Privacy Policy

1. Who we are and our commitment

This website is operated by Epcotec Pty Ltd (Australia) and Epcotec Ltd (Canada), together “Epcotec”, “we”, “us”. We are a senior software engineering studio.

We handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and the fair information principles of Canada’s PIPEDA (Personal Information Protection and Electronic Documents Act). Even where a small-business exemption might apply, we hold ourselves to these standards as a condition of working with enterprise and government buyers.

In Canada, where personal information is handled in Alberta, British Columbia or Quebec, we also apply the substantially similar provincial regimes: the Alberta and British Columbia Personal Information Protection Acts (PIPA) and, for Quebec, the private-sector privacy framework modernised by Law 25 (Act 25), including breach notification to the Commission d’accès à l’information (CAI) and privacy-impact assessments where required.

2. Personal information we collect

• Enquiry data you choose to send us through the contact form or by email: name, work email, company, the service and budget selections you make, and your message.
• Estimate tool data. The selections you make in the estimator are processed in your browser only and are not transmitted to us unless you include them in an enquiry.
• Correspondence records: emails, call notes and meeting records relating to an enquiry or engagement.
• Engagement data if you become a client: contact and billing details, project correspondence, and any personal information contained in materials you share with us for delivery.
• Technical logs kept by our hosting provider (such as IP addresses and request timestamps) for security and availability purposes.

We do not collect sensitive information, and we do not use advertising or cross-site tracking technologies on this website.

3. How we use personal information

• To respond to enquiries and prepare proposals, estimates and quotes.
• To deliver contracted services and manage engagements, including invoicing and reporting.
• To meet legal, tax, insurance and record-keeping obligations.
• To maintain the security and availability of this website.

We do not use personal information for automated decision-making that affects you, and we do not profile website visitors.

4. Disclosure and no sale

We do not sell or rent personal information. We disclose it only to: service providers acting under contract and confidentiality (hosting, email delivery, accounting); our professional advisers (legal, accounting, insurance) where needed; regulators, courts or law-enforcement bodies where required by law; and a successor entity in a genuine corporate transaction, under confidentiality. We do not disclose personal information to advertising networks or data brokers.

5. AI tooling and your information

We use AI tooling as part of our delivery process, under the control and review of our engineers. Our commitments: client materials are processed under confidentiality; we do not knowingly submit client personal information or confidential client code to tools that would use it to train public models; and no deliverable reaches a client without human review. If an engagement requires specific data-handling commitments beyond this policy, we agree them in writing before work starts.

6. Storage, security and international transfers

Data is encrypted in transit and at rest where the storage system supports it. Access is limited to team members who need it, protected by multi-factor authentication and least-privilege accounts. Our hosting and email providers may store data outside Australia or Canada; where they do, we select reputable providers and remain accountable for how the information is handled.

For clients subject to data-residency requirements (such as Canadian federal or provincial government buyers), we agree in writing to store and process the relevant data within the required jurisdiction (for example, within Canada for protected data) using infrastructure in the applicable region.

7. Retention

• Enquiry correspondence: up to 2 years after our last contact, then deleted or de-identified.
• Engagement, billing and project records: 7 years, as required for tax and legal purposes, then securely destroyed.
• Technical logs: rotated on a short cycle for security operations only.

8. Your rights

You may request access to the personal information we hold about you, ask us to correct it, or ask how it has been handled. Email hello@epcotec.com and we will respond within 30 days. In Australia you may also complain to the Office of the Australian Information Commissioner (OAIC); in Canada, to the Office of the Privacy Commissioner of Canada, although we would welcome the chance to resolve any concern directly first.

9. Data breaches

If we become aware of a data breach that is likely to result in serious harm, we will contain it, assess it, and notify affected individuals and the relevant regulator (the OAIC in Australia; the Office of the Privacy Commissioner in Canada) as required by law.

10. Marketing

We send marketing messages only where you have enquired with us or consented to receive them, consistent with the Spam Act 2003 (Cth) in Australia and Canada’s Anti-Spam Legislation (CASL). Every message identifies us, includes a way to contact us, and provides an unsubscribe option that we honour promptly. Withdrawing consent does not affect messages sent before withdrawal.

11. Cookies and tracking

This website uses only essential cookies necessary for it to function, and runs no advertising or cross-site trackers. Optional (analytics) cookies are set only after you accept them in the consent banner; you can choose essential-only or withdraw consent at any time. We will use a privacy-respecting analytics service and update this policy if and when analytics are enabled.

12. Reporting security vulnerabilities

We welcome responsible disclosure of security vulnerabilities. See /.well-known/security.txt for how to report them.

13. Changes to this policy

We may update this policy from time to time. The “last updated” date above shows the current version; material changes affecting clients will be communicated directly.

14. Contact

Privacy enquiries: hello@epcotec.com. Postal addresses for each entity are listed on the contact page once registration is complete.