Privacy Policy

1.1 Personal Information via Contact Form

When you complete our website's contact form, we collect:

• Full Name – to identify and address you appropriately
• Organisation Name – to understand your business context
• Email Address – to communicate with you regarding our services
• Phone Number – to contact you for follow-up or consultation
• Critical Infrastructure Sector (optional) – to tailor our services

1.2 Website Analytics and Technical Data

We collect standard analytics data including IP addresses, browser type, device type, pages visited, and visit timestamps. This is generally non-identifying or pseudonymised.

We collect personal information directly when you:

• Complete and submit our contact form
• Contact us via email or phone
• Engage with us for consultations or services
• Subscribe to our newsletters or updates

Analytics data is collected automatically through cookies when you visit our website.

• Service Provision: To provide information about our security assurance services
• Communication: To respond to inquiries and provide regulatory updates
• Business Development: To follow up regarding potential service engagements
• Marketing: To send relevant information (you may opt-out at any time)
• Website Improvement: To analyse usage and improve functionality
• Compliance: To meet our legal and regulatory obligations

4.1 Storage

Personal information is stored digitally in secure systems with Creator-Only access rules — only authorised VRG personnel can access your information.

4.2 Security Measures

• Restricted access (authorised VRG personnel only)
• Secure digital storage with encryption
• Regular security assessments and updates
• Strict internal confidentiality policies
• Secure transmission protocols

4.3 Data Retention

We retain personal information only as long as necessary to fulfil collection purposes or as required by law. When no longer required, we securely destroy or de-identify it.

5.1 No Third-Party Disclosure Without Consent

VRG does not sell, rent, or trade your personal information. We will not disclose it without your express consent except in limited circumstances below.

5.2 Permitted Disclosures

• Required by Law: Where required by Australian law or legal process
• Service Providers: Trusted providers who assist our operations (subject to confidentiality)
• Professional Advisers: Legal, financial, or professional advisers where necessary
• Business Transfers: In connection with any merger or acquisition (with prior notice)

6.1 Access

You may request access to the personal information we hold about you. We will respond within 30 days.

6.2 Correction

If your information is inaccurate or incomplete, you may request correction. We will action this within a reasonable timeframe.

6.3 Opt-Out of Marketing

Opt-out anytime by clicking "unsubscribe" in any marketing email or by contacting our Privacy Officer.

6.4 Deletion

You may request deletion of your personal information, subject to our legal retention obligations.

If you believe we have breached the Australian Privacy Principles, please contact our Privacy Officer in writing. We will acknowledge, investigate, and respond within 30 days.

If unsatisfied with our response, you may contact:

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Changes will be posted with an updated effective date. We encourage periodic review.

For any questions or requests regarding this policy: