Privacy notice
How VAPT.COM.AU handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Last updated 2026-09-02. This notice is for the marketing site and for enquiry handling. Engagements are also covered by the statement of work and any NDA you sign with us.
Who we are
VAPT.COM.AU is an Australian penetration-testing practice. Contact: pentest@vapt.com.au.
What we collect
- Enquiry form fields: name, work email, company, city, service interest, message.
- Email you send us, including attachments you choose to include.
- Technical logs our host (Cloudflare) may collect: IP address, user agent, timestamps. We do not run advertising cookies or a marketing pixel on this site.
Why we collect it
To reply to enquiries, to quote and deliver testing, to keep engagement records, and to meet legal obligations. We do not sell personal information. We do not use it for automated decision-making.
Form processor
The public enquiry form posts to Formspree in order to deliver the message to us. Do not put passwords, production data or health records in the marketing form. Use an NDA and a secure channel for engagement evidence.
Engagement evidence
Screenshots, logs and findings from a test are stored encrypted, limited to named testers, and deleted on the schedule in the statement of work. Testers are onshore in Australia unless the SoW says otherwise in writing.
Your rights
You may request access to, or correction of, personal information we hold, and you may complain to us at pentest@vapt.com.au. You may also complain to the Office of the Australian Information Commissioner (OAIC).
Retention
Marketing enquiries: up to 24 months unless you ask us to delete sooner. Engagement records: as agreed in the SoW, typically no longer than required for the retest, attestation and any dispute window.