Please read this policy alongside your product details or written service agreement. Your statutory rights remain protected, and updates do not retrospectively change existing agreements.
Scope
This policy describes requirements for handling authorised client information. Specific controls are agreed according to project risk and verified system capabilities. It does not claim ISO 27001, SOC 2 or other independent certification. Ordinary enquiries are not a secure project-upload channel.
Access and credentials
Agree named authorised users, least-privilege access and secure configurations. Use multifactor authentication where supported and appropriate. Credentials use agreed secure sharing or delegated access, never ordinary enquiry fields. Client-controlled systems retain their own access responsibilities.
Information and sharing
Collect only information necessary for the scope. Use approved channels and recipients, minimise or de-identify data where appropriate, and avoid public links for confidential files. Providers and subcontractors are assessed for relevant access, confidentiality, location and retention arrangements.
Ownership and confidentiality
Client data remains the client’s and is used only for authorised purposes. No sale, public demonstration, unrelated reuse, case studies or AI training without authority. Confidentiality obligations are mutual, subject to lawful exceptions and required disclosure.
Incidents
Report suspected incidents promptly. The response includes appropriate containment, scope and risk assessment, evidence preservation and coordinated communication. Project contacts and notification responsibilities are agreed in writing. Applicable breach notification duties are followed; no guaranteed detection or universal incident-response time is promised.
Retention and handover
Agree legal retention needs, backup limitations and return or deletion requirements. On completion, provide agreed deliverables, remove unnecessary temporary access and document remaining retained information. Immediate deletion from every backup or client-controlled system is not guaranteed. Confidentiality continues for information that remains confidential.
Project-specific agreements
Work involving substantial personal or sensitive information may require a separate data-processing agreement and security schedule. Contact us about concerns before sending sensitive evidence. Nothing in this policy excludes, restricts or modifies consumer guarantees, rights or remedies that cannot lawfully be excluded. Australian Consumer Law and any other applicable mandatory protections remain in effect.
Contact & related policies
For questions, requests or concerns, email connect@bergmetric.com.au. Please do not include passwords, payment card details or sensitive project records in an initial email.