Privacy Statement

SCOPE OF THIS VERSION This Statement covers Australia and India. Material addressing the General Data Protection Regulation, UK GDPR, standard contractual clauses, New Zealand and Singapore is held in a dormant annexure and is not part of this Statement. Where a customer in another jurisdiction is contracted, a separate addendum is required.

1. Who we are

Pyron is operated by Techly Operations Pty Ltd ACN 649 834 506, ABN 97 649 834 506. Pyron intellectual property is owned by Techly Holdings Pty Ltd ACN 649 834 275 and licensed exclusively to Techly Operations Pty Ltd, which may sublicense only as expressly authorised under that licence.

The Data Protection Officer is a director of Techly Operations Pty Ltd and may be contacted at Teams@techly.au.

2. What this Statement covers

• Personal information you give us directly — enquiries, account registration, support requests, and our websites.
• Personal information recorded in a Pyron tenant by one of our customers. For that information, our customer decides what is collected and why. We process it on their instructions. If you are asking about your own record in a customer's tenant, contact that organisation first.

3. The two roles we hold

Information	Our role	What it means
Customer Data — Entries, forms, attachments and everything recorded in a customer tenant	Processor. Data Processor under India's DPDP Act 2023.	We act on the customer's instructions. We do not decide what is collected, we do not use it for our own purposes, and we do not delete or move it without instruction.
Platform-Generated Data — Audit Trail records, system logs, telemetry	Controller	We decide the purpose. This data is owned by Techly Holdings Pty Ltd.
Derived Data and Aggregated De-identified Data	Controller	Customers may opt out of contributing to aggregated data. The election is recorded on their Order Form.
Our own business contacts, enquiries and website visitors	Controller	Handled under this Statement in the ordinary way.

The Privacy Act 1988 (Cth) uses the term APP entity rather than controller and processor. We use those terms here because they are required by Indian law and expected in procurement. Using them does not reduce our obligations under the Privacy Act.

4. What we collect and why

Purpose	Information
Providing Pyron	Account identifiers, authentication data, role and permission assignments, activity records
Support	Contact details, correspondence, and the information you give us about an issue
Security and audit	Audit Trail records, access logs, IP address at the point of authentication, device information
Billing and administration	Contact and billing details of customer personnel
Enquiries and marketing	Name, organisation, contact details, and the content of your enquiry

5. Where your information is held

Pyron is hosted by Amazon Web Services in Australia. Customer Data, meaning the records, forms, files and attachments in a tenant, together with its Audit Trail and its backups, is stored in the AWS Asia Pacific (Melbourne) region, with a copy of the database's backups in the AWS Asia Pacific (Sydney) region, and some services run in the Sydney region. Credentials a customer keeps in the Pyron Vault are stored, encrypted, in the same Australian environment. Pyron AI runs on Amazon Bedrock within Australia. Google Cloud Platform is no longer used for production or backup workloads.

A few of our service providers process limited information outside Australia. Our network provider carries traffic and renders pages at its data centres, normally the one nearest the user, without guaranteeing an Australian location, and keeps Customer Data only while processing it. Our authorisation provider holds user names, email addresses, roles and access decisions in the United States. Our error-reporting provider holds error reports, which can contain fragments of the data being processed, in the European Union. Browser automation is optional and nothing uses it by default; where a customer sets up an automation that uses it, the remote browser runs in the United States. Each provider, what it receives and where, is listed in Part 6. We remain accountable under the Privacy Act 1988 (Cth) for how each overseas recipient handles personal information we disclose to it.

6. Who we share it with

• Service providers who process data on our behalf, listed in the bullets that follow. Changes to this list are recorded in the revision history of this Statement.
• Amazon Web Services: hosting, storage, backups, email delivery, single sign-on and the Amazon Bedrock service used by Pyron AI. All Customer Data. Australia.
• Cloudflare: network security and delivery, page rendering and the running of customer automations. Traffic and data in transit, kept only while it is processed. Its data centre nearest the user, normally in Australia but not guaranteed.
• Grafana Labs: operational logs, metrics and traces. Technical records of how the service is running. Australia.
• Permit.io: authorisation. A random identifier for each person, which does not identify them to Permit.io, and their role assignments. Until 26 October 2026 it also received people's names and email addresses and the names of places in a workspace, and its records made before then may hold them until Permit.io deletes them under its own retention. United States.
• Functional Software (Sentry): error reporting. Error reports, which can contain fragments of the data being processed. European Union.
• Steel: remote browsers for browser automation, an optional feature that nothing uses by default and that runs only where a customer sets up an automation to use it. The pages visited, what is entered into them (which can include sign-in details the customer keeps in the Pyron Vault for that site) and saved sign-in sessions for those sites. United States.
• All Quiet and Slack: alerting our on-call staff. Alert text, which may name an affected workspace. Outside Australia.
• All Quiet: Pyron's status page, status.pyron.io, and its email updates. The email address and time zone of each person who subscribes to status updates, and nothing from a workspace. A subscriber can unsubscribe at any time, and their details are then deleted. United States.
• Google (Google Workspace): our email, including enquiries sent through our websites and support correspondence. The content of those messages. Google's data centres, which may be outside Australia.
• Anthropic: AI assistance for our engineers. When our engineers investigate a fault, the diagnostics they review (error reports, logs and query results) can contain fragments of Customer Data, and the assistant processes them. Anthropic does not use this data to train its models. United States.
• Where required or authorised by law, or to a law enforcement or regulatory body acting within its powers.
• We do not sell personal information and we do not disclose it for another party's marketing.

7. Pyron AI

• Pyron AI is supplied through Amazon Bedrock using Anthropic Claude models.
• Customer Data is not used to train foundation models and is not shared with the model provider for training.
• Inference runs on Amazon Bedrock in Australia, through Bedrock's Australian cross-region profile, which keeps each request within the Sydney and Melbourne regions.
• Pyron AI operates inside the platform's permission model. It sees only what the person asking is already permitted to see, and its activity is recorded in the Audit Trail like any other actor.
• Anything Pyron AI would delete, publish, send, or use to grant access waits for the approval of the person it is acting for, with a preview of what it will do. Other changes it makes on that person's behalf are recorded in the Audit Trail as made by Pyron AI.

8. Automated decisions

Some processing in our platforms happens without a person involved at the point of action. We describe it here because from 10 December 2026 the Privacy and Other Legislation Amendment Act 2024 (Cth) requires it, and because we would rather tell you than have you discover it.

What happens	Information used	Effect on you
LogSec licence validation. A security licence is checked against the Victoria Police Licensing and Regulation Division.	Name, licence number and status.	A failed check prevents sign-on to a shift. We supply the validation result; your employer makes the employment decision, and their supervisor process is the route to human review.
Automation engine business rules. Rules configured by our customer attach workflows, route and prioritise records, advance stages and trigger notifications.	Whatever the customer records in the Entry, which may include your name, role, location and activity.	Depends on how the customer has configured it. The customer decides what those rules do and is responsible for providing a route to human review.
AI steps in automations. An automation configured by our customer may ask Pyron AI to read, classify, summarise or draft from a record without a person present.	Whatever the automation is configured to read, which may include your name, role, location and activity.	Depends on how the customer has configured it. The customer decides what the automation does with the result and is responsible for providing a route to human review.
Pyron AI	Data the asking person is permitted to see.	None directly. Pyron AI acts only with the permissions of the person asking, and anything it would delete, publish, send or use to grant access waits for that person's approval.

9. How long we keep it

• Audit Trail records: 24 months.
• Customer Data: as configured by the customer, and for the subscription term. On termination, a 30-day export window, then deletion within 90 days. Backup sets are deleted on their normal rotation and remain encrypted and inaccessible until then.
• Security logs, meaning records of activity on our cloud accounts and infrastructure: 12 months. Application logs: up to 30 days. Error reports: up to 90 days.
• Enquiries and business contacts: 24 months from our last contact with you, or sooner if you ask us to remove them.

10. Security

Encryption at rest to AES-256, and in transit over public networks to a minimum of TLS 1.2. Multi-factor authentication for privileged access. Structural access enforcement through the platform's permission engine, whose default answer is no. An Audit Trail of every change, kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident.

11. If something goes wrong

We notify an affected customer of a suspected or confirmed security incident affecting their data without undue delay and no later than 48 hours. Where personal information is involved we assess whether an eligible data breach has occurred under Part IIIC of the Privacy Act 1988 (Cth), within 30 days and sooner where we can, and notify the Office of the Australian Information Commissioner and affected individuals where the test is met. Where we act as processor, the customer notifies the individuals.

12. Our websites

• Our websites use only essential cookies, and we do not run analytics on them. Inside Pyron, operational monitoring records page performance and errors so that we can find and fix faults: performance data is held by Grafana Labs in Australia, and error reports by Sentry in the European Union.
• That monitoring sets no cookie, builds no profile of you and is not used for advertising. Because of that, we do not show a cookie banner. If we ever add a non-essential or third-party tag, we will introduce a consent mechanism before doing so.
• Details are in the Pyron Cookie Policy.

13. Marketing

We send marketing only to people who have opted in. We send product and service updates to existing customers on the basis of that business relationship. Every commercial electronic message identifies us and carries a working unsubscribe.

14. Your rights

• You may ask for access to, or correction of, personal information we hold about you as controller. Write to Teams@techly.au. We acknowledge within 5 business days and respond within 30 days. If we refuse access we tell you why, in writing, and how to complain.
• Where your information sits in a customer's tenant, contact that organisation. We will help them respond, but we will not respond on their behalf without their instruction.
• If you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner.

15. India

• Where we offer services to Data Principals in India, the Digital Personal Data Protection Act 2023 applies regardless of where data is hosted.
• For Customer Data, our customer is the Data Fiduciary and we are a Data Processor.
• Our Grievance Officer is a director of Techly Operations Pty Ltd, contactable at Teams@techly.au. We acknowledge a grievance within 3 business days and resolve it within 15 days.
• We do not knowingly process the personal data of a person under 18 without verifiable parental consent, and we do not use personal data for tracking or behavioural advertising directed at children.

16. Changes

We update this Statement when our processing changes. Material changes are notified to customers and recorded in the revision history below. The version and effective date appear on the first page.

17. Contact

Techly Operations Pty Ltd, 15A Alden Court, Cheltenham VIC 3192. Teams@techly.au.

Revision history

Version	Date	Author	Change
2.0	Aug 2026	Techly Operations Pty Ltd	Drafted; not issued. 48 confirmation markers.
2.1	14 Aug 2026	Techly Operations Pty Ltd	Issued. All confirmation markers closed. Residency restated per tenant. Automated decision-making disclosed at Part 8 ahead of the 10 December 2026 commencement. Analytics recorded as self-hosted and first-party. India Grievance Officer function added. Scope reduced to Australia and India, with other jurisdictions moved to a dormant annexure.
2.2	25 Oct 2026	Techly Operations Pty Ltd	Re-issued after a check against production. Hosting restated (Melbourne, with some services in Sydney) and the designated-region wording removed. Service providers named with what each receives and where, including those outside Australia. AI inference and AI approval restated. AI steps in automations disclosed at Part 8. Audit Trail retention stated as 24 months and its protection described as it operates. Log retention restated. Website analytics withdrawn (none are run) and operational monitoring described.
2.3	26 Oct 2026	Techly Operations Pty Ltd	Google Workspace and Anthropic added to the service providers in Part 6. Enquiries and business contacts kept 24 months from last contact, matching the Website Terms.
2.4	26 Oct 2026	Techly Operations Pty Ltd	Permit.io restated: it now receives a random identifier for each person and their roles, and what it held before is described. A copy of the database's backups in the AWS Sydney region added to Part 5. All Quiet added to Part 6 for status-page subscribers.

Approval

Aden McCusker – Director – Techly Operations Pty Ltd

Date: [to be signed]

Jagjit Prithpal Saluja – Director – Techly Operations Pty Ltd

Date: [to be signed]

Pyron intellectual property is owned by Techly Holdings Pty Ltd and licensed exclusively to Techly Operations Pty Ltd, which may sublicense only as expressly authorised under that licence.

Enquiries: Teams@techly.au