Privacy Policy

1. About this policy

This policy explains how Caalano Digital Pty Ltd ("Caalano Digital", "we", "us", "our"), of Suite 612, 7 Maitland Place, Norwest NSW 2153, handles personal information about the people we deal with: people who enquire about our services, the businesses we work with and their staff, prospects, suppliers, job applicants, and visitors to caalanodigital.com.au.

We are a growth marketing agency. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

The Caalano Systems platform is operated by a related but separate company, Caalano Systems Pty Ltd (ABN 49 670 857 851). It has its own privacy policy at caalanosystems.com.au/privacy-policy and its own terms at caalanosystems.com.au/terms-conditions.

2. What we collect

Contact and business information: your name, business name, role, email address, phone number, postal address, and billing and payment details.

Correspondence and meetings: the content of emails, messages, calls and meetings with you, and notes we make about them.

Recorded calls. We record and transcribe some telephone and video calls for note-taking. Where a call is recorded we tell you at the start, and you can ask us not to record. If you ask, we will not record.

Website information: if you visit caalanodigital.com.au we collect your IP address, browser and device information, the pages you view, and cookie and pixel identifiers, using cookies, log files and similar technologies. Section 10 explains this.

Job applications: your CV, work history, referee details and anything else you choose to include.

Sensitive information. We do not ask for sensitive information about you, and we ask you not to include it in enquiries to us. If you send it to us anyway, we will delete it unless we need it for the purpose you sent it.

We collect most information directly from you. Where we obtain business contact details from a data provider for our own sales prospecting, we will tell you where we got them when we first contact you.

3. Why we use it

We use personal information to: respond to enquiries and assess whether we can help; provide our services to the businesses we work with and manage those relationships; invoice and collect payment; market our own services to businesses, where you have consented or would reasonably expect it; recruit; improve our services and our website; and meet our legal obligations.

We do not sell personal information, and we do not trade in it.

4. Direct marketing

We send marketing about our own services to businesses and the people who work in them. Every message identifies us and contains a working unsubscribe, which we action within 5 business days. Where you have consented to marketing, that consent covers email and SMS and continues until you withdraw it. You can withdraw it at any time using the unsubscribe link or by contacting us at the details in section 9.

Our SMS messages are sent through Twilio Inc., a United States company.

5. Who we disclose it to

We disclose personal information to:

• Service providers who help us run our business;
• professional advisers, insurers and auditors, where necessary;
• a purchaser or successor, if we sell or restructure our business, under an agreement to keep it confidential;
• anyone else with your consent, or where required or authorised by law.

6. Overseas disclosure

Most of the providers above are located outside Australia, principally in the United States.

Before disclosing personal information to an overseas recipient we take reasonable steps to ensure they do not breach the Australian Privacy Principles, principally by entering into a written agreement requiring them to handle the information in accordance with those principles.

In plain terms: the system we use to manage our enquiries and business relationships is in the United States, and several of our other providers are there too. Australian law does not require this information to be stored in Australia; it requires that you are told and that we take these steps.

If we ever rely on your consent for an overseas disclosure, we will tell you so clearly at the time and explain that we may not be accountable under the Privacy Act for how that recipient handles your information and that you may be unable to seek redress under the Privacy Act. We will not rely on this policy alone for that purpose.

7. Security

We take reasonable steps, including technical and organisational measures, to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include role-based access limited to what each person needs, multi-factor authentication, encryption in transit, documented joiner and leaver processes, periodic privacy training, and written agreements with our service providers. We do not use live personal information in testing or development environments.

If a data breach occurs that is likely to result in serious harm, we will assess it promptly and, where the Notifiable Data Breaches scheme requires, notify the Office of the Australian Information Commissioner and the affected individuals.

No system is completely secure, and we cannot guarantee absolute security.

8. How long we keep it

We keep personal information only for as long as it is needed for the purpose it was collected for, or as long as the law requires. When it is no longer needed we destroy it or permanently de-identify it.

Our usual periods are:

• enquiries to us, 24 months from last contact;
• recordings and transcripts of our business calls, 12 months;
• account, contract and billing records, 7 years after the relationship ends;
• job applications, 12 months unless you ask us to delete them sooner.

9. Access, correction and complaints

You can ask us what we hold about you, and ask us to correct it. We will respond within a reasonable period, generally within 30 days. There is no charge for making a request. If we refuse access or correction we will tell you why in writing and how to complain.

Anonymity. Where it is lawful and practicable, you can deal with us anonymously or under a pseudonym. In most cases we will need your name and contact details to respond to you.

If you think we have breached your privacy, tell us. We will acknowledge within 5 business days and give you a written response within 30 days.

If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992.

10. Cookies and tracking pixels

Our website uses cookies and tracking pixels provided by Google (Google Analytics, Google Ads and Google Tag Manager), Meta (Meta Pixel) and Microsoft (Clarity) for analytics and, where you consent, advertising. These providers may hold the information in the United States.

Advertising and analytics tracking does not operate until you make a choice in our consent banner. You can refuse as easily as you can accept, and you can change your choice at any time through the consent controls on the site. We record your choice.

You can also opt out through Meta's advertising settings, Google's ads settings and the Google Analytics opt-out browser add-on, and you can block or delete cookies through your browser.

11. Children

Our services are for businesses. We do not knowingly collect personal information about children.

12. Automated decision-making

We do not currently use automated decision-making that could significantly affect your rights or interests. If this changes, we will update this policy before the Australian Privacy Principles amendments commence on 10 December 2026.

13. Changes

We review this policy at least annually. The current version is always at caalanodigital.com.au/privacy-policy, with the date and version number at the top.