Techly Data Protection and Privacy Policy

Purpose

This policy sets out how Techly Operations Pty Ltd (Techly) meets its obligations for personal information: under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the Notifiable Data Breaches scheme, and India's Digital Personal Data Protection Act 2023 where it applies. What Techly tells the public is in the Privacy Statement. This policy is how Techly makes sure it is true.

Scope

All personal information Techly handles, in Pyron and on its websites, whoever it is about: the people in a customer's workspace, a customer's staff, guests, enquirers and Techly's own staff.

The two roles Techly holds

• Processor, for Customer Data. The records, forms, files and everything else a customer keeps in its workspace. Techly acts on the customer's instructions. It does not decide what is collected, does not use it for its own purposes, and does not delete or move it without instruction.
• Controller, for its own information. Audit Trail records, system logs and telemetry; derived and aggregated de-identified data; and its own business contacts, enquiries and website visitors.

The Privacy Statement's Part 3 sets these roles out in full, and this policy follows it.

The rules Techly follows

• Collect only what is needed. Pyron and the websites collect what is needed to provide the service, support it, keep it secure, and answer enquiries, and nothing else.
• Use it only for that purpose. Customer Data is used to provide Pyron to the customer that holds it. It is not used to train AI models, Techly's or anyone else's, and it is not sold or used for marketing. De-identified, aggregated data is handled as Part 3 of the Privacy Statement says, and a customer may opt out of contributing to it.
• Staff access is for a reason. Techly staff, Pyron Support included, look at Customer Data only to give the support the customer asked for, to investigate a fault or an incident, or to operate the service. What Support views and changes is recorded on the workspace's audit trail.
• Tell people first. A change that adds a service provider, a new kind of personal information, or a new place where it is processed is not switched on in production until the Privacy Statement says so.
• Keep it secure. Personal information is protected as the Techly Information Security Policy and the Techly Data Classification Policy require.
• Keep it only as long as needed. Retention follows the Techly Records Management Policy.
• Marketing by consent. Techly sends marketing only to people who have opted in, and every commercial message identifies Techly and carries a working unsubscribe.

Overseas recipients

Customer records and files are stored in Australia, and Pyron AI runs in Australia. A few service providers handle limited information outside Australia, and Part 6 of the Privacy Statement names each one, what it receives and where.

• Before a new provider receives personal information, Techly assesses it under the Techly Supplier and Third-Party Security Policy and lists it in the Privacy Statement.
• Techly remains accountable under the Privacy Act for how each overseas recipient handles the personal information Techly discloses to it.

Requests from individuals

• A request to access or correct personal information Techly holds as controller goes to Teams@techly.au. Techly acknowledges it within 5 business days and responds within 30 days, and a refusal is given in writing with the reason and how to complain.
• A request about a record in a customer's workspace is referred to that customer, who decides. Techly helps the customer respond, and does not respond on its behalf without its instruction.
• For people in India, the Grievance Officer, a director of Techly, acknowledges a grievance within 3 business days and resolves it within 15 days.

Data breaches

A suspected or confirmed incident involving personal information is handled under the Techly Incident Management Policy.

• Techly notifies an affected customer without undue delay and no later than 48 hours.
• Techly assesses whether an eligible data breach has occurred under Part IIIC of the Privacy Act within 30 days, and sooner where it can. Where the test is met, it notifies the Office of the Australian Information Commissioner and the affected individuals.
• Where Techly acts as processor, the customer notifies the individuals, and Techly gives it what it needs to do so.
• Every assessment is recorded, including those that find no eligible data breach.

Automated decisions

From 10 December 2026, a privacy policy must describe decisions made by computer programs that could significantly affect a person. Part 8 of the Privacy Statement lists the automated processing in Techly's platforms, and the Pyron AI and Automated Processing Statement explains how Pyron AI handles data and what a customer may need to say in its own privacy policy.

Who is responsible

• The Data Protection Officer, a director of Techly, owns this policy, keeps the Privacy Statement accurate, handles requests and complaints, and decides on notifying a data breach.
• The Technical Director makes sure Pyron and its providers handle personal information as this policy says, and tells the Data Protection Officer before a change to what is processed or where.
• Staff follow this policy and report anything that might be a breach straight away.

Review

The Data Protection Officer reviews this policy every year with the Privacy Statement, and sooner when the law, Pyron's processing or its providers change.