Privacy Notice

1. Who we are

Avertro Pty Ltd is a cybersecurity governance, risk, and compliance (GRC) software company. Our registered address is Level 1, 63-73 Ann Street, Surry Hills, NSW 2010, Australia.

For UK GDPR and EU GDPR, Avertro Pty Ltd acts as a data controller in respect of personal data collected through our website and marketing activities. Pursuant to Article 27 of the EU GDPR and UK GDPR, you can contact our representatives regarding any issues related to the processing of your personal data:

• EU Representative: IT.LAW GmbH; Avertro Pty Ltd - Colmantstraße 15, 53115 Bonn, Germany, art-27-rep-avertro@it.law (for GDPR matters).

• UK Representative: Rickert Services Ltd UK; Avertro Pty Ltd, PO Box 1487, Peterborough PE1 9XX, United Kingdom; art-27-rep-avertro@rickert-services.uk (for UK GDPR matters).

2. What Personal Data we collect and how

2.1. Directly from you

We may collect the following personal data you provide to us:

• Website contact and demo request forms — name, business email address, job title, company name, and any information you include in your message.

• Email correspondence — name, email address, and the content of your communications with us.

• Events — name, job title, company, email address, and any information you share with us in person or via event registration.

• Marketing subscription — name and email address when you subscribe to our communications.

• CyberHQ platform — if you are an authorised user of our services, we collect your name, business email address, and login credentials. We do not collect personal data beyond what is necessary to operate your account.

You are under no obligation to provide us with your personal data. However, we do need this information to deliver and manage our services efficiently. If you choose not to provide your personal data, we may be unable to deliver our services to you. Where permitted by law, we may combine information you provide with data we receive from other sources or collect about you.

2.2. From third parties

We may obtain personal data about you from the following sources:

• Professional networking platforms — we may collect publicly available professional profile information (name, job title, company, contact details) through third-party platforms and advertising tools where you have made this information available.

• Business data enrichment providers — we use these services to supplement contact information for prospective customers, sourced from publicly available professional sources. If we have obtained your contact details this way and contact you, we will disclose this at the time of first contact in accordance with our obligations under UK GDPR and EU GDPR. You may contact us at legal@avertro.com to find out whether we hold data about you sourced this way and to request its removal.

• CRM and marketing platform providers — our CRM and marketing platform may receive data about your interactions with our website and marketing emails (see Section 4 on Cookies and Tracking).

2.3. Automatically through your use of our website

When you visit our website, we automatically collect certain technical information including your IP address, browser type and version, pages visited, time and date of visit, and referring URL. This is collected through cookies and similar technologies, and in certain cases via a real-time lookup with a third-party IP geolocation provider to detect your approximate country (see Section 4).

3. How and why we use your Personal Data

3.1 Purposes of processing

We use your personal data for the following purposes:

3.2 Legitimate interests

Where we rely on legitimate interests as our lawful basis, we have assessed that our interests are not overridden by your rights and interests. You have the right to object to processing based on legitimate interests at any time — see Section 9 for how to exercise this right.

3.3 AI-enabled processing

Our CyberHQ platform includes AI-enabled features that help analyse aggregated security and risk information. These features are designed to work with organisational and technical data and do not make automated decisions about, or generate outputs concerning, identifiable individuals. If this changes, we will update this notice and provide any additional information required by law before that use begins.

4. Cookies and tracking technologies

We use cookies and similar tracking technologies on our website. These include:

• Essential cookies — required for the website to function. These cannot be disabled.

• Analytics cookies — we use website and marketing analytics tools to understand how visitors use our website (pages visited, time on site, referral source). These collect anonymised or pseudonymised data. You can opt out via your cookie preferences.

• Marketing and personalisation cookies — used to deliver relevant advertising and track campaign performance, including through professional networking and CRM/marketing platforms. These are only placed with your consent.

• IP geolocation lookups — when you interact with certain website forms, a script calls a third-party geolocation service to detect your approximate country from your IP address, so we can pre-fill the country field before you submit. This runs automatically on page load and does not depend on cookie consent, since it does not store data on your device — see Section 5 for the recipient and Section 6 for how the transfer is safeguarded.

You can manage your cookie preferences at any time by clicking the cookie preferences link in the footer of our website, or by adjusting your browser settings. Withdrawing consent for non-essential cookies will not affect the functionality of the website.

5. Who we share your Personal Data with

We do not sell your personal data. We share your data only as necessary to operate our business and deliver our services, with the following categories of recipients:

All third-party processors are required to process personal data only on our instructions and in accordance with applicable data protection law, under contractual data protection terms with each provider (including their standard Data Processing Agreements and Standard Contractual Clauses, where applicable).

We maintain an up–to-date list of subprocessors, which we will provide upon reasonable request.

6. International data transfers

Avertro is headquartered in Australia and operates globally. Your personal data may be transferred to and processed in countries outside your country of residence, where some of our service providers are located.

For transfers of personal data from the United Kingdom or the European Economic Area to countries not recognised as providing an adequate level of data protection (including the United States), we rely on Standard Contractual Clauses (SCCs) approved under UK GDPR and EU GDPR respectively as the lawful transfer mechanism. Copies of the relevant SCCs are available on reasonable request.

For transfers from Australia, we take steps to ensure that overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles.

7. How long we keep your Personal Data

We retain personal data for as long as necessary for the purposes for which it was collected, in accordance with the following general principles:

• Prospect and marketing data — retained for as long as the contact remains active (i.e., has not unsubscribed and has had engagement within the past 24 months). Inactive contacts are reviewed and purged on a rolling basis.

• Customer data — retained for the duration of the customer relationship and for (a) product & platform data it will be deleted within 45 days of termination, and (b) business relationship records (invoices, contracts), it will be retained for 7 years to meet legal and contractual obligations.

• Event attendee data — retained for 24 months after the event, unless the individual becomes a customer or active prospect.

• Website analytics data — retained in accordance with our analytics providers' default retention settings (typically 14–26 months).

• Legal or regulatory hold — where data is subject to a legal obligation, regulatory requirement, or dispute, it will be retained for the duration of that obligation.

When personal data is no longer needed, it is securely deleted or anonymised.

8. Marketing communications

We may send you marketing communications about our products, services, events, and content that we believe may be relevant to you. These are sent via email through HubSpot.

You can opt out of marketing communications at any time by clicking the unsubscribe link in any email, or by contacting us at marketing@avertro.com. Opting out of marketing does not affect transactional communications related to a contract or active service relationship.

We comply with the Spam Act 2003 (Cth) for communications to Australian recipients, and with applicable opt-in requirements under UK GDPR, EU GDPR, and equivalent laws for recipients in other jurisdictions.

9. Your rights

9.1. All individuals

Regardless of where you are located, you may contact us at legal@avertro.com to:

• Request access to personal data we hold about you

• Request correction of inaccurate or incomplete data

• Opt out of marketing communications

• Ask us to delete data sourced from third parties

9.2. UK and European Economic Area residents (UK GDPR / EU GDPR)

If you are located in the UK or EEA, you have the following additional rights:

• Right to erasure — request deletion of your personal data, subject to certain exceptions

• Right to restrict processing — request that we limit how we use your data

• Right to object — object to processing based on legitimate interests or for direct marketing

• Right to data portability — receive your data in a structured, machine-readable format

• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

We will respond to all requests within one month. For complex requests, we may extend this by a further two months and will notify you accordingly.

UK residents may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

EEA residents may lodge a complaint with the data protection authority in their country of residence or the country where the alleged infringement occurred.

9.3. Australian residents (Privacy Act 1988)

You have the right to access and correct personal information we hold about you. If you believe we have mishandled your personal information, you may make a complaint to us first, and if unresolved, to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9.4. California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect about you and how it is used, request deletion of your personal information, opt out of the sale or sharing of your personal information (we do not sell personal data), and not be discriminated against for exercising these rights. To exercise these rights, contact us at legal@avertro.com.

10. Children’s privacy

Our website and services are directed at businesses and professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors, and if we become aware that we have done so, we will delete it.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, disclosure, or destruction. Our security practices are reviewed regularly.

No method of transmission or storage is completely secure. If you have concerns about the security of your data, please contact us at legal@avertro.com.

12. Third-party links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy notices separately.

13. Contact us

For any questions about this Privacy Notice, to exercise your rights, or to make a complaint, contact us at:

Privacy Contact
Avertro Pty Ltd
Level 1, 63-73 Ann Street, Surry Hills, NSW 2010, Australia
Email: legal@avertro.com

We aim to respond to all enquiries within 10 business days.