Privacy Policy

1. Who this draft is about

Celestique Cloud is an Australian-led AI, data, cloud, security and managed-services consultancy based in Mitcham, Melbourne, Victoria, Australia. In this document, “we” and “us” mean Celestique Cloud, and “you” means a person who visits this website or sends us something through it.

Where this draft refers to the Australian Privacy Principles, it means the principles set out in Schedule 1 to the Privacy Act 1988 (Cth). The Office of the Australian Information Commissioner, the OAIC, is the regulator responsible for that Act. This draft has been written with those principles in view. Confirming that it actually meets them is one of the purposes of the legal review, and until that review is complete we make no compliance claim.

2. What this draft covers

It covers personal information collected through this website. It does not cover information exchanged under a signed engagement, which is governed by the terms of that engagement, and it does not cover websites we link to, which have their own policies.

3. What we collect

We collect what a form asks for, and nothing that a form does not ask for. There are three places on this website where you can send us information.

Enquiry form and free discovery workshop request

These two forms collect the same set of fields:

• first name and last name
• work email address
• phone number, optional
• company
• role, optional
• enquiry category and service interest
• current cloud environment
• project timeframe
• budget range, optional
• a description of the business challenge you want to discuss
• preferred contact method
• a consent tick confirming you are happy for us to reply

The business challenge field is free text, so what it contains is entirely your choice. Please keep it at the level of the problem. Do not paste credentials, secrets, client records, health information or anything else you would not want sitting in an email inbox.

Careers expression of interest

• name
• email address
• location
• area of interest
• LinkedIn profile address, optional
• portfolio or GitHub address, optional
• a short introduction
• a consent tick

This website has no file upload of any kind, so no curriculum vitae, identity document or image can be sent through it. That is deliberate. Accepting uploads would require malware scanning, secure storage, retention rules and a deletion process, none of which are in place, so the capability is absent rather than partly built.

Information collected automatically

Serving a web page produces technical records. Our hosting and infrastructure providers record standard request information such as the internet address the request came from, the browser user agent, the page requested, the response status and the time. These records exist to run the site, investigate faults and detect abuse such as automated form submission. They are not used to build a profile of you.

4. Why we collect it

Australian privacy law does not use the list of lawful bases familiar from European law. Under Australian Privacy Principle 3, an organisation may collect personal information that is reasonably necessary for one or more of its functions or activities. The activities we rely on are:

• replying to an enquiry that you chose to send us
• arranging, running and following up a discovery workshop you requested
• considering an expression of interest in working with us
• keeping a record of what was asked and what we answered
• operating the website and protecting it from abuse

Where a form includes a consent tick, that consent is an additional and separate basis for contacting you, and you can withdraw it at any time. We do not use enquiry content to build a marketing profile, we do not add you to a mailing list because you asked a question, and we do not sell personal information to anybody.

5. How long we keep it

This draft does not state a retention period. Setting a defensible period for each category above, and a matching deletion process for both the mailbox copies and any other copy, is a specific item for the legal review. Inventing a number here would be worse than admitting the gap. Until a period is agreed and published in this section, information is kept only while it is needed for the matter it was sent about.

6. Who receives it

A form submission becomes an email. It is delivered to Celestique Cloud mailboxes by a third-party transactional email provider, which necessarily processes the content of the submission in order to deliver it. That provider is the only external party that receives the content of what you write.

Beyond that, information may be disclosed to:

• our hosting and infrastructure providers, which handle request logs as an ordinary part of serving the site
• professional advisers, where we need advice about a matter you have raised with us
• a law enforcement body, court or regulator, where we are required or authorised by law to disclose

We do not disclose the content of one organisation’s enquiry to another, and we do not pass personal information to advertising networks or data brokers.

Disclosure outside Australia

Some of the providers described above may store or process information outside Australia. This draft makes no data residency commitment. Identifying each provider, the countries involved and the steps Australian Privacy Principle 8 requires before an overseas disclosure is part of the legal review, and this section will be rewritten with specifics once that work is done.

7. Cookies and analytics

A cookie is a small file a website can ask your browser to keep. This website is built to work without cookies that identify you personally. It does not use advertising cookies, and it does not embed social media tracking pixels.

We may use an analytics tool to understand which pages are read and where visitors arrive from. This draft deliberately does not name a provider, because the choice and its configuration are still under review. Once settled, this section will name the tool, state what it records, say whether it uses cookies and explain how to opt out. If a tool is adopted that requires consent, a consent mechanism will be in place before it is switched on.

8. How the information is protected

Australian Privacy Principle 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. Rather than summarise that in a sentence, we list the controls that are actually implemented on this website, one by one, in the Security Statement. That page covers transport security, response headers, content security policy, how form submissions are validated and rate limited, and where an enquiry goes once it is sent.

No control set is perfect. If you think you have found a weakness, the Security Statement explains how to report it.

9. Your rights

Under Australian Privacy Principles 12 and 13 you may ask for access to the personal information we hold about you, and you may ask us to correct it if it is wrong, out of date, incomplete, irrelevant or misleading. You may also:

• ask us what we hold and why we hold it
• ask us to delete an enquiry, where no law requires us to keep it
• withdraw a consent you previously gave
• ask us to stop contacting you
• complain about the way we have handled your information

Send any of these to director@celestiquecloud.com. We will ask for enough detail to locate the record and to be reasonably satisfied that the request is yours. There is no charge for making a request. This draft does not promise a turnaround time, because we would rather set one we can meet than publish one we cannot.

If our response does not satisfy you

You can take a privacy complaint to the Office of the Australian Information Commissioner. The OAIC publishes its complaint process and contact details at oaic.gov.au. You are not required to come to us first, although it is usually faster if you do.

10. Changes to this draft

This document will change, first through legal review and then whenever our practices change. The drafting date at the top of the page is updated whenever the text is revised. When the policy is adopted, the draft notice will be replaced with a version and effective date.

11. Contact

Privacy enquiries, access requests, corrections and complaints: director@celestiquecloud.com.

Celestique Cloud
16 Creek Road, Mitcham VIC 3132, Australia

For anything that is not a privacy matter, the contact page lists the right address for each kind of enquiry.