Privacy Policy

Morpht Pty Ltd (ABN 51 156 310 922)
 

1. About this policy

Morpht Pty Ltd ("Morpht", "we", "us") is an Australian digital agency. We design, build and support websites and digital services for government and enterprise clients.

This policy explains how we collect, use, disclose, store and protect personal information. It covers:

• personal information Morpht collects for its own business, such as from clients, website visitors, newsletter subscribers, job applicants and suppliers
• personal information Morpht handles on behalf of clients when we deliver services to them

Morpht is bound by the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme.

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

2. Our Privacy Officer

Murray Woodman, Managing Director, is Morpht's Privacy Officer. You can contact him about this policy, to request access to or correction of your personal information, or to make a complaint:

• Email: contact@morpht.com (Attention: Privacy Officer)
• Post: Privacy Officer, Morpht Pty Ltd, 1/204 King Street, Newtown NSW 2042

3. Personal information we collect for our own business

3.1 Kinds of personal information

Depending on how you deal with us, we may collect:

• Contact details: name, job title, organisation, email address, phone number and postal address.
• Business dealings: records of enquiries, meetings, proposals, contracts, invoices and support requests.
• Marketing preferences: newsletter subscriptions, event registrations and how you interact with our emails.
• Website and usage information: pages visited, device and browser type, approximate location, referring site, and interactions with our site, collected through cookies and similar technologies (see section 9).
• Recruitment information: CVs, qualifications, work history, referee details and interview notes.
• Supplier and contractor information: contact, payment and contract details.

We do not seek to collect sensitive information, such as health information or racial or ethnic origin. If we need it, for example to make a workplace adjustment for a job applicant, we collect it only with your consent.

3.2 How we collect it

We collect personal information:

• directly from you, when you contact us, complete a form on our website, subscribe to our newsletter, attend an event, apply for a role or do business with us
• automatically, when you use our website (see section 9)
• from third parties, such as your colleagues when they introduce you, referees you nominate, and public professional networks such as LinkedIn

You can deal with us anonymously or under a pseudonym where that is practical, for example when browsing our website or making a general enquiry.

3.3 Why we collect and use it

We collect and use personal information to:

• respond to enquiries and provide our services
• manage our relationships, contracts, billing and accounts
• send newsletters and information about our services, where you have agreed or would reasonably expect it (see section 10)
• understand how our website is used and improve it
• recruit and engage staff and contractors
• meet our legal, regulatory and contractual obligations

We use personal information only for the purpose we collected it for, or for a related purpose you would reasonably expect, unless you consent or the law requires or permits otherwise.

4. Personal information we handle for clients

When Morpht delivers services to a client, we may handle personal information that the client controls. Examples include:

• submissions made through webforms on client websites
• user accounts on client websites
• personal information contained in content we migrate, or in support requests

When we act for a client:

• The client controls the information: we handle it only to deliver the services, in line with our contract and the client's lawful instructions.
• Contract obligations apply: for Australian Government clients, we comply with the APPs and with any additional privacy, security and records obligations in our contract, as a contracted service provider under the Privacy Act.
• We minimise access: our team accesses client personal information only where a task requires it.
• We anonymise development data: for normal development work, we use anonymised data, not real personal information.
• We manage offshore access: team members outside Australia access client production data only where the client's contract permits it and the client has approved it (see section 6).
• We retain and delete as required: we keep client data for the periods required by our contract and the law, then securely delete it (see section 8).

If you want to access or correct personal information held on a client's website or service, please contact that client. We will help the client respond.

5. Disclosure of personal information

We may disclose personal information to:

• our staff and contractors, where they need it to do their work
• service providers that support our business, such as email, file storage, project management, CRM, accounting, analytics and hosting providers
• our partners and subcontractors, where they help us deliver services to you or your organisation
• Australian Government agencies, where our contract requires it, for example for panel reporting
• our professional advisers and insurers
• anyone else, where you consent or the law requires or authorises it, including a court order or a request from a law enforcement agency

We require our service providers, partners and subcontractors to protect personal information and to use it only for the purpose we provided it for.

We do not sell personal information.

6. Overseas access and storage

Some of the people and systems that handle personal information for Morpht are located outside Australia.

6.1 Our team

Some Morpht contractors work from the Czech Republic, Japan and Croatia. They:

• are bound by Morpht's privacy and security policies
• use named accounts protected by multi-factor authentication on company-managed devices
• do not access classified information or client production data without the client's approval

6.2 Our systems

We use the following services, which store or process personal information in the locations shown:

Before we disclose personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs. We do this through our contracts, our security requirements, and our choice of reputable providers.

Where a client contract requires personal information to stay in Australia, we comply with that requirement.

7. Security

We protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our controls include:

• security practices aligned with the Australian Government Information Security Manual
• unique accounts, multi-factor authentication and least-privilege access, with access removed promptly when roles change
• encryption of data in transit and, where our providers support it, at rest
• secure development practices, peer review and dependency vulnerability scanning
• a documented security policy, in place since 2018 and reviewed every year
• a documented Cyber Incident Response Plan

Morpht is working towards ISO 27001 certification.

8. Retention and destruction

We keep personal information only for as long as we need it for the purpose we collected it for, or as long as the law or a contract requires. For example:

• business and financial records are kept for the periods required by tax and corporations law
• client data is kept for the periods required by our contract with the client
• recruitment information for unsuccessful applicants is kept only as long as needed for the recruitment process, unless the applicant agrees to us keeping it longer

When personal information is no longer needed, we securely delete it or de-identify it. Equipment is securely wiped before it is reused or disposed of.

9. Our website, cookies and analytics

9.1 Cookies and similar technologies

The morpht.com website uses cookies and similar technologies to operate the site, understand how it is used, and measure our marketing. You can block or delete cookies through your browser settings. Some parts of the site may not work as intended if you do.

9.2 Analytics

We use Google Analytics and Matomo to understand how visitors use our website. These tools collect information such as pages visited, time on site, device type and approximate location. We use this information in aggregate to improve our site.

9.3 Personalisation and recommendations

• Convivial Profiler: our website uses Convivial Profiler, Morpht's own personalisation technology, to show content relevant to your interests. It runs in your browser. It does not collect your name, email address or other information that identifies you, and the profile it builds stays on your device.
• Recombee: our website uses Recombee to recommend content. Recombee uses a pseudonymous identifier to link your visits. It does not receive your name or email address.

9.4 Search and chat

Our website uses QuantSearch for search and a chat feature that uses artificial intelligence. QuantSearch is hosted in Australia. We do not use it to collect personal information, and we ask that you do not enter personal information into search or chat.

9.5 LinkedIn advertising

We advertise on LinkedIn. We use LinkedIn's tools to show our advertisements to people who have engaged with our website or our LinkedIn content. We do not upload email addresses or other contact details to LinkedIn for advertising. You can control how LinkedIn uses your information for advertising in your LinkedIn settings.

10. Newsletters and direct marketing

We send newsletters and information about our services by email, using HubSpot. We do this only where you have subscribed or would reasonably expect to hear from us, in line with the Spam Act 2003 (Cth).

Every marketing email includes a way to unsubscribe. You can also ask us to stop at any time by contacting the Privacy Officer.

11. Artificial intelligence

Morpht uses AI tools to support some of its work. We apply these rules:

• Client personal information: we do not enter client personal information into AI tools unless the client has approved it.
• Approval for client work: we disclose our use of AI to Australian Government clients and seek their approval, as our contracts require.
• Human review: a person reviews AI-assisted outputs before they are used or published.
• Website features: the AI features on our website are described in section 9.4.

12. Data breaches

We assess any suspected data breach promptly under our Cyber Incident Response Plan. We take immediate steps to contain the breach and reduce any harm.

• Client data: where a breach affects personal information we handle for a client, we notify the client immediately, as our contract requires.
• Eligible data breaches: where a breach is likely to result in serious harm, we notify the affected individuals and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

13. Access and correction

You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting the Privacy Officer. We may need to verify your identity first.

We will respond within 30 days. Access is free. If we refuse a request, we will explain why in writing and tell you how to complain. We may refuse access only where the Privacy Act allows us to.

14. Complaints

If you have a concern about how we have handled your personal information, please contact the Privacy Officer and give us the details. We will acknowledge your complaint promptly, investigate it, and respond in writing within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• Website: oaic.gov.au
• Phone: 1300 363 992

15. Children

Our services and website are intended for organisations and professionals. We do not knowingly collect personal information from children.

16. Changes to this policy

We review this policy at least every year, and when our practices or the law change. The current version, with its effective date, is published at https://www.morpht.com/privacy.