Privacy policy

1. Summary

We build secure, privacy-first software for regulated industries, so we hold ourselves to the same standard we design for our clients. In short:

• We collect only what we need to respond to you, deliver our services and run our business.
• Analytics and session replay on our website stay off unless you switch them on. We do not use advertising, retargeting or social media tracking.
• We never sell your personal information or share it for advertising.
• Our website data is processed in Australia and the European Union, with a small number of trusted service providers listed in this policy.
• We operate an information security management system certified to ISO 27001 and hold a SOC 2 Type II report.
• You can ask to access, correct or delete your information at any time by emailing privacy@lewinnovation.com.

The rest of this policy explains the detail.

2. Who we are and what this policy covers

In this policy, "Lew Innovation", "we", "us" and "our" means Lew Innovation Pty Ltd (ABN 81 637 215 859).

This policy explains how we collect, use, disclose and protect personal information when you:

• visit lewinnovation.com or any of its pages (our "website");
• contact us, book a consultation, request our trust documents or subscribe to updates;
• are a client, or work for a client, of ours;
• are a supplier, contractor or partner of ours; or
• apply to work with us.

We are the controller (in Australian terms, the entity responsible) for the personal information described in this policy.

This policy does not cover personal information we process on behalf of our clients inside the software we build, host or support for them. In that case our client is the controller and their privacy policy applies. See section 9.

We follow:

• the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs);
• the Privacy Act 2020 (New Zealand) and its Information Privacy Principles;
• the UK General Data Protection Regulation and the Data Protection Act 2018 (UK GDPR);
• the EU General Data Protection Regulation (GDPR); and
• the Spam Act 2003 (Cth), the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy rules for electronic marketing and cookies.

We apply these standards as a matter of policy, whether or not a particular law strictly applies to a business of our size.

3. The personal information we collect

3.1 Information you give us

Please do not send us health information or other sensitive information through our website forms or by email unless we have asked for it. Our forms are designed for business enquiries only. If you include sensitive information anyway, we will handle it under this policy and delete anything we do not need.

3.2 Information collected automatically

Always, because the website cannot work securely without it:

• Server and security logs. When you load a page or submit a form, our hosting and security providers process your IP address, browser type, requested page and time. Our form-handling service logs only a request reference, the outcome and error codes. It does not log your name, email, phone number or message.
• Bot protection. When you submit a form, Cloudflare Turnstile checks that you are a person and not an automated program. Cloudflare processes your IP address and technical signals from your browser to do this. Turnstile does not use advertising cookies or track you across other websites.
• Your cookie choice. We store your cookie preference in your browser (as li_consent) for 12 months, and keep an anonymous consent record (see section 3.3).

Only if you choose "Accept" or switch them on in cookie settings:

• Analytics. How you use our website, such as pages viewed, links and buttons clicked, the referring website, your approximate location (city or country, derived from your IP address), device and browser type. We use Mixpanel with data stored in the European Union.
• Session replay. A reconstruction of how pages were used, such as scrolling, clicks and page changes, to help us find usability problems. Text you type into forms is masked in your browser before anything is sent, so it is never recorded.

If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics and session replay.

Our Cookie Policy lists every cookie and similar technology we use, what it does and how long it lasts. You can change your mind at any time using the "Cookie settings" link in the footer of every page.

3.3 Consent records

To show that we respect your choice, we keep a record of each cookie decision: a random identifier, the policy version, the categories you accepted or refused, whether a Global Privacy Control signal was present, the date and time, and the page. We do not store your IP address or any other information that identifies you in this record. Consent records are deleted automatically after 24 months.

3.4 Information from other people

Sometimes we receive information about you from someone else, for example a colleague who introduces us, a client who adds you to a project, a referee you nominate, or public business sources such as your organisation's website or a professional networking profile. We use it only for the business purpose it was provided for. Where the law requires, we will tell you that we have collected it, including under New Zealand Information Privacy Principle 3A.

3.5 Dealing with us anonymously

You can browse our website without telling us who you are, and with analytics switched off. If you want us to reply to an enquiry, we will need a way to contact you. You may use a pseudonym where that is practical, but we will need your real identity to enter into a contract with you.

4. How we use personal information

We use personal information to:

• respond to your enquiry and arrange consultations;
• prepare proposals, estimates and statements of work;
• deliver, support and invoice our services;
• manage our relationships with clients, suppliers and contractors;
• assess job and contractor applications;
• share trust documents under appropriate confidentiality terms;
• understand how our website is used and improve it (only with your consent);
• keep our website, systems and data secure, and prevent spam, fraud and abuse;
• send you updates and insights you have asked for, or that relate to services you already use from us (you can opt out at any time, see section 5);
• meet our legal, regulatory, insurance, tax, audit and certification obligations, including ISO 27001 and SOC 2; and
• establish, exercise or defend legal claims.

We do not use your personal information for any unrelated purpose without telling you first and, where required, asking for your consent.

4.1 Legal bases (UK and EU)

If you are in the United Kingdom or the European Economic Area, we rely on the following lawful bases under Article 6 of the UK GDPR and the GDPR:

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment.

4.2 Automated decision-making

We do not use computer programs to make decisions about you that could significantly affect your rights or interests. Our website's bot check (Cloudflare Turnstile) automatically decides whether a form submission appears to come from a person. If it fails, you can try again or contact us directly by email or phone, and a person will respond.

If this changes, we will update this policy to describe the kinds of personal information used and the kinds of decisions made, as required by APPs 1.7 to 1.9 and the UK GDPR and GDPR.

5. Marketing

We only send marketing emails to people who have asked for them or who are existing business contacts, and every message includes an unsubscribe link. You can also opt out by emailing privacy@lewinnovation.com. We will action an opt-out within five business days. Opting out of marketing does not stop service messages about work you have engaged us for.

We do not sell, rent or trade personal information, and we do not share it with third parties for their own marketing.

6. Who we share personal information with

We share personal information only where needed for the purposes in section 4, with:

• our team, including employees and contractors who are bound by confidentiality and security obligations and receive security and privacy training;
• service providers who process information on our behalf under written contracts, listed below;
• professional advisers such as our lawyers, accountants, insurers and auditors, including our ISO 27001 and SOC 2 auditors;
• a buyer or successor if we sell or restructure our business, under confidentiality obligations; and
• regulators, courts or law enforcement where required or authorised by law.

6.1 Service providers

We choose providers that meet our security requirements, review them as part of our ISO 27001 supplier management, and require them to protect personal information and use it only to provide services to us. We will update this table when providers change. Our current sub-processor list is also available in our Trust Centre.

7. Overseas disclosure and international transfers

We are based in Australia, and our website data is primarily processed in Australia and the European Union. Some personal information may be disclosed to, stored in or accessed from other countries, mainly:

• European Union (Mixpanel analytics, Salesflare CRM);
• United States (Cloudflare, Microsoft)
• New Zealand and the United Kingdom, where our team members, contractors or clients are located; and
• other countries where a service provider's global network operates.

Before disclosing personal information overseas, we take reasonable steps to make sure the recipient protects it in a way that is consistent with the Australian Privacy Principles (APP 8) and the New Zealand Information Privacy Principles (IPP 12).

For information about people in the United Kingdom or the European Economic Area that is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a recipient's certification under the EU-US Data Privacy Framework and its UK extension. You can request a copy of the relevant safeguards by emailing privacy@lewinnovation.com.

8. How we protect personal information

Security is the core of what we do. Our controls include:

• an information security management system certified to ISO 27001 and an independent SOC 2 Type II report;
• encryption of data in transit (TLS 1.2 or higher) and at rest;
• single sign-on, multi-factor authentication and least-privilege access, reviewed regularly;
• secrets kept in a dedicated secrets manager, never in code;
• logging that deliberately excludes personal information wherever possible;
• no real personal information in development or test environments;
• vendor security assessments before we engage new service providers;
• regular security testing, vulnerability management and patching;
• security and privacy training for everyone who works with us; and
• a tested incident response plan.

No system is completely secure. If you believe your information has been compromised, please contact us immediately at privacy@lewinnovation.com.

8.1 Data breaches

If a data breach is likely to result in serious harm to you, we will notify you and the relevant regulator as required, including under the Australian Notifiable Data Breaches scheme, the New Zealand Privacy Act 2020, and within 72 hours to the relevant supervisory authority under the UK GDPR and GDPR where those laws apply. When we act for a client, we notify that client without undue delay so they can meet their own obligations.

9. Information we process for our clients

When we design, build, host or support software for a client, including healthcare, life sciences, media and other regulated organisations, we may handle personal information about that client's customers, patients, users or staff. In those cases:

• our client is the controller of that information and decides how it is used;
• we act as their service provider or processor and handle the information only on their documented instructions and under our contract with them;
• we apply the security controls in section 8 and any additional controls the client's industry requires; and
• the client's own privacy policy explains how that information is handled.

If you want to access, correct or delete information held in a platform we operate for one of our clients, please contact that organisation directly. If you contact us, we will pass your request to the client promptly and help them respond.

10. How long we keep personal information

We keep personal information only for as long as we need it for the purposes in this policy, or as required by law. Then we delete or de-identify it securely.

11. Your rights and choices

11.1 Everyone

Wherever you are, you can ask us to:

• access the personal information we hold about you;
• correct information that is inaccurate, out of date, incomplete or misleading;
• delete information we no longer need;
• stop marketing to you; and
• change your cookie choices at any time through Cookie settings.

We do not charge for making a request. We will need to confirm your identity before releasing or changing information. If we refuse a request, we will explain why in writing and tell you how to complain.

11.2 Additional rights in the United Kingdom and European Economic Area

You also have the right to:

• restrict how we use your information in certain circumstances;
• object to processing based on our legitimate interests, and to object to direct marketing at any time;
• data portability, meaning to receive information you gave us in a structured, machine-readable format, or have it sent to another organisation;
• withdraw consent at any time, without affecting processing that took place before you withdrew it; and
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you.

11.3 How quickly we respond

12. Children

Our website and services are designed for businesses and professionals. They are not directed at children and we do not knowingly collect personal information from anyone under 18 through our website. If you believe a child has given us personal information, please contact us and we will delete it.

Where we build platforms for clients that are used by children or families, we design them to meet the client's obligations, such as the Australian Children's Online Privacy Code, the UK Age Appropriate Design Code and the US Children's Online Privacy Protection Act, under section 9.

13. Links to other websites

Our website links to other websites, such as client sites, our booking page and professional networks. We are not responsible for their privacy practices, so please read their privacy policies.

14. Questions and complaints

Please contact our Privacy Officer first so we can try to resolve any concern:

Privacy Officer, Lew Innovation Pty Ltd
Email: privacy@lewinnovation.com
Post: 32 York Street, Sydney NSW 2000, Australia

We will acknowledge your complaint within five business days, investigate it, and give you a written response within 30 days. If we need longer, we will tell you why.

If you are not satisfied with our response, you can contact the privacy regulator where you live:

In the UK and EEA you may complain to a regulator at any time, without contacting us first.

15. Changes to this policy

We review this policy at least once a year and whenever our practices change, for example, if we add a new service provider or a new category of cookie. The version number and effective date at the top of this page show when it last changed. If a change materially affects how we use information we already hold, we will tell you before it takes effect and, where required, ask for your consent again.

Version history