Privacy Policy

SentrySec is operated by MEVS Lab (ABN [37 992 008 784 ]) ("SentrySec", "we", "us", "our"). We are committed to protecting your privacy and handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy explains what personal information we collect, why we collect it, how we use and protect it, and the choices you have.

1. Who this policy applies to

SentrySec is business software used by security companies (our "Customers") to run their operations. Two groups are covered by this policy:

• Visitors and prospects — people who use our website or contact us about the product.
• Customer users and their personnel — administrators, guards and other staff whose information is entered into the platform by a Customer.

Where a Customer enters information about its guards, clients or sites into SentrySec, the Customer is responsible for that information and how it is used. We process it on the Customer's behalf under our agreement with them. If you are a guard or staff member and have a question about your information, contact your employer in the first instance.

2. Personal information we collect

Depending on how you interact with us, we may collect:

• Contact and enquiry information — name, company, work email, phone number, and details you provide when you request a demo or trial.
• Account information — names, email addresses and roles for users set up on the platform.
• Workforce information entered by Customers — guard names, security licence numbers and states, rostering and shift data, and employment-related details.
• Operational data — NFC checkpoint scans and associated location and time data, patrol records, and incident reports (including titles, categories, severity, location and timestamps).
• Customer and site records — client contacts, site addresses and related details entered by Customers.
• Billing information — invoicing details and payment records.
• Technical and usage information — IP address, device and browser information, log data, and how the platform is used, collected to keep the service secure and reliable.

We do not deliberately collect sensitive information unless it is necessary for a Customer's use of the platform and has been provided lawfully. Where sensitive information (such as certain licence or compliance data) is handled, we treat it with the additional care required under the APPs.

3. How we collect information

We collect information:

• directly from you when you contact us, request a trial, or create or use an account;
• from our Customers when they set up their operation and enter workforce, client and site data;
• automatically through your use of the platform (for example, checkpoint scans and system logs); and
• through standard web analytics and cookies on our website (see section 9).

4. Why we collect and how we use it

We use personal information to:

• provide, operate and improve the SentrySec platform;
• set up and manage accounts, trials and subscriptions;
• respond to enquiries and provide support;
• generate rosters, patrol reports, incident records and analytics for Customers;
• keep the service secure, detect and prevent misuse, and maintain audit trails;
• meet our legal, regulatory and contractual obligations; and
• send service-related communications and, where permitted, information about the product.

We only use information for the purposes for which it was collected, for a directly related purpose you would reasonably expect, or as otherwise permitted by law.

5. Disclosure of information

We do not sell personal information. We may disclose it to:

• Service providers who help us run the platform — most importantly Supabase, which hosts our database and application infrastructure, and other providers for hosting, email, analytics and payments. These providers act on our instructions and are bound to protect the information.
• A Customer, where the information relates to that Customer's operation.
• Law enforcement, regulators or others where required or authorised by law.
• A successor entity in connection with a business sale or restructure, subject to this policy.

6. Data location and cross-border disclosure

We host SentrySec data on servers located in Australia. Our infrastructure provider is Supabase, configured to store Customer data in an Australian region.

7. Security

We take reasonable steps to protect personal information from misuse, loss, and unauthorised access, modification or disclosure. Our measures include:

• encryption of data in transit and at rest;
• tenant isolation so each Customer's data is separated from others';
• access controls, authentication and audit logging;
• regular encrypted backups; and
• ongoing review of our security practices.

No system can be guaranteed completely secure. In the event of a data breach that is likely to result in serious harm, we will comply with our obligations under the Notifiable Data Breaches scheme, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

8. Retention

We keep personal information only for as long as necessary to provide the service, meet legal and contractual obligations, resolve disputes and enforce our agreements. When a Customer's account ends, we return or delete Customer data in line with our agreement with that Customer, unless we are required to retain it by law.

9. Cookies and analytics

Our website uses cookies and similar technologies to make the site work, remember preferences and understand how it is used. You can control cookies through your browser settings, though some features may not work correctly without them. We may use analytics tools to understand website traffic; where these use cookies, they are covered by this section.

10. Access and correction

You have the right to request access to the personal information we hold about you and to ask us to correct it if it is inaccurate, out of date or incomplete. To make a request, contact us using the details below. We will respond within a reasonable period. There is generally no charge, though we may recover reasonable costs for certain requests. In limited circumstances we may decline access as permitted by the APPs, and we will explain why.

If your information was entered by a Customer (for example, your employer), we may direct your request to that Customer.

11. Complaints

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please contact us first so we can investigate and respond. We will acknowledge your complaint promptly and aim to resolve it within a reasonable time.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

12. Changes to this policy

We may update this policy from time to time. The current version will always be available on our website, and the "Last updated" date at the top will reflect the latest change. Material changes will be communicated where appropriate.

13. Contact us

MEVS Lab — SentrySec
Privacy enquiries: [info@sentrysec.com.au]
[0421000233]

If you have any questions about this policy or how we handle your information, please get in touch.