Privacy Policy

1 · Purpose

This policy sets out how Nxt7a collects, uses, discloses, stores and protects personal information, in line with Australian privacy law and the privacy expectations of those we serve.

2 · Scope

Applies to personal information Nxt7a handles about staff, clients, partners, prospects and website/app users, in any system, globally. A separate public-facing privacy notice is derived from this policy for individuals.

3 · Policy Statements

Compliance baseline. Nxt7a handles personal information consistent with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), and with other data-protection laws applicable where individuals or operations are located.

Collection. We collect only the personal information we reasonably need, by lawful and fair means, and tell individuals what we collect and why.

Use and disclosure. Personal information is used for the purposes it was collected for, or related purposes the individual would reasonably expect, and is not sold. Disclosure to third parties (e.g. processors) is governed by contract and the Supplier Code of Conduct.

Consent and choice. Where consent is the basis for handling personal information, it is sought clearly. Individuals can ask to access or correct their information.

Security. Personal information is protected under the Information Security, Access Control and Data Classification policies, encrypted and access-controlled per its sensitivity.

Cross-border. Where personal information moves across borders (e.g. cloud regions, a distributed team), we take reasonable steps to ensure it remains protected.

Retention. Personal information is kept only as long as needed and then securely disposed of (per Data Classification & Retention).

Breaches. Privacy incidents are handled under the Incident Response Policy, including Notifiable Data Breaches obligations.

Indigenous data. Personal and community information relating to Indigenous peoples is additionally governed by the Data Sharing & Indigenous Data Sovereignty Policy.

4 · Roles & Responsibilities

• Privacy Officer / Information Security Officer oversees privacy compliance and handles requests and complaints.
• All personnel handle personal information per this policy.
• CEO is accountable and engages counsel ([COO or delegate]) on significant matters.

5 · Compliance, Monitoring & Breach

Privacy complaints and requests are logged and responded to within required timeframes. Mishandling is a breach handled under the Code of Conduct.

6 · Related Documents

Information Security Policy · Data Classification & Retention Policy · Access Control Policy · Incident Response Policy · Supplier Code of Conduct · Data Sharing & Indigenous Data Sovereignty Policy.

7 · Standards Mapping

• B Corp: Customers.
• ISO/IEC 27001:2022: A.5.34 (privacy and protection of PII).
• ISO/IEC 42001:2023: A.7 (data for AI systems, where personal data is used).
• Statutory: Privacy Act 1988 (Cth) and the APPs; applicable international data-protection laws.

Review note. A public-facing privacy notice and any required APP-5 collection notices need drafting and legal review with [COO or delegate]. If we handle EU/UK personal data, assess GDPR/UK GDPR obligations separately.

8 · Version History