How we handle your information.

01Who we are

This Privacy Policy applies to personal information handled by Mallen Services Pty. Ltd. (ABN 66 630 719 970), operator of the website mallen.com.au and provider of electronic security and IT services. In this policy, "we", "us" and "our" refer to Mallen Services.

We take privacy seriously and handle personal information in accordance with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth).

02What information we collect

We collect personal information when you interact with us, including when you:

• Submit a contact form, support ticket, or rate calculator registration on our website
• Call us or send us a message
• Engage our services as a client, or as the representative of a client organisation
• Interact with systems we monitor on behalf of a client (for example, logging into a device that we monitor)

The categories of personal information we may collect include:

• Contact information: name, email address, phone number, company or site name, job title
• Service information: details of your site, devices, issues reported, and support history
• Technical information: IP addresses, device hostnames, and device status information from systems we monitor for our clients
• Account information: records of services provided, invoices, and correspondence

We do not knowingly collect sensitive information (as defined under the Privacy Act) through our website forms. We do not collect information from children under 16.

03How we use your information

We use personal information for the following purposes:

• Responding to your enquiries, support tickets, and service requests
• Providing and administering our services, including monitoring, maintenance, billing, and reporting
• Communicating with you about services we provide or that you have enquired about
• Complying with our legal and regulatory obligations, including those under our Master Security Licence
• Maintaining our internal records and improving our services

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

04Where your information is stored

Personal information we collect through the website is processed and stored in the following systems:

Microsoft Dynamics 365

Our customer relationship management and field service platform. Hosted by Microsoft in Australian data centres. Used to store contact records, support cases, opportunities, and service history.

Microsoft Power Automate

Used to route form submissions from the website into Dynamics 365.

Microsoft Teams

Used for internal notifications when forms are submitted.

SyncroMSP

Used for remote monitoring and management of endpoints on client sites. Stores device status, limited diagnostic information, and ticket correspondence.

Zabbix (self-hosted)

Used for network and infrastructure monitoring. Stores device status and performance metrics.

We have assessed these services and are satisfied they provide appropriate protections. Microsoft is certified under international security standards including ISO 27001, ISO 27018, and SOC 2.

05Who we share information with

We do not sell personal information. We may share personal information in limited circumstances:

• Service providers: the platforms listed in section 04, acting as data processors on our behalf under contractual obligations
• Legal and regulatory obligations: where we are required by law to disclose information, including under our Master Security Licence obligations
• Business transfers: if Mallen Services is sold or merged, information may be transferred to the acquiring entity, subject to continued application of this policy
• With your consent: where you have specifically authorised us to share information with a third party

We do not transfer personal information overseas other than incidentally through our use of Microsoft services, which are primarily hosted in Australia.

06How long we keep information

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law. Specific retention periods:

• Client service records: seven years after the end of the client relationship, consistent with Australian commercial record-keeping requirements
• Enquiries from prospects who do not become clients: typically two years, after which the record is archived or deleted
• Support ticket content: retained for the life of the client relationship plus seven years, for historical troubleshooting and audit purposes
• Website webhook logs and rate-limit records: retained for 90 days maximum

07Your rights

Under Australian privacy law, you have rights in relation to personal information we hold about you, including the right to:

• Request access to the personal information we hold about you
• Request correction of information that is inaccurate, out of date, incomplete, or misleading
• Request deletion of your information (subject to our legal obligations to retain certain records)
• Opt out of direct marketing communications (though we do not currently conduct direct marketing campaigns through the website)
• Make a complaint about our handling of your personal information

To exercise any of these rights, contact us using the details in section 11 below. We will respond to access and correction requests within 30 days.

08Cookies & tracking

This website does not currently use tracking cookies or any third-party analytics. We plan to introduce Google Analytics in the future to help us understand how visitors use the website. When Google Analytics is introduced, we will update this policy to include:

• The specific data Google Analytics collects (typically limited to anonymised usage patterns: pages visited, time on site, rough geographic location, device type)
• How to opt out, both through our own cookie controls and through Google's opt-out tools

The website does use essential functional storage (such as remembering your rate calculator session) for features you have explicitly initiated. This information does not leave your browser.

09Security of your information

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. These steps include:

• Encrypted connections (HTTPS) for all website traffic
• Microsoft 365 multi-factor authentication for all staff accessing client data
• HMAC-signed webhooks between website forms and Power Automate, to prevent tampering
• Rate limiting and honeypot protections on public forms
• Regular review of access permissions

No method of transmission or storage is completely secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.

10The Mallen Phone app

Mallen Phone is our business telephone app for Android, published on Google Play (package name au.mallen.phone). It is used by our own staff and by staff of client organisations, and this section applies to everyone who installs it. The app signs in with your work Microsoft account and connects to the telephone system operated by or for the organisation that issued that account.

The organisation that issued your account — your employer — controls the Microsoft 365 tenant and the telephone system the app connects to, and is responsible for the information held in them. Mallen Services supplies the app and, where contracted, operates the telephone system on that organisation's behalf.

What the app accesses, why, and where it goes:

Your Microsoft account identity — name, work email address, and sign-in tokens

To sign you in and to prove to your telephone system that you are entitled to your extension. Shared with Microsoft and your organisation's telephone system; tokens are stored on your device.

Your Outlook contacts — names, organisations, job titles, phone numbers, email addresses, and photos

So you can find and call people, and so incoming calls show a name instead of a number. Read from your own Microsoft 365 mailbox and stored on your device. Not sent anywhere else.

Voicemail — transcripts, audio recordings, caller details, and whether you have listened to a message

To show and play voicemail in the app and keep its status in step with Outlook. Read from your own Microsoft 365 mailbox; audio is cached on your device and deleted automatically.

Call audio

To carry the call. Sent over an encrypted connection to your organisation's telephone system. The app does not record calls.

Call history

To show your recent calls. Stored on your device only.

A notification token issued by Google, and your device name

So your handset can be woken for incoming calls, and so your telephone system can tell your devices apart. Shared with Google (Firebase Cloud Messaging) and your organisation's telephone system.

Crash diagnostics — device model, operating system version, and stack traces

To diagnose app faults. Sent to Google Firebase Crashlytics. Call logs, SIP identities and dialled numbers are not included.

The server address you enter when you first set up the app

To look up the settings for your organisation's telephone system. Sent to Mallen Services — the address itself, and nothing about you.

What the app does not do:

• No advertising, no analytics: the app contains no advertising and no analytics or usage tracking — the crash diagnostics above are the only diagnostic service it uses. We do not sell or share your personal information with anyone.
• Phone contacts stay on the phone: your phonebook comes from your Microsoft 365 account. If you grant the optional contacts permission, the app reads the contacts stored on the phone itself on the device only — to show a photo you already have, or to put a name to a caller who is not in the company phonebook — and never uploads or changes them. The app works without this permission.
• The app does not record calls: where the organisation operating your telephone system has enabled call recording or transcription, that is performed by the telephone system under that organisation's own policies, not by the app.

A fuller, app-specific version of this policy is published at mallen.com.au/mallen-phone-privacy.html. Because the information the app shows is held in your employer's Microsoft 365 tenant and telephone system, requests to access, correct or delete it are handled by your employer — contact your IT team in the first instance.

11Contact & complaints

To make a privacy enquiry, access request, correction request, or complaint, contact:

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

12Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Substantive changes will be communicated to active clients via email or a notice on the website. You should review this policy periodically to stay informed of how we handle your information.