Privacy Policy

01Who we are

Vantage is a crisis simulation platform operated by Difiza Pty Ltd (ACN 629 454 164), headquartered at 490 Northbourne Avenue, Dickson ACT 2602, Australia. In this policy we call ourselves "Difiza", "we", "us" or "our".

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy is our APP privacy policy.

02What this policy covers

This policy covers our public website, including the "Book a demo" form and the sign-in page.

When an organisation subscribes to Vantage, the data its people put into exercises is handled under that organisation's contract with us, including a data processing agreement. In that case we handle that information on the customer's behalf and as its contract allows. If you take part in an exercise run by your employer, contact them first about how your data is used.

03The data we collect

Information you give us

When you request a demo we collect:

• Name and work email address (required)
• Organisation and sector (optional)
• Anything you write in the message field

Please don't include sensitive or confidential information in the message. A short description of what you're looking for is enough.

If you email us directly, we'll have your email address, the content of your message and anything you choose to attach.

Information collected automatically

• IP address, used for a short time to apply rate limits and stop spam and abuse of the demo form.
• Standard server logs, such as the requested page, date and time, browser type and referring page. These are kept to run the site and investigate faults or attacks.
• Security signals, such as whether a form was submitted suspiciously quickly. These are used only to filter out automated submissions.

We do not use analytics, advertising pixels or third-party tracking on this website.

Anonymity

You can browse the website without telling us who you are. To arrange a demo we need your name and a way to contact you. If you'd rather not give these, you can still read about Vantage on this site.

Sensitive information

We don't ask for sensitive information, such as health information or political opinions, and we ask you not to include it in your message.

04How we use your data, and why

We use personal information only for the purposes we collected it for, or for related purposes you would reasonably expect:

We won't send you marketing emails unless you agree, as the Spam Act 2003 requires. Every marketing email will tell you who sent it and include a way to unsubscribe.

05Cookies and browser storage

We only use what is strictly necessary for the site to work. There are no advertising, analytics or tracking cookies.

Fonts, icons and page libraries are loaded from Google Fonts, jsDelivr and cdnjs (Cloudflare). Your browser connects to those services directly, so they receive your IP address and browser details as part of the request. They don't receive anything you type into our forms.

06Who we share data with

We don't sell or rent personal data. We share it only with service providers that help us run the website. Each works under a contract that limits how they can use it:

• Amazon Web Services (AWS): website hosting, and email delivery of demo requests through Amazon Simple Email Service.
• Google Workspace: our email service, which receives and stores the demo request emails sent to us.
• Content delivery networks: Google Fonts, jsDelivr and cdnjs, as described in section 5.

We may also share data where required by law, to protect our rights or the safety of others, or with a buyer or successor if our business is reorganised or sold. In that case the data stays protected under this policy.

07Disclosure overseas

Our website and platform are hosted in Australia, in the AWS Asia Pacific (Sydney) region. Some of our providers may still process information outside Australia, most likely in the United States. This includes the content delivery networks in section 5, and Google Workspace, which may store email in Google data centres outside Australia.

Before disclosing personal information overseas, we take reasonable steps under APP 8 to make sure the recipient handles it in a way consistent with the Australian Privacy Principles, usually through contract terms. You can ask us for more detail.

08How long we keep data

• Demo requests and related emails: up to 24 months after our last contact, unless you become a customer. If you do, the records then form part of the account relationship.
• Rate-limiting records: up to about 24 hours, stored in a hashed form rather than as your raw IP address or email address.
• Server and security logs: up to 90 days, unless needed longer to investigate a specific incident.
• Browser storage: controlled by you. Signing out or clearing your browser data removes it.

09How we protect your data

We use technical and organisational measures that suit the risk. These include encryption in transit, restricted access to systems, protection against form abuse, and keeping secrets and server code out of the public web root. Read more on our Security page.

No system is completely secure. If a data breach is likely to cause you serious harm, we'll notify you and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.

When we no longer need personal information for any purpose allowed by law, we take reasonable steps to destroy it or de-identify it.

10Access, correction and complaints

Under the Australian Privacy Principles you can:

• ask for access to the personal information we hold about you (APP 12)
• ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13)
• opt out of marketing at any time

To make a request, email us at the address below. We'll respond within 30 days. We may need to confirm your identity first, and we don't charge for making a request. If we refuse a request, we'll tell you why in writing and explain how to complain.

Making a complaint

If you think we've breached the Australian Privacy Principles, please contact us first. We'll acknowledge your complaint, look into it, and give you a response within 30 days.

If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

If you're in the UK or EU and their data protection laws apply to how we handle your information, you also have the rights those laws give you. Contact us to use them.

11Children

Vantage is a professional service for organisations. Our website is not aimed at children, and we don't knowingly collect data from anyone under 18.

12Changes to this policy

We may update this policy as our services or the law change. The date at the top shows when it was last revised. If we make significant changes, we'll make them clear on this page.

13Contact us