BlackFlag Advisory privacy policy. How we collect, use and protect personal information under the Australian Privacy Act 1988.
Important: BlackFlag Advisory conducts all assessments using exclusively passive OSINT techniques. We do not access, probe, test, or collect any data from the systems, networks, or accounts of assessed organisations. All assessment findings are derived from publicly available information only. By submitting your domain, email address, name, or phone number through our website, you consent to the collection and use of that information as described in this policy.
BlackFlag Advisory ("we", "us", "our") is committed to protecting the privacy of all individuals who interact with our website and services. This Privacy Policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Privacy and Other Legislation Amendment Act 2024 (Cth).
BlackFlag Advisory (ABN 18 302 235 751) is a cyber governance, risk and compliance practice based in Sydney, NSW. We apply the Australian Privacy Principles in full to all personal information we handle, as a matter of professional practice. As a GRC advisory firm, we hold ourselves to the highest standards of data governance — the same standards we help our clients achieve.
This policy applies to all personal information collected through our website at www.blackflagadvisory.com.au, including domain submission forms, callback request forms, and the general enquiry form.
APP 3 & 5
What Information We Collect
We collect only the personal information that you voluntarily provide to us, and only to the extent necessary to deliver our services. The table below sets out what we collect, through which channel, and why.
| Information Type |
Collection Channel |
Required / Optional |
| Full name |
Assessment form, callback form, enquiry form |
Required |
| Email address |
Assessment form, callback form, domain submission |
Required |
| Phone number |
Assessment form, callback request, domain submission |
Required for callback; optional for domain submission |
| Organisation name |
Assessment form, enquiry form |
Required |
| Primary domain |
Domain submission form, assessment form |
Required for assessment |
| Selected pricing plan |
Assessment form (URL parameter from pricing page) |
Optional |
| Any information included in free-text enquiry fields |
Enquiry messages |
At your discretion |
We do not take card payments through our website and do not collect payment card details.
We do not knowingly collect personal information from individuals under the age of 18. See Section 14 for our Children's Privacy policy.
We do not collect sensitive information as defined under the Privacy Act (including health, racial or ethnic origin, political opinion, religious belief, sexual orientation, criminal record, or biometric information), and we ask that you do not include such information in any form submission or enquiry.
Information we collect during assessments
When we assess an organisation, we collect information that is publicly available or published in data breach and threat-intelligence sources. This can include personal information about that organisation’s staff or associated individuals — such as names, work email addresses, role titles, and indications that a work account’s credentials have appeared in a data breach or infostealer dataset.
We collect this information indirectly, from those sources rather than from the individuals themselves, and solely to identify and report security exposure to the organisation that engaged us. We do not use it to contact the individuals concerned, for marketing, or for any other purpose.
We never attempt to use a credential, and we never access any account or system. Exposed passwords and secrets are not reproduced in full in our reports; findings are reported in redacted form. This information is held with the assessment report, shared only with the engaging organisation, and deleted on the same schedule as the report (Section 4).
APP 6
Why We Collect This Information
We collect your personal information solely for the following primary purposes:
| Purpose |
Basis |
| To conduct passive OSINT-based GRC assessments of submitted domains |
Performance of services / consent |
| To contact you with assessment findings, pricing options, and next steps |
Performance of services / consent |
| To respond to callback requests and general enquiries |
Consent |
| To deliver assessment reports and related documentation |
Performance of services |
| To issue invoices and receipts |
Performance of contract |
| To comply with applicable legal and regulatory obligations |
Legal obligation |
We will not use your personal information for any purpose other than those listed above — including direct marketing, profiling, or resale — without your explicit prior consent.
APP 11.2
How Long We Retain Your Information
We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The specific retention periods that apply to different categories of information are set out below.
Assessment reports and associated documentation
2 years from date of delivery, then permanently deleted
Contact and enquiry data (name, email, phone, domain)
12 months from last contact, then permanently deleted
Callback and domain submission form data
90 days from submission if no engagement proceeds, then deleted
Invoices and payment records
As required by Australian tax law
Records required for legal or regulatory compliance
As required by applicable Australian law
When personal information is no longer required, it is permanently deleted from our email systems. We do not archive or retain backups of personal information beyond these periods.
APP 11
How We Store Your Information
Form submissions from our website are processed via Formspree (formspree.io), a third-party form handling service. When you submit any form on our website, that information is transmitted to Formspree's servers and forwarded to our email address.
Your personal information is then held in our secure email account operated by ProtonMail — an end-to-end encrypted email platform hosted on Switzerland-based servers — and used solely for the purposes described in this policy.
This website is hosted by Netlify, Inc. As our hosting provider, Netlify processes standard web server request data — including IP addresses, browser user-agent strings, requested URLs and timestamps — in the course of serving pages to you. This data is used for delivery, security and abuse prevention, and is retained in accordance with Netlify's own retention practices.
We do not store personal information in unencrypted local files, shared drives, or third-party CRM platforms. Access to personal information is restricted exclusively to BlackFlag Advisory.
APP 8
Overseas Disclosure
We use the following overseas service providers. When you use our website or submit information, some of your personal information is disclosed to them as described below.
Netlify, Inc.
Website Hosting & Content Delivery
Headquartered in the United States. As our hosting and content delivery provider, Netlify processes standard web server request data when you visit this website, including your IP address, browser user-agent string, the pages you request and the time of each request. Netlify also processes domain names submitted to our external assessment tool in order to execute the assessment. This data is used solely for page delivery, security and abuse prevention.
View Netlify Privacy Policy ↗
Formspree Inc.
Form Handling & Submission Processing
Headquartered in the United States. Form submission data — including your name, email, phone number, domain, and any message content — passes through Formspree's US-based servers before being forwarded to our ProtonMail inbox. Formspree does not use this data for any purpose other than delivery.
View Formspree Privacy Policy ↗
Proton AG
Headquartered in Switzerland, subject to Swiss data protection law (nFADP). All client communications and stored personal information are held in ProtonMail's end-to-end encrypted environment. Switzerland is recognised by the European Commission as providing an adequate level of data protection.
View Proton Privacy Policy ↗
Google LLC
Web Fonts & Digital Footprint DNS Lookups
Headquartered in the United States. Our pages load typefaces from Google Fonts, so Google receives your IP address and browser details when you view this website. When you run a Digital Footprint, your browser also sends the domain you enter to Google Public DNS (dns.google) to look up its public email-security records. Google does not receive your name, email address or any form content.
View Google Privacy Policy ↗
Cloudflare, Inc.
Headquartered in the United States. Some pages load charting and map libraries from Cloudflare’s cdnjs service, so Cloudflare receives your IP address and browser details when those files are delivered. No form content is sent to Cloudflare.
View Cloudflare Privacy Policy ↗
We do not rely on your consent for these disclosures. Before disclosing personal information overseas, we take reasonable steps under APP 8.1 to ensure each recipient handles it consistently with the Australian Privacy Principles, and we remain accountable for how they handle it.
APP 6
Disclosure to Third Parties
We do not sell, rent, trade, share, or otherwise disclose your personal information to third parties for marketing, advertising, or commercial purposes.
We may disclose your personal information only in the following limited circumstances:
| Circumstance |
Recipients |
| Service delivery — necessary to process your submission and deliver assessment outputs |
Netlify, Formspree and Proton AG; Google and Cloudflare for website delivery and Digital Footprint lookups only (as described in Section 6) |
| Legal obligation — required or authorised by Australian law, court order, or regulatory authority |
Relevant authority as required by law |
| Explicit consent — you have specifically authorised disclosure to a named third party |
As specified by you at the time of consent |
APP 11
Security of Your Information
We take reasonable technical and organisational steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Our security measures include:
| Control Type |
Measure |
| Encryption at rest & in transit |
ProtonMail end-to-end encryption for all stored personal information; HTTPS enforced across all website pages and form submissions |
| Access control |
Personal information is accessible only to BlackFlag Advisory; no shared credentials or third-party access to email systems |
| Form handling |
Form submissions processed via Formspree over encrypted connections; no plaintext data storage on our servers |
| Data minimisation |
We collect only information that is necessary; we do not retain data beyond the periods specified in Section 4 |
We follow the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. If a data breach is likely to result in serious harm to any individual, we will notify the affected individual(s) and the Office of the Australian Information Commissioner (OAIC).
If we suspect a data breach, we will assess it promptly and within 30 days. Once we have reasonable grounds to believe an eligible data breach has occurred, we will notify the OAIC and affected individuals as soon as practicable.
APP 12 & 13
Your Rights — Access & Correction
Under the Australian Privacy Principles, you have the following rights in relation to your personal information held by BlackFlag Advisory:
Right of Access (APP 12)
You may request access to the personal information we hold about you. We will respond within 30 days. There is no charge for making an access request.
Right of Correction (APP 13)
You may request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading. We will correct it or provide a written notice of our reasons for refusal.
Right of Deletion
You may request deletion of personal information we hold about you, subject to our legal obligations. We will act on such a request where we are not required by law to retain it.
Right to Withdraw Consent
Where we process your information on the basis of consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing prior to withdrawal.
To exercise any of these rights, please contact our Privacy Officer using the details in Section 17. We will acknowledge your request within 5 business days and respond in full within 30 days. There is no charge for any access, correction, or deletion request.
APP 3.3
Sensitive Information
We do not intentionally collect sensitive information as defined under the Privacy Act 1988, which includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, or biometric data.
We ask that you do not include sensitive information of any kind in form submissions, domain submissions, or enquiry messages. If sensitive information is inadvertently provided, we will take steps to delete it as soon as practicable.
Our services relate to the assessment of an organisation's publicly observable technical and governance posture. No sensitive personal information is required or relevant to our service delivery.
APP 1.7
Automated Decision-Making
BlackFlag Advisory does not use automated systems to make decisions about individuals. All assessment findings and reports are reviewed, verified, and delivered personally by BlackFlag Advisory. No automated decision-making process is applied to personal information submitted by clients or prospective clients that would significantly affect your rights or interests.
Our Digital Footprint tool automatically checks an organisation’s public DNS and email-security records and returns indicative findings about that organisation’s domain. It does not make decisions about individuals.
Upcoming Regulatory Change — December 2026
From 10 December 2026, new APP 1.7 requirements under the Privacy and Other Legislation Amendment Act 2024 require APP entities to disclose in their privacy policy where they use computer programs to make, or substantially assist in making, decisions that could significantly affect the rights or interests of individuals. This section is our disclosure for that purpose: BlackFlag Advisory does not use computer programs to make, or substantially assist in making, such decisions.
APP 1.4
Cookies and Tracking
Our website does not currently use cookies, local storage, session storage, or any third-party tracking scripts. We do not use Google Analytics, Meta Pixel, LinkedIn Insight Tag, or any advertising or behavioural tracking technology.
Our website loads typefaces from Google Fonts and, on some pages, charting and map libraries from Cloudflare’s cdnjs service. The Digital Footprint sends the domain you enter to Google Public DNS. These providers receive your IP address and browser details when this happens (see Section 6). None of these calls set cookies or carry your name, email address or form content.
If our use of cookies or tracking technology changes in the future, this Privacy Policy will be updated accordingly and a cookie consent mechanism will be implemented prior to any tracking activation, in compliance with applicable Australian law.
APP 1.4
Links to External Sites
Our website may contain links to external websites including cyber.gov.au, the OAIC, provider privacy policy pages, and other reference resources. These links are provided for your convenience and information.
BlackFlag Advisory is not responsible for the privacy practices, content, or data handling of any external websites. We encourage you to review the privacy policies of any external site before submitting your personal information to them.
Our services are directed exclusively to businesses and corporate entities. We do not knowingly collect personal information from individuals under the age of 18.
If you believe we have inadvertently collected personal information from a person under 18, please contact our Privacy Officer immediately using the details in Section 17 and we will take prompt steps to delete that information.
Children's Online Privacy Code — December 2026
The OAIC is required to develop and register a Children's Online Privacy Code by 10 December 2026. As our services are not directed at children and we do not knowingly collect information from individuals under 18, we do not anticipate that this Code will impose additional obligations on BlackFlag Advisory. This policy will be reviewed and updated as the Code is finalised.
APP 1
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law — including the ongoing reform of the Privacy Act 1988. The "Last Updated" date at the top of this page will be updated whenever material changes are made.
Where changes are material, we will take reasonable steps to notify affected individuals. We encourage you to review this policy periodically.
Previous versions of this policy are available on request by contacting our Privacy Officer.
If you believe we have handled your personal information in a way that does not comply with the Australian Privacy Principles or this policy, we encourage you to contact us in the first instance so that we may attempt to resolve your concern.
Please contact our Privacy Officer using the details in Section 17. We will acknowledge your complaint within 5 business days and provide a substantive response within 30 days. If we require additional time, we will advise you of this and provide a revised timeline.
If you are not satisfied with our response to a privacy complaint, or if we fail to respond within 30 days, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
Office of the Australian Information Commissioner (OAIC)
Website:
oaic.gov.au |
Phone:
1300 363 992 |
GPO Box 5218, Sydney NSW 2001
APP 1
Contact — Privacy Officer
For any privacy-related enquiries, access requests, correction requests, deletion requests, or complaints, please contact our Privacy Officer directly:
Privacy Officer — BlackFlag Advisory
Role
Privacy Officer & Founder, BlackFlag Advisory
Response
Acknowledged within 5 business days — full response within 30 days
If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or by calling 1300 363 992.