlawful. If we refuse a request, we will generally give written reasons and available complaint options where required.

There is no charge to make an access or correction request. Where permitted by law, we may charge reasonable costs of providing access after advising the requester. We aim to respond within 30 calendar days. If additional time is reasonably required, we will explain the delay and expected timeframe.

For customer-controlled information, we may refer the request to the relevant customer and assist them as required by law or contract.

21. Privacy complaints

Send a privacy complaint to the contact details in section 28 and include enough information for us to understand the concern. We will:

acknowledge the complaint, ordinarily within seven business days
investigate it through an appropriately independent person where practicable
request further information where reasonably necessary
aim to provide a written outcome within 30 calendar days, or explain why more time is required.

We ask that you give us a reasonable opportunity to resolve the complaint. If you are not satisfied, you may be able to complain to the Office of the Australian Information Commissioner or another applicable regulator.

22. Children and vulnerable individuals

Our public websites and sales processes are directed to organisations and adult representatives, not children. Do not submit a child's personal information through a public form or live chat unless you have lawful authority and it is reasonably necessary.

Through services supplied to care, health, disability, community or education organisations, we may handle information about children or vulnerable individuals on behalf of a customer. The customer is responsible for the lawful collection and instructions, and we apply controls appropriate to the information, contracted service and risk.

23. Government-related identifiers

We do not adopt a government-related identifier, such as a tax file number, Medicare number or driver's licence number, as our own customer identifier. We collect, use or disclose government-related identifiers only where reasonably necessary and permitted or required by law. Do not send these identifiers through a public website form or live chat.

24. Automated processing and artificial intelligence

We may use automation to route support tickets, identify device or security events, produce alerts, assist technicians, analyse service information and improve operations. Staff remain responsible for material service and relationship decisions.

As at the last-updated date, we do not arrange for a computer program to use personal information to make decisions that could reasonably be expected to significantly affect an individual's rights or interests without meaningful human involvement. If this changes, we will review our notices and this policy before the practice begins or as required by law.

Customer-authorised cloud, security or productivity services may include artificial-intelligence features governed by the relevant order, configuration and provider terms. Customers must not enable such features for personal information unless they have assessed the purpose, authority, security and notice requirements.

25. Business transfers and legal claims

Personal information may be disclosed under confidentiality controls for genuine due diligence, financing, restructuring, merger, acquisition, sale of assets or transfer of services. A recipient may continue handling transferred information for purposes consistent with this policy, applicable law and any notice given at the time.

We may retain, use or disclose information where reasonably necessary to establish, exercise or defend legal or equitable claims, enforce an agreement, recover a debt, respond to compulsory legal process or protect the rights, safety and security of Cloddy, a customer, an individual or the public.

26. Third-party websites and customer systems

Our websites may link to third-party websites, platforms or services. Their privacy practices are governed by their own policies, and we are not responsible for an independent third party's handling of information outside our control.

Customers control the content, permissions and privacy practices of their own systems. Cloddy is not responsible for a customer's independent collection, use or disclosure of personal information, but remains responsible for Cloddy's own conduct to the extent required by law and the customer agreement.

27. Changes to this policy

We may update this policy when our services, providers, legal obligations or information-handling practices change. The current version will be published on this page with its last-updated date.

For a material change that significantly affects how existing personal information is handled, we will provide additional notice or seek consent where required by law or reasonably appropriate. An earlier version continues to apply to conduct occurring before a change to the extent required by law.

28. Contact us

For privacy questions, access or correction requests, complaints, requests for this policy in another accessible form, or suspected privacy incidents, contact:

Privacy Officer — Cloddy Pty Ltd

Trading as Cloddy and Good Cause Tech

Email: [email protected]
Phone: 1300 199 084
Address: Level 1, 457–459 Elizabeth Street, Surry Hills NSW 2010

Please do not include passwords, authentication codes or unnecessary sensitive information in an initial privacy enquiry.

Privacy Policy