ergonomicoffice Pty Limited (“we”, “us”, “our”) is committed to safeguarding customer information, protecting personal and confidential data, and maintaining appropriate cyber security controls across our systems, staff and operations.
This Security & Cyber Protection Policy explains:
This policy supports our obligations under:
This policy should be read together with our Privacy Policy, which explains how we collect, use, disclose and retain personal information.
We take reasonable technical and organisational steps to protect the confidentiality, integrity and availability of information held by ergonomicoffice, whether stored electronically or in hard-copy form.
Depending on the systems and information involved, our security controls include:
Our security arrangements are reviewed as our systems, technology and risk environment change.
ergonomicoffice does not store complete customer credit card numbers within its ordinary business systems.
Online card payments are processed through Eway, a payment gateway certified to PCI DSS Level 1.
Eway provides secure payment processing, encryption, tokenisation and fraud-prevention capabilities.
Full credit card numbers are not retained within ergonomicoffice customer, accounting or order records and are not available to staff through our ordinary business systems.
Payment security is a shared responsibility. We maintain appropriate security over our website, devices, accounts and business systems in addition to the controls provided by our payment gateway.
Information transmitted through our website is protected using HTTPS/TLS encryption.
Website and application security measures may include:
Website and application security arrangements are reviewed with our technology providers as platforms and risks change.
ergonomicoffice maintains cyber security controls appropriate to its size, systems, information holdings and risk environment.
Our approach is informed by relevant Australian cyber security guidance and by any additional contractual requirements applying to particular customers or projects.
Controls may include:
Access to business systems is restricted according to legitimate business requirements.
Controls include:
We use established third-party providers for services including:
We consider security, privacy and information-handling arrangements when selecting and managing providers that may handle customer information.
Some providers may process or store information outside Australia.
Where personal information is disclosed overseas, we take reasonable steps where required under the Australian Privacy Principles to ensure that it is handled appropriately.
Further information is provided in our Privacy Policy – Overseas Storage and Cross-Border Disclosure.
Staff are expected to protect customer and company information and to follow internal information-handling requirements.
This includes:
ergonomicoffice maintains operational separation between its core customer information systems and its use of generative AI tools.
Generative AI tools are not given direct access to our core customer databases, order records, accounting records or customer account information.
Company policy prohibits the intentional entry, upload or sharing with generative AI systems of personal identifying information including:
The same principle applies to confidential or commercially sensitive customer material including:
We do not use customer personal information to train, fine-tune or improve generative AI models.
Where approved generative AI tools are used internally, their use is restricted to appropriate public, non-personal, non-confidential or de-identified information and is subject to company controls.
ergonomicoffice does not use generative AI to make automated decisions about customer eligibility, purchasing, quotations or account approval.
Further information is provided in our Privacy Policy – Privacy and Data Security.
We recognise that government, corporate and institutional customers may impose additional requirements relating to:
Where additional requirements apply, they can be identified and agreed before sensitive information is supplied or services commence.
Where hard-copy customer or business records are retained, reasonable measures are taken to restrict unauthorised access.
When records are no longer required and there is no legal or business requirement to retain them, they are securely destroyed.
ergonomicoffice maintains procedures for responding to suspected or actual data breaches consistent with the Privacy Act, APP 11 and the Notifiable Data Breaches Scheme.
A data breach can include:
Possible security or privacy incidents may be identified through:
Where appropriate, initial actions may include:
Suspected eligible data breaches are assessed promptly and proportionately to the apparent risk.
Where an assessment is required under the Notifiable Data Breaches Scheme, we will take reasonable steps to complete that assessment as soon as practicable and within the period required by law.
The assessment may consider:
Where notification is required, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with applicable law.
Where relevant, we may also notify:
Notifications may include:
Following an incident, appropriate corrective action may include:
Security and privacy incidents are documented as appropriate to support investigation, response, review and future risk reduction.
Customers with online account access also play a role in maintaining account security.
We recommend:
If you believe your personal information, customer account or dealings with ergonomicoffice may have been affected by a security incident, please contact:
Privacy & Security Officer – ergonomicoffice Pty Limited
Email: sales@ergonomicoffice.com.au
Phone: 1300 555 930
We will investigate reported security concerns promptly and take appropriate action.
For information about the collection, use, disclosure and retention of personal information, please also refer to our Privacy Policy.
