Privacy policy

Who we are

Ferres Systems (ABN 98 663 151 710) is a managed security and cyber services business based in Melbourne, Victoria, working with clients across Australia. This policy covers this website and the enquiries that come through it. Work we do under a signed engagement is also governed by that engagement's written scope, which takes precedence where it is more specific.

For anything in this policy, email hello@ferressystems.com.au.

What we collect, and when

Personal information reaches us from this site in the ways listed here. Each one only collects what you choose to type in and send.

Every form also carries a hidden field that real people never see or fill in. It exists to catch automated spam, and if it is filled in the submission is discarded. It collects nothing about you.

Some small records are also created as a side effect of using the site:

• Your IP address in our notification emails. When a message arrives from the contact form, the footer form, a job application, a resource request, a business card page or the Exposure Check, the email our team receives also shows the internet address it was sent from. We use it to spot abuse and spam.
• Rate-limit records. Resource requests, the Exposure Check and pricing estimate emails keep a count of recent requests on our web server, so that nobody can use them to flood an inbox or run up requests. Each count is filed under a one-way hash of your IP address (and, for resource requests, your email address, or for the Exposure Check, the domain) rather than the address itself, alongside the times of recent requests.
• Estimate records. When a pricing estimate is emailed, it gets a reference such as FS-7K2M9Q. A record of that estimate is kept on our web server: the reference, the plan, team size, add-ons and prices, whether you asked for a copy or a call, and when. It does not contain your name, email address or anything else about you. It lets us look the estimate up when you quote the reference.
• Server logs. Our hosting provider keeps standard web server logs, which include IP addresses and the pages requested. These are ordinary records used for security and troubleshooting, not analytics, and we do not build profiles from them.

Cookies, analytics and browser storage

Being specific here is more useful than a list of things we might hypothetically do:

• No cookies from this site. Our own code sets none, for any purpose. The one exception to be aware of is the booking page, /book/, which loads Calendly's script and embeds Calendly's calendar. Calendly may set its own cookies or use browser storage in connection with that, under Calendly's privacy policy rather than ours.
• No analytics. There is no Google Analytics, no tag manager, no pixel, no heatmap, no session recording.
• No advertising or remarketing. Nothing we have put on this site builds an audience or follows you to another site.
• Browser storage, only for the pricing estimate. Nothing is written to local storage. The pricing page writes two items to your browser's session storage, which is cleared when you close the tab. One holds your estimate: the plan, team size, monthly figure, your answers summarised, the rate card version and, once it has been emailed, the reference. It lets the booking page show your estimate back to you. The other holds the name and email address you typed into the "talk it through" form, and it is only written after you send that form, so the booking calendar can be filled in for you. Neither item is sent to us. What the booking page passes on to Calendly from them is described under service providers below.
• No account, no login, no profile. There is nothing to sign up for.
• No sensitive information is ever asked for. Do not send us health information, government identifiers or payment card details through this website. If we need something like that during an engagement, we will arrange a proper channel for it.

The Essential Eight readiness checklist and the incident cost estimator both run entirely in your browser: your answers are never transmitted anywhere and nothing is stored when you close the tab. The pricing estimator also works out its figures in your browser. Nothing from it is sent to us unless you ask to email the estimate or talk it through, and then only the plan, team size and add-ons you chose, together with the details on that form.

Service providers and third parties

We use a small number of service providers to run this website and deliver what you ask for. They handle your information to provide those services to us, under their own terms and privacy policies.

• Resend delivers every email our forms send, both to you (documents, estimates, reports) and to our team, so the contents of those emails pass through it. Resend also holds our email contact list: the names and email addresses of people who requested a document, and of people who ticked the box for security updates on the pricing page. Resend is based outside Australia. If Resend is unavailable, notifications to our team can instead be sent through our web host's own mail server.
• Calendly provides the booking calendar on /book/. Anything you enter when you book goes to Calendly. If you arrive from the "talk it through" form on the pricing page, your name, email address, estimate reference and a one-line summary of the estimate (plan, team size and monthly figure) are added to the calendar's web address so they are filled in for you. If you arrive from the booking link in an estimate email, the reference is filled in the same way. Either way, Calendly receives those details when the calendar loads, before you book. Calendly is based outside Australia.
• Our automation server for the Exposure Check, at hooks.ferressystems.com.au, receives the domain and work email address you submit, runs the check and sends you the report through Resend.
• Google Public DNS. The Exposure Check reads your domain's public DNS records through Google's DNS service. Only the domain name is sent, never your email address.
• Google Fonts. This site loads its typefaces from Google's font service. Doing so means your browser makes a request to Google, and Google receives your IP address as part of that request, as it would for any resource loaded from another domain. We do not receive anything from it and it is not used by us to identify you.
• Our hosting provider runs the web server, keeps the server logs described above, and stores the rate-limit and estimate records.
• Email itself. When you send a form, the contents reach us as an email. Email is not an inherently private medium, which is worth knowing before you put anything confidential in a message box.

Where it lives, and how long

Client data we look after under a managed services engagement stays inside Australian infrastructure. That commitment is firm, and it is the same one made across this site.

This public website is different, and we would rather say so than blur the two. Form emails are delivered through Resend and bookings are handled by Calendly, both of which are based outside Australia, so the details you send through this website are handled outside Australia on their way to us.

Enquiries are kept while the conversation is live and for a reasonable period afterwards, so that we can pick up where we left off if you come back. Your place on our email contact list lasts until you unsubscribe or ask us to remove you.

Evidence gathered during a paid engagement is held for twelve months and then deleted. That period exists for one reason: if an insurer or auditor questions a finding a year later, we can show our working. This is the same commitment made on the Security Baseline Assessment page, and it is not a different number here.

Job applications are kept for twelve months so we can come back to you when a role opens, unless you ask us to delete them sooner.

Rate-limit and estimate records are kept only as long as they are useful for the purposes above. Server logs are kept by our hosting provider under its own retention. Copies held by Resend and Calendly are kept under their own retention. If you ask us to delete what we hold, that includes what we can remove from both.

Who we share it with

Nobody, for their own purposes. We do not sell personal information, we do not trade it, and we do not hand it to data brokers, advertisers or partners.

That is different from using the service providers named above to deliver emails, run the Exposure Check and take bookings. They handle information on our behalf so the thing you asked for actually happens, not so they can use it for themselves.

We may disclose information where the law requires it, or where it is necessary to deal with a serious and imminent threat to someone's safety. If we are compelled to hand something over, we will tell you unless we are legally prohibited from doing so.

Data breaches

We are subject to the Notifiable Data Breaches scheme under the Privacy Act 1988. If a breach involving your personal information is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner, as the scheme requires. We write about how that scheme works for our clients, and the same obligations apply to us.

Your rights

There is no form for any of this. Email hello@ferressystems.com.au and a person will deal with it.

Changes to this policy

If we change how we handle personal information, this page changes with it and the date at the top moves. We will not quietly broaden what we collect and leave the policy pointing the other way.