Privacy policy

Who this policy covers

This policy is for 4IR Pty Ltd (ABN 21 657 755 112), a cyber security consultancy based in Sydney, New South Wales (“4IR”, “we”, “us”). We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).

What this website collects

• No cookies, analytics, tracking pixels or advertising tools are used on this website.
• The website has no forms, accounts or logins.
• All content and images are served from this website itself. No third-party scripts are loaded. The LinkedIn link opens LinkedIn, which has its own privacy policy.
• The hosting provider (Microsoft Azure) processes technical information such as IP address, browser type and the pages requested, to deliver the site and protect it from abuse. We do not use this information to identify individual visitors.

If you email us

If you contact contact@4ir.com.au, we receive your name, email address and anything you choose to include. It is used only to respond to you, to discuss or provide services, and to keep appropriate business records. We do not sell personal information or add it to marketing lists.

Please don’t send sensitive information, such as passwords or details of a live security incident, by ordinary email unless a secure way to exchange it has been agreed.

Information handled when providing services

Security reviews and evidence work can involve personal information about a client’s staff and contractors. Depending on the scope, this can include names, work email addresses and usernames, job roles and admin role assignments, sign-in and multi-factor authentication registration status, device names and assigned users, and the names of people who attended an incident response exercise.

• Purpose. This information is used only to deliver the work the client has engaged us for, such as assessing controls, preparing the evidence pack and reporting findings.
• Minimisation. Only what the agreed scope needs is collected, using read-only access wherever the platform allows (Uplift uses client-approved, time-bound admin access, removed at close). Where a finding can be reported without naming a person, it is.
• Storage and security. Engagement data is held in our Microsoft 365 environment, with access restricted to the person doing the work and protected by multi-factor authentication.
• Retention and deletion. Engagement data is kept for the period set out in the engagement letter, then deleted. A client can ask for earlier deletion.
• Disclosure. Evidence and reports are provided to the client only. We do not share them with insurers, brokers, customers or anyone else; the client decides what to share.
• Client responsibility. Clients remain responsible for telling their own staff how their information is used, in line with their own privacy obligations.

Storage and overseas disclosure

Email, business records and engagement data are held in Microsoft 365, protected with access controls and multi-factor authentication. Microsoft may store or process some data outside Australia, including in the United States, as part of providing its services. Personal information is kept only as long as it is needed for the purposes above, or as required by law.

Disclosure

We do not disclose personal information to others, except to service providers that help operate the business (such as the email and website hosting providers), or where required or authorised by law.

Access, correction and complaints

You can ask to access or correct personal information we hold about you, or raise a privacy concern, by emailing contact@4ir.com.au. You will receive a response within a reasonable time, usually within 30 days. If you are not satisfied with the response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

This policy may be updated from time to time. The current version is always available on this page.

4IR Pty Ltd · ABN 21 657 755 112 · Last updated 22 October 2026