Privacy Policy

Holistic Governance ("we", "us", "our") is committed to protecting your personal information in accordance with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs).

1. Information We Collect

Category	Data Collected	How
Governance enquiries	Organisation name, contact name, email, phone, governance challenge, accreditation status	Website enquiry form
Proposals	Client name, email, proposal content, engagement notes	Created by Holistic Governance during engagement
Newsletter	Email address	Newsletter sign-up form
Booking	Name, email (provided to Calendly)	Kickoff meeting booking
Resource downloads	Name, work email, organisation, organisation type	Free-resource download forms (e.g. board dashboards, health checks)

2. How We Use Your Information

• To prepare and deliver governance proposals and consultancy services
• To communicate with you about your enquiry or engagement
• To send newsletters you have opted into
• To schedule meetings and kickoff calls
• To deliver free resources you request (including emailing you the download link) and respond if you ask us to follow up

We do not sell, rent, or trade your personal information to third parties.

3. How We Store and Protect Your Data

Measure	Detail
Encryption at rest	Google Cloud default encryption (AES-256)
Encryption in transit	TLS 1.2+ with HSTS
Data location	Stored in Sydney, Australia (australia-southeast1). Transactional email is processed by Resend, Inc. in the United States — see Third-Party Services
Email authentication	SPF, DKIM and DMARC published on our sending domains to help prevent email spoofing
Access control	Authenticated administrator access only
Input validation	Server-side sanitisation, Content Security Policy, rate limiting
Log redaction	Personal information is masked in all server logs

Proposal links: Each proposal is accessible via a unique, cryptographically random URL (e.g. /p/prop_<32-hex>). Anyone who has the link can view the proposal and any signature captured on acceptance. Proposal links should be treated as confidential and not forwarded to third parties.

4. Data Retention

Data Type	Retention Period
Governance enquiries	12 months from submission
Proposals (active)	24 months from last update
Proposals (accepted — frozen copy)	7 years from acceptance, or as required by law, for contractual and legal record-keeping purposes
Proposals (declined/archived)	6 months after status change
Newsletter subscribers	Until you unsubscribe, or 24 months of inactivity
Resource download leads	12 months from submission

When a proposal is accepted, a protected read-only copy is stored as a permanent record of the agreed terms. This snapshot cannot be edited after acceptance.

After the retention period, your data is reviewed and deleted unless there is a legal or contractual reason to retain it.

5. Third-Party Services

Service	Purpose	Data Shared
Google Cloud (Firestore)	Data storage	All collected data (encrypted, stored in Australia)
Resend, Inc. (USA)	Email delivery (enquiry notifications and resource-delivery emails)	Recipient name and email, email content — processed on United States infrastructure
Calendly	Meeting scheduling	Only a link — you provide your details directly to Calendly
Google Analytics & Google Ads tag	Website usage insights and conversion measurement	Browsing and conversion data (Google Analytics 4 does not log or store IP addresses)

Each service operates under its own privacy policy. We encourage you to review them.

Overseas disclosure: email delivery involves disclosing your name, email address and message content to Resend, Inc. in the United States. All other personal information is stored in Australia.

6. Cookies

Our main website uses Google Analytics cookies to understand how visitors use the site. These cookies collect anonymised data only.

Our proposal management system uses a single session cookie for administrator authentication. This cookie contains no personal information, is HttpOnly and Secure, and expires after 7 days or on logout.

Some pages also load the Google Ads tag for conversion measurement, which may set advertising cookies (e.g. _gcl_*). Beyond Google Analytics and the Google Ads tag, we do not use advertising or tracking cookies.

7. Your Rights

Under the Australian Privacy Act, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Withdraw consent (e.g. unsubscribe from newsletters)
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached

8. Data Breach Response

In the event of a data breach that is likely to result in serious harm, we will:

• Notify affected individuals as soon as practicable
• Assess any suspected breach within 30 days, and notify the OAIC as soon as practicable after forming the view that a notifiable breach has occurred, as required under the Notifiable Data Breaches scheme
• Take immediate steps to contain and remediate the breach

9. Contact

We will respond to all privacy-related requests within 30 days.

10. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. Continued use of our services after changes constitutes acceptance of the updated policy.