- Proactive IT Support
- Advanced Cyber Security
- Local Perth Team
- Book Your Free Consultation
Privacy Policy
1. About This Privacy Policy
itX365 Pty Ltd (“itX365”, “we”, “us” or “our”) respects the privacy of our clients, prospective clients, website visitors, suppliers and other individuals whose personal information we handle.
This Privacy Policy explains how we collect, hold, use, disclose, protect and manage personal information.
itX365 provides information technology and communications services including:
- managed IT services;
- Microsoft 365 management;
- cybersecurity services;
- cloud and virtual server hosting;
- website hosting;
- online and offsite backup services;
- internet and NBN services;
- business telephone and VoIP services;
- domain registration and DNS management;
- hardware and software procurement;
- remote and onsite technical support; and
- related IT and communications services.
In providing these services, we may handle personal information belonging to our clients, their employees, customers, suppliers and other individuals.
We aim to manage personal information consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where they apply to us.
2. What Is Personal Information?
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.
Depending on our relationship with you, this may include information such as:
- your name;
- business name;
- job title;
- business and personal email addresses;
- telephone and mobile numbers;
- postal or business address;
- account and contact details;
- billing information;
- correspondence with us;
- support requests and ticket information;
- device and system information;
- usernames and account identifiers;
- IP addresses;
- website usage information; and
- other information reasonably necessary to provide our services.
We do not intentionally collect personal information that we do not reasonably require.
3. Information We Collect Directly
We may collect personal information directly from you when you:
- contact us by telephone, email, website form or another communication method;
- request a quotation or proposal;
- become a client;
- submit a support request;
- communicate with our service desk;
- purchase a product or service;
- register or transfer a domain;
- request an internet or telecommunications service;
- provide information for a Microsoft 365 or cloud service;
- visit our premises;
- correspond with our staff;
- make a payment;
- subscribe to communications from us; or
- otherwise interact with itX365.
Where practical, we collect personal information directly from the person concerned.
4. Information We May Receive From Clients
As a managed IT and communications provider, itX365 may receive personal information from our business clients.
For example, a client may provide us with information about its employees or users so that we can:
- create user accounts;
- configure Microsoft 365;
- establish email accounts;
- configure telephone extensions;
- provide remote access;
- set up computers;
- administer security;
- manage backups;
- troubleshoot technical problems;
- onboard or offboard employees; or
- otherwise provide contracted IT services.
In these circumstances, we generally handle the information for the purpose of providing services to our client.
Clients are responsible for ensuring that personal information they provide to itX365 has been collected and disclosed lawfully.
5. Information We May Access While Providing IT Support
Because of the nature of managed IT services, authorised itX365 personnel may occasionally have technical access to systems containing personal, confidential or commercially sensitive information.
Depending on the services we provide, this may include systems such as:
- Microsoft 365;
- Exchange Online;
- email mailboxes;
- OneDrive;
- SharePoint;
- Teams;
- computers and laptops;
- physical and virtual servers;
- network devices;
- firewalls;
- backup systems;
- hosted servers;
- websites;
- databases;
- business telephone systems;
- cloud applications; and
- other client IT systems.
Technical access does not mean that itX365 routinely reads, reviews or uses the contents of client data.
Our personnel should access client systems and information only to the extent reasonably necessary to provide support, administration, monitoring, security, backup, troubleshooting or other authorised services.
For example, a technician troubleshooting an email delivery problem may need to examine message headers, mail-flow information or relevant messages. A technician investigating a file-access problem may need to access relevant folders or permissions.
Where practical, access is limited to what is reasonably required to perform the task.
6. Administrative and Privileged Access
Some IT services require itX365 to hold or use administrative privileges.
These may include:
- Microsoft 365 administrative access;
- server administrator accounts;
- network administration credentials;
- firewall administration;
- domain and DNS administration;
- backup administration;
- hosting control-panel access; and
- other privileged technical accounts.
We use administrative access for legitimate purposes associated with delivering and securing contracted services.
Where appropriate, we use security measures such as separate administrative accounts, multifactor authentication and access restrictions to protect privileged access.
7. Support Tickets and Communications
When you contact our service desk, we may retain information including:
- your name;
- organisation;
- email address;
- telephone number;
- description of the issue;
- correspondence;
- screenshots;
- attachments;
- system information;
- diagnostic information;
- actions taken by our technicians; and
- resolution notes.
This information forms part of our service records and may be retained for operational, security, contractual, billing and historical support purposes.
Please avoid including unnecessary sensitive personal information in support requests.
8. Technical and Device Information
When we manage or support IT systems, our monitoring and management tools may collect technical information including:
- device names;
- usernames;
- operating-system information;
- software inventory;
- hardware specifications;
- serial numbers;
- IP addresses;
- network information;
- security status;
- patch status;
- antivirus or endpoint-security status;
- system health;
- performance information;
- event and diagnostic logs;
- backup status; and
- other technical information necessary to manage the environment.
Some technical information may constitute personal information where it can reasonably be associated with an identifiable individual.
9. Website Information
When you visit our website, certain technical information may be collected automatically.
This may include:
- IP address;
- browser type;
- device type;
- operating system;
- referring website;
- pages visited;
- approximate location derived from network information;
- date and time of access; and
- website interaction information.
We may use cookies and similar technologies to help our website function, understand website usage, improve performance and measure the effectiveness of our website.
Where third-party analytics, security, anti-spam or similar services are used, those providers may also process information in accordance with their own privacy practices.
10. Cookies
Cookies are small data files that websites may store on a device.
Our website may use cookies that are necessary for website functionality as well as cookies or similar technologies used for security, analytics or performance.
You can generally configure your browser to reject or delete cookies.
Disabling certain cookies may affect some website functionality.
Where required by applicable law, we will obtain appropriate consent before using non-essential cookies or similar technologies.
11. Why We Collect and Use Personal Information
We may collect, hold and use personal information for purposes including:
- providing IT and communications services;
- responding to enquiries;
- preparing quotations and proposals;
- providing technical support;
- administering client accounts;
- monitoring managed systems;
- managing cybersecurity;
- configuring and administering cloud services;
- providing hosting and backup services;
- provisioning internet and telecommunications services;
- registering and managing domains;
- supplying hardware and software;
- processing payments;
- issuing invoices;
- maintaining business and service records;
- managing our relationship with clients and suppliers;
- communicating service information;
- improving our services;
- investigating security incidents;
- detecting fraud or misuse;
- meeting legal and regulatory obligations;
- resolving disputes; and
- protecting our clients, staff, systems and business.
We may also use contact information to communicate with existing or prospective clients about services that we reasonably believe may be relevant to them, subject to applicable marketing and privacy laws.
12. Direct Marketing
We may occasionally send clients or prospective clients information about itX365 products, services, security matters or technology developments.
Where required, we will provide a reasonable way to opt out of marketing communications.
You may ask us at any time not to send you direct marketing communications.
Operational communications, security alerts, service notifications, invoices and other communications necessary for an existing service relationship are not treated as optional marketing communications.
13. When We May Disclose Personal Information
We do not sell personal information.
We may disclose or make personal information available where reasonably necessary to provide our services or operate our business.
Recipients may include:
- employees and authorised contractors;
- cloud-service providers;
- Microsoft and other software providers;
- telecommunications carriers and wholesalers;
- internet service providers;
- data-centre and hosting providers;
- backup-service providers;
- cybersecurity providers;
- domain registrars and registries;
- hardware distributors and manufacturers;
- payment and accounting providers;
- professional advisers;
- insurers;
- government or regulatory authorities where required; and
- other service providers necessary to deliver the requested service.
We seek to limit disclosures to information reasonably necessary for the relevant purpose.
14. Third-Party Technology Providers
Many services supplied or managed by itX365 rely on third-party technology providers.
For example, a Microsoft 365 service necessarily involves information being processed within Microsoft’s infrastructure. Internet, telecommunications, backup, hosting, security and domain services may similarly require information to be processed by the applicable provider.
Those providers may operate their own infrastructure and may have their own privacy policies and contractual obligations.
Where itX365 selects a provider on behalf of a client, we endeavour to use reputable providers appropriate for the service being supplied.
Where the Client selects or directs us to use a particular third-party provider, the Client should also consider that provider’s privacy and security practices.
15. Overseas Processing and Disclosure
Some technology and cloud-service providers used by itX365 operate infrastructure or support services outside Australia.
As a result, personal information may in some circumstances be stored, accessed, processed or disclosed outside Australia.
The countries involved depend on:
- the particular service;
- the provider selected;
- the Client’s configuration;
- data-residency options offered by the provider;
- the location of support personnel; and
- the provider’s infrastructure arrangements.
Where practicable and required by applicable privacy law, itX365 will take reasonable steps in relation to overseas disclosure of personal information.
Because cloud and technology providers may operate distributed global infrastructure and change their service locations over time, it may not always be practicable to identify every country in which information may be processed.
Where the location of data processing is important to a Client because of legal, contractual or regulatory requirements, the Client should notify itX365 before purchasing or implementing the relevant service so that appropriate data-residency requirements can be considered.
16. Client Data Hosted by itX365
Where itX365 hosts data on behalf of a business client, the data remains the Client’s data subject to the applicable service agreement.
We do not acquire ownership of a Client’s business data merely because it is stored on infrastructure supplied or managed by itX365.
We may access hosted data where reasonably necessary to:
- maintain the service;
- troubleshoot problems;
- perform backups or recovery;
- investigate security issues;
- comply with authorised Client instructions; or
- comply with legal obligations.
17. Backup Data
Where itX365 provides backup services, copies of Client data may be stored within backup infrastructure.
Backup data may contain personal information originally collected by the Client.
Backup retention periods depend on the backup service purchased and its configuration.
Deletion of information from a live system does not necessarily cause the information to be immediately removed from existing backup copies.
Backup information will generally expire according to the applicable retention schedule.
18. Security of Personal Information
itX365 takes reasonable steps to protect personal information we hold from misuse, interference, loss, unauthorised access, modification and disclosure.
Depending on the information and system involved, security measures may include:
- multifactor authentication;
- access controls;
- privileged account management;
- endpoint security;
- firewalls;
- network security;
- email security;
- encryption;
- secure remote-access tools;
- monitoring and alerting;
- backups;
- software patching;
- security policies; and
- staff access restrictions.
No computer system, internet connection, cloud service or security technology can be guaranteed to be completely secure.
Accordingly, while we take reasonable security precautions, we cannot guarantee that unauthorised access, cyberattack or data loss will never occur.
19. Data Breaches
itX365 maintains processes for responding to suspected data breaches.
Where we become aware of a suspected breach involving personal information, we may take steps to:
- contain the incident;
- investigate what occurred;
- assess the information affected and potential harm;
- take appropriate remedial action; and
- make notifications where required by applicable law.
Where the Notifiable Data Breaches scheme under the Privacy Act applies and an eligible data breach has occurred, itX365 will comply with applicable notification requirements.
Where an incident relates primarily to information held on behalf of a Client, we may work with that Client and relevant service providers to investigate and respond appropriately.
20. Retention of Personal Information
We retain personal information for as long as reasonably necessary for the purposes for which it was collected, including to:
- provide services;
- maintain service and support history;
- meet contractual obligations;
- maintain accounting and taxation records;
- resolve disputes;
- maintain security records; and
- comply with legal requirements.
Different types of information may have different retention periods.
When personal information is no longer reasonably required and we are not legally required or otherwise entitled to retain it, we will take reasonable steps to destroy or de-identify it where appropriate.
Client data held in hosting and backup systems may be subject to the retention and termination provisions contained in the applicable service agreement and our Terms & Conditions.
21. Access to Personal Information
You may request access to personal information that itX365 holds about you.
Please provide sufficient information for us to identify you and locate the relevant information.
We may need to verify your identity before providing access.
In some circumstances, Australian privacy law permits or requires us to refuse access to some information. If that occurs, we will generally explain the reason where we are permitted to do so.
22. Correction of Personal Information
We take reasonable steps to ensure personal information we use is accurate, current and appropriate for its intended purpose.
If you believe personal information we hold about you is inaccurate, incomplete or out of date, please contact us.
We will take reasonable steps to correct information where appropriate.
23. Requests Concerning Client-Controlled Information
Sometimes itX365 holds or can technically access personal information solely because we provide IT services to another organisation.
For example, an individual’s personal information may be contained within a Client’s Microsoft 365 environment, server or backup system.
In those circumstances, the Client may be the organisation primarily responsible for deciding how that information is handled.
If you contact itX365 seeking access to or correction of information controlled by one of our clients, we may refer your request to that Client or require its authorisation before accessing, changing or releasing the information.
This helps prevent unauthorised disclosure or alteration of Client information.
24. Privacy Complaints
If you believe itX365 has mishandled your personal information or breached your privacy, please contact us.
Privacy Contact
itX365 Pty Ltd
61 Leach Way
Gnangara WA 6077
Australia
Telephone: (08) 6144 4200
Please provide sufficient details for us to understand and investigate your concern.
We will acknowledge and investigate privacy complaints within a reasonable period and will endeavour to resolve them directly with you.
If you are not satisfied with our response and applicable privacy law gives you the right to do so, you may be able to make a complaint to the Office of the Australian Information Commissioner (OAIC).
25. Links to Other Websites
Our website may contain links to websites operated by third parties.
itX365 is not responsible for the privacy practices, security or content of third-party websites.
You should review the privacy policy of a third-party website before providing personal information to it.
26. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- changes to our services;
- changes to our technology providers;
- changes to our information-handling practices;
- legal or regulatory changes; or
- changes to our business operations.
The current version will be published on our website and will show the date it was last updated.
We encourage you to review this Privacy Policy periodically.
27. Contact Us
For questions, access or correction requests, privacy concerns or complaints, please contact:
itX365 Pty Ltd
ABN 53 665 391 104
61 Leach Way
Gnangara WA 6077
Australia
Telephone: (08) 6144 4200
Website: itx365.com.au
Last updated: 7 October 2026