How BB84 Dynamics handles your personal information.
Effective 4 October 2026
This policy explains how BB84 Dynamics Group Pty Ltd (ACN 699 393 292) ("BB84 Dynamics", "we", "us") handles personal information. Part A applies to everyone. Parts B, C and D add rights that apply where you live.
1.1 This policy covers personal information we collect through this website, through direct contact with us, and in the course of our business. It does not cover information held inside a customer's own deployment of our software. In those deployments the customer controls the environment, holds the keys, and is the controller of that information. We cannot read it.
1.2 "Personal information" means information that identifies you, or could reasonably be used to identify you, directly or indirectly.
2.1 Information you give us. Your name, your organization, your email address, and anything you write in the message field of our contact form or send to us directly.
2.2 Information collected automatically when you visit this website. Browser type, operating system, approximate location derived from your IP address, the pages you viewed, and the site you arrived from. This is used in aggregate.
2.3 We do not collect payment card details, government identifiers, or special category information through this website.
3.1 Directly from you, when you complete a form, email us, speak to us, or meet us. Automatically, through standard web server logs. Occasionally from third parties, such as a mutual introduction or a public business register. Anything we receive from a third party is protected under this policy.
4.1 To respond to your enquiry and arrange a briefing. To provide and administer our products and services. To send you information you have asked for. To improve our website and our products. To meet our legal and regulatory obligations.
4.2 We will contact you by email, telephone or post. If you ask us to stop, we stop.
5.1 To our own people, advisers, insurers and service providers, only where they need it to do the work. To a regulator, court or law enforcement agency where the law requires it. To a prospective purchaser, under confidentiality, if our business or its assets are ever sold.
5.2 Where we disclose personal information to a third party, we require them to protect it consistently with this policy.
6.1 We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use it for targeted advertising. We do not profile you, and we make no automated decisions that produce legal or similarly significant effects.
7.1 We keep personal information only for as long as it serves the purpose it was collected for, or for as long as the law requires us to keep it, and then we delete it.
8.1 We apply physical, technical and administrative measures to protect personal information against loss, misuse, interference, and unauthorized access, modification or disclosure.
8.2 No transmission over the internet can be guaranteed to be secure. You send information to us at your own risk, and while we take the measures described above, we cannot guarantee the security of information in transit.
9.1 We may use cookies to understand how this site is used and to improve it. Cookies are small files a site stores in your browser. They are not programs and they cannot damage your device. Most browsers accept them by default and you can refuse them in your browser settings, though parts of this site may then work less well.
9.2 We do not use cookies for advertising, and we do not run advertising networks on this site.
10.1 This site may link to sites we do not own or control. Those links are for your convenience and are not an endorsement. We are not responsible for the privacy practices of other sites, and we encourage you to read their privacy statements.
11.1 We may update this policy. Changes take effect when we post them here. The effective date at the top of this page tells you when it last changed.
12.1 To ask a question about this policy, to exercise any right set out below, or to make a complaint, use the form on this website, or write to us at BB84 Dynamics Group Pty Ltd, Level 11, 40 Marcus Clarke Street, Canberra ACT 2601, Australia.
12.2 We may need to verify your identity before we act on a request. We will not ask for more information than we need to do that.
13.1 We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
14.1 You may ask us for the personal information we hold about you, and you may ask us to correct it if it is wrong, out of date, incomplete, irrelevant or misleading. Contact us as set out in clause 12. We may refuse a request in the limited circumstances the Privacy Act allows, and if we do we will tell you why.
15.1 If you believe we have mishandled your personal information, contact us first as set out in clause 12 and we will investigate. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.
16.1 If you are a resident of a United States state with a comprehensive consumer privacy law, including California, Virginia, Colorado, Connecticut, Utah and Texas among others, you have the following rights, subject to the exceptions in your state's law:
16.1.1 to know what personal information we have collected about you, where we got it, why we collected it, and who we disclosed it to;
16.1.2 to obtain a copy of that information in a portable form;
16.1.3 to have it corrected if it is inaccurate;
16.1.4 to have it deleted;
16.1.5 to opt out of the sale of personal information, of sharing for cross-context behavioral advertising, and of profiling for decisions that produce legal or similarly significant effects;
16.1.6 to limit the use of sensitive personal information; and
16.1.7 not to be discriminated against for exercising any of these rights. We will not deny you a service, charge you a different price, or give you a lower quality of service because you exercised a right under this part.
17.1 As stated in clause 6, we do not sell personal information, we do not share it for cross-context behavioral advertising, we do not use it for targeted advertising, and we do not profile you. There is accordingly nothing for you to opt out of. If that ever changes, we will update this policy and provide the opt-out mechanisms the law requires before the change takes effect.
17.2 We do not knowingly collect or process the personal information of anyone under 16, and we do not sell or share the personal information of minors.
18.1 Submit a request using the form on this website, or in writing to the address in clause 12. You may use an authorized agent where your state's law allows it, and we may ask that agent to prove their authority.
18.2 We will respond within the period your state's law allows, and we will tell you if we need an extension and why.
18.3 If we refuse your request, you may appeal by contacting us again and saying that you are appealing. We will respond to the appeal in writing with our reasons. If we refuse the appeal, you may complain to your state Attorney General.
19.1 Where we process the personal information of individuals in the European Union or the United Kingdom, we do so in accordance with the General Data Protection Regulation and the UK GDPR. Our full GDPR statement, including our lawful bases, your rights, and how we handle international transfers, is set out in our GDPR Policy, which forms part of this policy.
19.2 In summary, you have the right to be informed, to access your personal information, to have it corrected or erased, to restrict or object to its processing, to data portability, and not to be subject to automated decision making. You may also complain to your supervisory authority.
20.1 We operate in Australia and the United States, and personal information covered by this policy may be stored or processed in either country. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on the standard contractual clauses approved by the European Commission or the UK equivalent.
20.2 This clause concerns information we hold. It does not apply to a customer's own deployment of our software, where the customer determines the jurisdiction and we hold nothing.