Privacy Statement
Intuitive IT’s Privacy Policy
About this policy
This policy explains how Intuitive IT Pty Ltd (ABN 55 164 249 825) collects, uses, shares and protects personal information, as required by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
It covers everything we do as a business: managed IT, cyber security and consulting services, web design, web hosting and app development, domain registration, and recruitment. It applies to all our websites and portals, including intuitiveit.com.au, ai.intuitiveit.com.au, appdevelopment.intuitiveit.com.au, webdesignmelbourne.co, our domain registration site, and our support portals (including help.iit.net.au).
When we say "we", "us" or "Intuitive IT", we mean Intuitive IT Pty Ltd, Level 18, 1 Nicholson St, East Melbourne VIC 3002.
This policy takes effect on 1 November 2026 and replaces our previous policy dated 25 May 2018.
The personal information we collect
What we collect depends on how you deal with us.
| If you are… | We may collect |
|---|---|
| A client contact or decision-maker | Name, job title, organisation, email, phone, billing details, and records of our dealings with you |
| A member of a client's staff | Name, work contact details, role, user account details, device and login information, support requests and what you write in them, and the results of security services we run for your employer (see below) |
| A website visitor | Pages viewed, how you use them, device and browser details, location (city or country), and where you came from (see "Our websites, cookies and tracking") |
| A marketing contact or event attendee | Name, organisation, contact details, your interests, and which of our emails you open or click |
| A domain name customer | Registrant name, organisation, contact details and payment details, as required by domain registries |
| A job applicant | Your application, CV, work history, screening answers (including right to work, expected salary and experience), and online assessment results (see "Automated decisions") |
| A supplier or partner | Name, organisation, contact and payment details |
We don't ask for sensitive information, such as health information or racial or ethnic origin, unless it's needed for a specific purpose and you agree. We may come across it in a client's systems while providing services; we treat that the same way as everything else we access there.
Our websites and services aren't intended for children under 16.
How we collect it
Most information comes directly from you: when you contact us, log a support request, fill in a form on our websites, sign an agreement, register a domain, attend an event or apply for a job.
We also collect information from others:
- Your employer, if your organisation is our client. They give us your details so we can set up and support your accounts and devices.
- Our clients' systems, while we manage and secure them (see the next section).
- Recruitment platforms: SEEK, where you apply, and TestGorilla, where you complete our assessments.
- Website and advertising tools that record how our sites are used (see "Our websites, cookies and tracking").
- Public sources and business contacts, such as LinkedIn profiles and referrals.
Information we didn't ask for. If we receive personal information we didn't ask for, such as an unsolicited CV or an email sent to us by mistake, we check whether we could have collected it ourselves. If we couldn't, we destroy or de-identify it as soon as practicable, unless the law requires us to keep it.
Government identifiers. We don't use government-related identifiers, such as tax file numbers, Medicare numbers or driver licence numbers, to identify you in our own systems. If we come across them in a client's systems, we handle them only as needed to provide our services.
Information in our clients' systems
When we manage an organisation's IT, we can access its systems and the personal information in them, including staff email, files, user accounts and devices. We access it only to provide the services our client has engaged us for, and we treat it as confidential.
That work includes:
- Remote support and monitoring. Our software lets technicians see device status and, when supporting you, view and control your screen.
- Security monitoring. We monitor security and event logs, and watch user accounts and devices for signs of compromise.
- Dark web monitoring. We check whether staff email addresses or passwords appear in known data breaches, and report findings to the client.
- Security awareness testing. We send simulated phishing emails to staff and record who opens, clicks or reports them. We share the results, including names, with the client. If you click a simulated phishing link, our platform automatically assigns you a short training module. How your employer uses the results is up to them.
- Backups and account administration, including archiving the email and files of staff who leave.
If you work for one of our clients and have a question about your information in their systems, please contact your employer first. They decide what is collected and how it's used; we act on their instructions.
How we use personal information
We use personal information to:
- provide, support and secure the services our clients engage us for
- respond to enquiries and support requests
- manage our client relationships, including agreements, invoicing and payments
- register and manage domain names
- run and improve our websites and services
- send marketing about our services, where you've agreed or would reasonably expect it
- assess job applicants
- meet our legal obligations and protect our rights
We use AI tools in some of this work, including to read and triage support requests and to help our technicians find answers in our knowledge base. We record and may transcribe some video meetings using Zoom; we'll tell you when a meeting is being recorded.
We don't use personal information to train AI models. Our AI provider processes support requests under commercial terms that don't allow it to train its models on our data. If you have concerns about AI tools processing your support requests, contact us at [email protected] and we'll discuss your options.
We don't sell personal information.
We take reasonable steps to keep personal information accurate, up to date and complete, such as confirming contact details with our clients when staff join or leave, and updating our records when you tell us something has changed.
Automated decisions
We use computer programs to make, or substantially shape, some decisions about people. This section explains which decisions, and what information they use.
Applying for a job with us
Our job ads ask applicants to apply through SEEK and to complete online assessments through TestGorilla.
Information used: your answers to our screening questions about your right to work in Australia, your expected salary and your experience; your work history; and your TestGorilla results. Those results cover your personality traits (a "Big Five" or OCEAN test), how well you fit the role, your problem-solving ability and your time management. While you complete the assessments, TestGorilla may take webcam images and record activity such as whether you leave the test window, to check the integrity of the results.
Decisions made automatically: some answers to our SEEK screening questions end an application automatically. If your answer doesn't meet a requirement we've set for the role, your application is marked unsuccessful and you're sent an email telling you so. Nobody at Intuitive IT reviews applications closed this way.
Decisions where software plays a substantial role: TestGorilla scores your results and ranks you against other applicants. A person at Intuitive IT decides who to interview, but those scores are the main thing they rely on. We may also take TestGorilla's integrity checks into account.
Getting support from us
Information used: your name and contact details, your organisation and its service agreement with us, and what you tell us in your support request, including your description of the problem and anything you attach.
Decisions where software plays a substantial role: our service management system automatically gives priority to requests from organisations on agreements with guaranteed response times. An automated triage tool also reads your request and proposes how urgent it is. A member of our team reviews the urgency of every request, but the tool's assessment is what they start from. Together, these affect how quickly your request is handled.
Security awareness training
Information used: whether you opened, clicked or reported a simulated phishing email.
Decisions made automatically: if you click a simulated phishing link, our platform automatically assigns you a short training module. No person is involved in that step.
If you think a decision was wrong
Contact us at [email protected] and a person will look at it.
Our websites, cookies and tracking
We use these tools on our websites to understand how they're used and to advertise our services:
- Google Analytics measures visits, pages viewed and where visitors came from.
- Mouseflow records how visitors use a page, including clicks, scrolling and mouse movement, and produces heatmaps. Text typed into form fields is masked.
- HubSpot is our marketing and customer relationship system. If you fill in a form or click a link in one of our emails, HubSpot links your visits to your contact record, so we can see which pages you've viewed.
- LinkedIn Insight Tag lets LinkedIn show our ads to people who have visited our sites, and measure how those ads perform. LinkedIn may match your visit to your LinkedIn account.
These tools use cookies and similar technologies. You can block or delete cookies in your browser settings, opt out of Mouseflow at mouseflow.com/opt-out, and manage ad preferences in your LinkedIn account settings. Some parts of our sites may not work properly if you block cookies.
To stop receiving marketing emails, use the unsubscribe link in any email or contact us.
Who we share it with
We share personal information only as needed for the purposes above, with:
- the service providers and software platforms we use to run our business and deliver our services
- vendors we deal with on a client's behalf, such as internet, hosting and telephony providers, when the client has authorised us
- domain name registries and their administrators, as needed to register and manage domains
- your employer, for information about you collected through services we provide to them, such as phishing simulation results
- our professional advisers, such as lawyers and accountants
- a buyer of, or merger partner in, all or part of our business, and their advisers
- government agencies, regulators or law enforcement, where the law requires or allows it
Sending information overseas
Our people are all based in Australia, and no one outside Australia accesses our clients' data. Some of the services we use store or process information outside Australia:
- United States: our endpoint security platform; our phishing simulation and security awareness platform; the AI service our support tools use (Anthropic's Claude), which reads the content of support requests and our knowledge base; and our website analytics, session recording, marketing and advertising tools (Google, Mouseflow, HubSpot and LinkedIn).
- European Union: the online assessments job applicants complete (TestGorilla).
Our service management and backup platforms, and our video meeting platform (Zoom), store information in Australia. Before using an overseas service, we check that it protects personal information to a standard comparable to Australian privacy law.
Security, data breaches and retention
We protect personal information with access controls, multi-factor authentication, encryption where appropriate, security monitoring, and staff training. Access is limited to people who need it for their work.
We build privacy into how we design systems, for ourselves and our clients: we collect only what we need, limit who can access it, and assess privacy risks before introducing new tools, including AI tools.
If we become aware of a data breach involving personal information, we act quickly to contain it and assess the risk of harm. Where the Notifiable Data Breaches scheme requires it, we notify the people affected and the Office of the Australian Information Commissioner. If the breach involves a client's systems, we work with the client to do this.
We keep personal information only as long as we need it for the purposes in this policy, or as the law requires. After that, we delete or de-identify it. Information in a client's systems is kept, returned or deleted in line with our agreement with that client.
Your choices, access and complaints
Access and correction. You can ask for a copy of the personal information we hold about you, or ask us to correct it, by contacting our Privacy Officer. We may need to confirm your identity first, and there's no charge to make a request. We'll respond within 30 days. If we can't give you access or don't agree to a correction, we'll explain why in writing and tell you how to complain.
Anonymity. You can deal with us without giving your name, or by using a pseudonym, for example when asking a general question about our services. For most services, such as support or domain registration, we need to know who you are.
Marketing. You can opt out of marketing emails at any time using the unsubscribe link or by contacting us.
Complaints. If you're concerned about how we've handled your personal information, contact our Privacy Officer. We'll acknowledge your complaint, look into it, and respond in writing within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Contact us
Privacy Officer: Yener Adal, Managing Director
Email: [email protected]
Phone: 1300 269 551
Post: Privacy Officer, Intuitive IT Pty Ltd, PO Box 4145, Balwyn East VIC 3103
Changes to this policy. We review this policy regularly and will publish any changes on this page, with the date they take effect.