01Who this covers
This policy applies to VYCAN Consulting, ABN 30 307 496 690, a registered sole trader delivering HRIS system integration, automation and data work remotely across Australia and New Zealand. It covers this website and the consulting work we do.
Personal information means information about an identified individual, or an individual who is reasonably identifiable, as defined in the Privacy Act 1988 (Cth).
02Our commitment
As a small business, VYCAN Consulting may fall within the small business exemption in the Privacy Act 1988 (Cth).
We do not rely on that exemption. We have chosen to handle personal information in accordance with the Australian Privacy Principles, because the work involves employee records and payroll data and our clients are entitled to expect that standard regardless of our size.
03What this website collects
Nothing directly. This is a static website. It sets no cookies, uses no local or session storage, runs no analytics or tracking, and contains no forms of any kind. There is no account to create and no newsletter to join. We do not know who visits this site.
Two indirect exceptions are worth naming plainly.
Fonts
The typefaces on this site are served by Google Fonts. Your browser requests them from fonts.googleapis.com and fonts.gstatic.com, which means Google receives your IP address and browser details in order to serve the files. We receive nothing from this and have no access to it. Google's handling of that request is governed by its own privacy policy.
Hosting logs
This site is hosted on Cloudflare. Like any web host, Cloudflare keeps standard server logs, which can include IP addresses, request times, pages requested and user agent. These are generated by the hosting infrastructure for delivery, security and abuse prevention. We do not use them to build a profile of you and we do not combine them with anything else.
04When you email us
The only way this site invites contact is a plain email link. If you email us, we receive whatever you choose to put in that email — commonly your name, your email address, your employer, and a description of your systems or the problem you are trying to solve.
We use it to reply, to work out whether an engagement makes sense, and to prepare a scope if it does. We do not add you to a mailing list, and we do not have one.
Our email is hosted on Microsoft 365. Please do not send employee records, extracts or credentials by email when making an enquiry. They are not needed at that stage, and a secure channel is agreed as part of the scope before any real data moves.
05Employee data in an engagement
This is where the meaningful personal information sits. An HRIS integration moves records about a client's employees — names, employee numbers, contact details, position and cost centre, employment dates, leave, and payroll and banking details.
Those people are our client's employees, not our customers. Our client decides what is collected and why. We handle that information on their behalf, under their instructions, and only as the written scope for the engagement requires.
We work inside your systems, not ours. Credentials are held in your tenancy rather than ours, code is delivered into your repository, and integrations run on your infrastructure. Our standing position is that we do not take copies of employee data out of client environments.
Where a specific task genuinely requires a data extract — a migration rehearsal, or reproducing a defect that only appears with real values — it is agreed in writing first, kept to the smallest set that answers the question, held only for as long as that task takes, and destroyed when it is done.
If you are an employee of one of our clients and have a question about your own record, your employer is the right first contact. They control the record. We will support any request they pass to us.
06Sensitive information
Some engagements touch information the Privacy Act treats as sensitive, or that carries elevated risk. In HRIS work this can include health information where a client operates in the care sector, tax file numbers, bank account details, and information revealing union membership or a person's background.
We do not seek this information out. Where an interface has to carry it, it is identified in the field map at scope, moved only between the systems the client has told us to connect, and never used for any other purpose. Tax file numbers are handled in accordance with the TFN Rule issued under the Privacy Act.
07How we use information
We use personal information only to:
- reply to an enquiry and work out whether we can help
- prepare, price and agree a scope of work
- build, test, reconcile and support the integrations that scope describes
- meet our legal, tax and record-keeping obligations
We do not sell personal information. We do not disclose it for anyone else's marketing. We do not use client data to train machine learning models, and we do not put client employee data into third-party AI services.
08Who we disclose it to
VYCAN Consulting is a sole trader. There are no employees or subcontractors, so day to day there is nobody else to disclose anything to. We may disclose personal information:
- to the client whose information it is, or to a party that client directs us to
- to the systems named in the scope, because moving records between them is the work
- to our professional advisers, where they are bound by confidentiality
- where we are required or authorised by law to do so
09Overseas disclosure
We do not deliberately send personal information overseas. Two ordinary pieces of infrastructure mean information can nonetheless be handled outside Australia:
- website font delivery and hosting, as described in section 03, which involves providers operating globally
- our email, which is hosted on Microsoft 365
Where a client's own systems store data overseas, that is determined by the client's arrangements with that vendor, not by us.
10Security
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. In practice that means multi-factor authentication on the accounts we use, encrypted devices, credentials held in your tenancy rather than ours, access requested at the least privilege the task needs, and access surrendered when an engagement ends.
No method of transmission or storage is completely secure. If we reasonably believe an eligible data breach has occurred, we will act in accordance with the Notifiable Data Breaches scheme and tell the affected client without delay so they can meet their own obligations.
11How long we keep it
Enquiry correspondence is kept while a conversation is live and for a reasonable period afterwards, then deleted.
Engagement records — scope documents, field maps, runbooks and correspondence — are kept for as long as we need them to support the work and to meet our legal and tax obligations, which for business records in Australia is generally at least five years.
Any working extract of client employee data is destroyed as soon as the task that justified it is finished, as described in section 05.
12Access and correction
You can ask what personal information we hold about you, ask for a copy, and ask us to correct it if it is wrong. Email us and we will respond within a reasonable period, normally 30 days.
We may need to verify who you are before we release anything. If we refuse a request we will tell you why in writing. Where the information belongs to a client's records rather than ours, we will refer you to that client, who is the right party to decide.
13Complaints
If you think we have mishandled your personal information, email us with the details. We will acknowledge your complaint, investigate it, and write back to you with an outcome — normally within 30 days.
If you are not satisfied with how we handle it, you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au.
14Changes
We may update this policy. The version published here is the current one, and the date at the top of this page shows when it last changed.
15Contact
Privacy questions, access requests and complaints all go to contact@vycanconsulting.com.au.
See also our terms of use.