Privacy policy.

Who we are

Tenet CTO is a Velo Group company. This policy explains how we collect, hold, use and disclose personal information, and how you can access or correct it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What we collect

We collect only what we need to respond to you and to deliver an engagement:

• Contact details you give us, such as your name, email address, phone number, organisation and role.
• What you tell us when you ask about an engagement, such as the decision in front of your board and any dates that matter.
• During an engagement, the information you or your organisation provide for the work, which may include personal information held in your systems, code or documents.
• Billing details needed to invoice your organisation.
• Technical information our hosting provider processes when you visit this site, such as IP address, browser type and the pages requested.
• Usage information collected by Google Analytics, such as the pages you view, how you arrived at the site, your device and browser, and your approximate location.

You can contact us without giving your name, or under a pseudonym, but we will usually need a name and an email address to reply or to engage.

How we collect it

Most information comes directly from you: by email, in a consultation, or in the documents and access you provide during an engagement. We do not buy personal information or collect it from data brokers.

Cookies and analytics

We use Google Analytics to understand how visitors use this site, so we can improve it. Google Analytics sets cookies in your browser and sends usage information to Google, which processes it on our behalf. We use the reports in aggregate. We do not use them to identify you, and we do not combine them with other information we hold about you.

We do not use advertising cookies or remarketing, and Google Analytics advertising features are turned off. Our hosting provider, Cloudflare, also sets strictly necessary cookies to protect the site from abuse and to deliver the analytics, and keeps short-lived request logs for security and performance.

You can block or delete cookies in your browser settings, or install the Google Analytics opt-out browser add-on. The site works the same either way. How Google uses information from sites that use its services explains Google’s handling.

How we use it

• To reply to your enquiry and arrange a consultation.
• To scope, deliver and sign off an engagement, and to keep the records that support the work.
• To invoice and to meet our tax, accounting and other legal obligations.
• To keep this site and our systems secure.
• To understand how visitors use this site and to improve it.

We do not sell personal information, and we do not use it for direct marketing without your consent. Any marketing email we send carries a way to unsubscribe.

We do not use personal information in decisions made by a computer program that could significantly affect your rights or interests.

Who we disclose it to

We disclose personal information only where it is needed for the purposes above, or where the law requires it. Recipients may include:

• Service providers who host this site and our email, documents and working tools, under confidentiality and data-handling terms.
• Google, which provides Google Analytics.
• Partners in the practice who contribute to an engagement, under the same confidentiality obligations as we are.
• Our professional advisers, such as accountants, lawyers and insurers.
• Regulators, courts or law enforcement where the law requires it.

Client data used in an engagement is held only in approved zero-retention enterprise tooling and is never used to train models. How we use AI sets out what that tooling does.

Information held outside Australia

Some of our service providers store or process information outside Australia, including in the United States. Google Analytics data is processed and stored by Google, including in the United States. Before we use a provider, we take reasonable steps to make sure it handles personal information to a standard consistent with the Australian Privacy Principles.

Security and retention

We protect personal information with access controls, multi-factor authentication, encryption in transit and at rest where our providers support it, and access limited to the people working on your matter.

We keep engagement records for as long as we need them to support the advice we gave and to meet our legal obligations, typically 7 years. When information is no longer needed, we delete or de-identify it. At the end of an engagement, client data is returned or deleted as the engagement letter sets out.

Access and correction

You can ask for access to the personal information we hold about you, or ask us to correct it, by emailing contact@tenetcto.com. We will respond within 30 days. If we refuse a request, we will tell you why in writing and how to complain.

Complaints

If you think we have mishandled your personal information, email contact@tenetcto.com with the details. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

We review this policy when our practices or the law change. The current version is always on this page, with the date it was last updated.