EYwALINK logo EYWA·LINK
中文
Legal

Privacy Policy

Last updated: 2026-10-05

Overview

EYwALINK ("we", "us", "our") is committed to protecting your personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). This policy explains how we collect, use, store, and protect your personal data when you interact with our website, engage our services, or communicate with us about AI solutions.

This policy describes EYwALINK's handling of personal information for website visitors and prospects. For engagements processing personal data, the Data Processing Agreement (DPA) executed under the Master Services Agreement governs the detailed processor obligations. Request a copy via our contact page.

1. Information We Collect

Directly Provided

  • Name and contact details (email address, phone number)
  • Company name and job title (if provided)
  • Project requirements and enquiry messages

Automatically Collected

  • IP address and approximate geographic location
  • Browser type and device information
  • Pages visited (via self-hosted, first-party analytics — see §7)

2. How We Use Your Information

  • Respond to your enquiries and deliver consulting services under signed engagement agreements
  • Send project updates and invoices to signed clients
  • Improve our website through aggregated, anonymised analytics
  • Comply with legal obligations and regulatory requirements

3. Data Processing Roles

Under the Privacy Act 1988 (Cth), the roles EYwALINK and you play in data processing depend on the context:

Website Visitors and Prospects

  • EYwALINK is the APP entity (controller). We determine the purposes and means of collecting, using, and storing the personal information you provide through our website or communications.

Client Engagements

  • You are the APP entity (controller); EYwALINK is the processor, acting on your documented instructions.
  • For engagements processing personal data, a Data Processing Agreement (DPA) is executed alongside the Master Services Agreement. The DPA details processor obligations, security controls, sub-processor restrictions, and data-subject-rights procedures.

This role distinction is consistent with MSA Section 7 (Data Protection and Privacy).

4. Data Storage & Security

Enquiry data is stored, encrypted at rest, and backed up securely. Client engagement data is processed on client-controlled infrastructure by default (air-gapped, network-isolated, or the client's cloud). Where EYwALINK holds client data, it is encrypted at rest (AES-256) and in transit (TLS 1.3). Your personal information is not shared with third parties without your consent, except as required by law.

5. Data Retention

  • Website enquiries: 24 months after last contact
  • Client engagement records: 7 years post-engagement (tax and statutory compliance)
  • Client data processed during engagements: retained only for the engagement duration, then returned or securely destroyed within 14 days
  • Analytics data: aggregated only; anonymised after 14 days

Longer retention applies only where a law or regulatory obligation requires it.

6. Your Rights

Under the APPs, you may:

  • Access your personal data
  • Request correction of inaccurate information
  • Request deletion (subject to retention obligations)
  • Opt out of marketing communications at any time
  • Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

APP 12 — Access

  • Submit a written request to info@eywalink.org with identification.
  • EYwALINK responds within 30 days. No fee.

APP 13 — Correction

  • Submit a correction request to info@eywalink.org.
  • EYwALINK takes reasonable steps to correct within 14 days and notifies third-party recipients of the correction where practicable.

For client engagements, data handling rights are detailed in the Data Processing Agreement (DPA) executed under the Master Services Agreement.

7. Cookies & Analytics

EYwALINK uses two self-hosted analytics tools running on its own infrastructure: Umami (primary, fully cookieless) and Matomo (secondary, kept during cutover). Both are first-party only — they set no third-party cookies, perform no cross-site tracking, and collect no personal data that can identify individual visitors. Matomo may set a first-party, non-personal visitor cookie; Umami sets none. Only aggregated, anonymised usage statistics (page views, referral sources, approximate geographic region) are collected. No Google Analytics, no Facebook Pixel, no other third-party tracking. No personally identifiable data is sent to external services.

8. AI Model Data Handling

EYwALINK's services involve AI models. Our approach to AI data handling:

  • Training data: Data used to fine-tune a model for a client belongs exclusively to that client and is processed in isolated compute environments with no cross-engagement leakage.
  • Inference data: Data submitted to AI models is processed in real-time and not persisted unless explicitly required. For self-hosted models on client infrastructure, no inference data is transmitted to EYwALINK.
  • Vector stores: Embeddings and vector indices are stored on client-controlled infrastructure under the client's security controls.
  • Model weights: Fine-tuned model weights belong to the client. EYwALINK does not retain model weights after delivery.
  • Model provenance: EYwALINK uses open-source AI models only (no proprietary models such as OpenAI, Anthropic, or Google). A Software Bill of Materials (SBOM) is provided with each engagement deliverable. See AI Data & Model Handling.

9. Cross-Border Data Transfers

EYwALINK primarily processes data within Australian infrastructure. Cross-border transfers occur only where explicitly required by a client engagement and authorised under the DPA, in accordance with APP 8.

10. Notifiable Data Breaches

EYwALINK is subject to the Notifiable Data Breaches (NDB) Scheme. Where an eligible data breach occurs, EYwALINK assesses the breach, notifies affected individuals and the OAIC without unreasonable delay, and cooperates with client notification obligations.

Governing Law

This Privacy Policy is governed by the laws of Victoria, Australia. In the event of inconsistency, the following hierarchy applies:

  • The DPA governs for data protection and privacy matters under a specific engagement;
  • The MSA governs for general engagement terms, including Section 7 (Data Protection and Privacy);
  • This Privacy Policy governs for website visitors and prospects not under an engagement.

Contact

Privacy enquiries: info@eywalink.org. General enquiries: info@eywalink.org.