Privacy Policy

My Security Education is operated by Kuggar Pty Ltd (ABN 67 165 118 561) (we, us, our), a company incorporated in Australia with its registered office at Sydney NSW, Australia.

We provide a workplace compliance learning management platform to organisations. This policy explains how we handle personal information, and applies to our website at mysecurityeducation.com, our platform, and our dealings with prospective and current customers.

We are bound by the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (APPs) contained in it.

The distinction below matters, because it determines who decides what happens to a given piece of information.

Where we decide (we are the entity responsible)

Information we collect directly for our own purposes: website visitors, enquiries submitted through our contact form, marketing contacts, billing contacts and the administrators who manage a customer account with us. We determine why and how that information is handled, and this policy governs it in full.

Where our customer decides (we act on their instructions)

Information about a customer’s workers that is entered into or generated by the platform: names, work email addresses, group and site membership, training assignments, completions, assessment attempts and results. Our customer, as the worker’s employer or engager, decides what is collected and why. We handle it only to provide the platform to that customer, in accordance with our agreement with them.

If you are a worker using the platform because your employer requires it, please direct requests about your training records to your employer in the first instance. We will refer such requests to them, and will assist them in responding.

Information you give us

• Enquiries. Your name, work email address, organisation, role, an indication of how many workers you need to cover, and whatever you write in the message field.
• Account and billing. Administrator names and contact details, organisation name, country, time zone, and billing contact details.
• Correspondence. Records of your communications with our sales and support teams.

Information collected through the platform

• Worker identity information supplied by the customer or by their identity provider: name, work email address, and group or site membership.
• Training records: assignments, due dates, progress, completions, assessment attempts, scores, and the content version each relates to.
• Audit records: administrative actions taken in the platform, the account that took them, and when.

Information collected automatically

• Technical information when you use our website or platform: IP address, browser and device type, pages visited, and timestamps.
• When you submit our contact form we store a salted, irreversible hash of your IP address rather than the address itself, together with the country code supplied by our network provider. We use these solely to detect and limit abuse of the form.

What we do not collect

• We do not collect or store passwords. Access to the platform is by single sign-on through your organisation’s identity provider.
• We do not store payment card details. Card data is handled by our payment provider; we retain only a masked reference and the transaction outcome.
• We do not seek sensitive information as defined in the Privacy Act. Please do not include health information or other sensitive details in free-text fields.

We handle personal information for these purposes:

• To respond to your enquiry and provide a quote or demonstration.
• To provide, maintain, support and secure the platform for our customers.
• To deliver training assignments, record completion and generate the compliance reporting and evidence our customers rely on.
• To send service communications: assignment notices, reminders, overdue escalations, and billing and account notices.
• To administer subscriptions, invoicing and payment.
• To detect, investigate and prevent misuse, fraud and security incidents.
• To comply with our legal obligations and to establish, exercise or defend legal claims.
• With your consent, or where otherwise permitted under the Spam Act 2003 (Cth), to send you marketing about our services. Every marketing message includes a functional unsubscribe facility.

If we cannot collect the information described above, we may be unable to respond to your enquiry or provide the platform to your organisation.

We disclose personal information to:

• Your organisation. If you use the platform as a worker, your administrators can see your assignments, completions and results. That is the purpose of the platform.
• Service providers who help us run the service: cloud hosting and content delivery, database and object storage, video processing and delivery, email delivery, payment processing, and error monitoring. Each is bound to handle the information only for the purposes we specify.
• Professional advisers such as our lawyers, accountants and auditors, where reasonably required.
• Regulators, courts and law enforcement, where required or authorised by law.
• An acquirer, if we sell or transfer all or part of our business, subject to that party agreeing to handle the information consistently with this policy.

We do not sell personal information, and we do not disclose it to third parties for their own marketing purposes.

We aim to store platform data in Australia. However, some of the service providers we rely on operate globally, and personal information may be stored in or accessed from overseas, including the United States and other jurisdictions in which those providers operate data centres.

Before disclosing personal information overseas we take reasonable steps, as required by APP 8, to ensure the recipient does not breach the APPs, including through contractual commitments covering security, confidentiality and permitted use.

If data residency is a specific requirement for your organisation, raise it with us before you subscribe and we will confirm in writing what arrangements apply. Current details of the countries in which your data may be held are available on request from privacy@mysecurityeducation.com.

This website uses Google Analytics, a web analytics service provided by Google LLC, to help us understand how visitors use the site: which pages are viewed, for how long, and how visitors arrived. Google Analytics sets cookies (such as _ga) and collects information including your approximate location, device and browser details, and pages visited. This information is processed by Google and may be stored on servers outside Australia, including in the United States.

We use this information in aggregate to improve the site. We do not use it to identify individual visitors, and we do not operate advertising or retargeting pixels. You can opt out of Google Analytics across all websites with the Google Analytics opt-out browser add-on, or by blocking cookies in your browser. For details of how Google handles this data, see Google’s privacy policy.

The platform itself sets cookies that are strictly necessary for it to work: keeping you signed in, maintaining your session, protecting against cross-site request forgery, and remembering interface preferences such as light or dark appearance. These cannot be disabled without preventing the platform from functioning.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Those steps include:

• Encryption in transit, and encryption at rest for stored data.
• Single sign-on only, so we hold no passwords that could be exposed.
• Logical separation of each customer’s data, with access controls that stop an administrator reaching another organisation’s records.
• Role-based access for our own staff on a least-privilege basis. Support access to a customer environment is explicit, time-boxed, visibly flagged, and recorded in an append-only audit log against the individual operator.
• Regular patching, backups, and monitoring of the systems that run the service.

No system is perfectly secure. If you believe your account or your organisation’s data has been compromised, contact us immediately at privacy@mysecurityeducation.com.

We maintain a data breach response plan. If we suspect a data breach, we assess it promptly and, where required, within 30 days.

If we form the view that a breach is an eligible data breach under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, meaning it is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable.

Where the affected information belongs to a customer’s workers, we will notify that customer without undue delay so they can meet their own obligations, and we will support their response.

We keep personal information only as long as we need it for the purposes described in this policy, or as required by law.

• Enquiries. Retained for up to 24 months from your last contact with us, then deleted, unless you become a customer.
• Training and compliance records. Retained for the life of the customer’s subscription. These records exist to evidence compliance, so they are not deleted at will during a subscription.
• Deleted users and organisations. Soft-deleted and recoverable for a defined retention window (30 days for users), after which they are permanently removed.
• Financial records. Retained for at least seven years, as required by Australian taxation law.
• Audit logs. Retained for the life of the subscription plus a reasonable period afterwards, because their evidential value depends on them not being editable or disposable.

On termination, we make a customer’s data available for export for the period set out in our agreement with them, then delete or de-identify it.

Under APP 12 and APP 13 you may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

Send requests to privacy@mysecurityeducation.com. We will need to verify your identity. We aim to respond within 30 days. Access is generally free; if a request is large or complex we may charge a reasonable cost-based fee, and will tell you before proceeding.

We may refuse access or correction in the limited circumstances permitted by the Privacy Act. If we do, we will tell you why in writing and how to complain.

Workers: where the information is your training record held on behalf of your employer, we will refer your request to your employer, who is best placed to respond.

Under APP 2 you may deal with us anonymously or under a pseudonym where it is lawful and practicable. In practice this is not possible where we need to respond to an enquiry, provide the platform, or maintain compliance records that must be attributable to an identified worker in order to serve their purpose.

We may send you information about our services where you have consented or where it is otherwise permitted. Every commercial electronic message we send includes a clear and functional unsubscribe facility, as required by the Spam Act 2003 (Cth), and we action unsubscribe requests promptly.

Service messages required to operate the platform, such as training assignment notices, reminders and billing notices, are not marketing and cannot be unsubscribed from while your account is active. Those settings are controlled by your organisation.

To opt out of marketing at any time, use the unsubscribe link or email privacy@mysecurityeducation.com.

If you think we have breached the APPs or mishandled your personal information, tell us first so we can try to fix it.

1. Email privacy@mysecurityeducation.com with the details, or write to the Privacy Officer at Sydney NSW, Australia.
2. We will acknowledge your complaint within 5 business days.
3. We will investigate and respond in writing within 30 days. If we need longer, we will tell you why and when to expect a response.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner: oaic.gov.au, or by phone on 1300 363 992.

We may update this policy from time to time. The current version is always published at https://mysecurityeducation.com/privacy, with its effective date and version shown at the top. Where a change materially affects how we handle your personal information, we will take reasonable steps to notify you in advance, such as by email or an in-platform notice.

Privacy Officer
Kuggar Pty Ltd
Sydney NSW, Australia

Email: privacy@mysecurityeducation.com
General enquiries: via the contact form

See also our Terms and Conditions.