Data Policy

Last updated: 3 June 2025

1. Purpose and Scope

This Data Policy sets out how Edge4Ward Pty Ltd ("Edge4Ward", "we", "us") collects, stores, processes, and protects data — including personal information, client data, and operational data — in the course of operating our business and delivering professional services.

This policy applies to all Edge4Ward employees, contractors, and representatives; all data systems managed or operated by Edge4Ward; and data processed on behalf of clients as part of service delivery. This policy should be read alongside our Privacy Policy and Terms of Use.

2. Types of Data We Handle

Personal Information

Information relating to identified or identifiable individuals, including contact details, employment information, and usage data. Handling is governed by the Privacy Act 1988 (Cth) and our Privacy Policy.

Client Data

Data provided to us by clients in the course of service delivery, which may include business records, system data, employee information, financial data, or other proprietary information. This data remains the property of the client at all times.

Operational Data

Data generated in the operation of our own systems, including logs, analytics, system performance data, and internal business records.

Sensitive Data

Certain engagements may involve sensitive categories of data including health information, financial records, or government identifiers. Additional safeguards apply as described in Section 6.

3. Data Collection and Processing Principles

Edge4Ward is committed to the following principles in all data handling activities:

• Lawfulness: Data is collected and processed only on a lawful basis.
• Purpose limitation: Data is collected for specified, explicit, and legitimate purposes.
• Data minimisation: We collect only data adequate, relevant, and limited to what is necessary.
• Accuracy: We take reasonable steps to ensure data is accurate and up to date.
• Storage limitation: Data is retained only as long as necessary for its purpose.
• Integrity and confidentiality: Data is processed with appropriate security measures.

4. Client Data

Where Edge4Ward processes data on behalf of a client as part of a service engagement:

• We act as a data processor and process client data only in accordance with the client's documented instructions
• We do not use client data for any purpose other than delivering the contracted services
• We do not disclose client data to third parties without the client's prior written consent, except where required by law
• Upon termination of the engagement, we return or securely destroy client data in accordance with the relevant services agreement
• We maintain appropriate records of all processing activities involving client data

5. Data Storage and Infrastructure

Edge4Ward uses industry-leading cloud infrastructure providers for data storage and processing. Primary data residency is in Australia.

• Amazon Web Services (AWS) — Australian regions (ap-southeast-2)
• Microsoft Azure — Australian East / Southeast regions
• Google Cloud Platform — Australian regions where applicable

All infrastructure providers are selected based on their security certifications, data residency capabilities, and compliance with applicable Australian standards.

6. Data Security Controls

Technical Controls

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256 or equivalent
• Multi-factor authentication (MFA) for all systems accessing client or sensitive data
• Role-based access control (RBAC) with least-privilege principles
• Continuous monitoring and alerting via SIEM tools
• Regular vulnerability assessments and penetration testing

Organisational Controls

• Mandatory security awareness training for all staff and contractors
• Background checks for personnel handling sensitive or classified data
• Information security policies reviewed at least annually
• Incident response plan tested at least annually
• Vendor security assessments for all sub-processors

7. Data Retention and Deletion

We retain data for the minimum period necessary. General retention periods include:

• Client engagement records: 7 years after end of engagement
• Financial and tax records: 7 years
• Website enquiry data: 2 years from date of enquiry
• Website analytics data: 26 months
• Staff and contractor records: 7 years after employment ends

Upon expiry of the applicable retention period, data is securely deleted or de-identified using industry-standard methods.

8. Sub-Processors and Third Parties

Edge4Ward may engage third-party sub-processors to assist in delivering services. All sub-processors are subject to a prior security and privacy assessment, contractual data protection obligations, and limitations on the use of data solely for authorised purposes. A list of key sub-processors is available on request.

9. Data Breach Response

In the event of a data breach:

• We will assess the nature and scope of the breach within 24 hours of detection
• Affected clients will be notified within 72 hours where required by law or where the breach is likely to result in serious harm
• We will notify the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches (NDB) scheme where required
• We will take immediate steps to contain, remediate, and prevent recurrence
• A post-incident review will be conducted within 30 days of resolution

To report a suspected security incident: security@edge4ward.com.au

10. Cross-Border Data Transfers

Where data is transferred outside Australia, Edge4Ward takes reasonable steps to ensure the receiving party provides equivalent data protection to that required under Australian law. For clients subject to the GDPR, Edge4Ward can provide appropriate transfer mechanism documentation including Standard Contractual Clauses (SCCs).

11. Your Rights as a Data Subject

Subject to applicable law, individuals whose personal data we hold have the right to access, correct, delete, restrict processing of, and port their data, as well as the right to object to certain processing and to withdraw consent. To exercise any of these rights, contact our Privacy Officer (see Section 12). We will respond within 30 days.

12. Contact and Governance

Edge4Ward's data governance function is overseen by our Privacy Officer.

• Privacy Officer, Edge4Ward Pty Ltd
• Level 20, 1 Market Street, Sydney NSW 2000, Australia
• Privacy: privacy@edge4ward.com.au
• Security incidents: security@edge4ward.com.au
• Phone: +61 2 XXXX XXXX

This Data Policy is reviewed and updated at least annually. The current version is always available at this URL.