Privacy Policy

1. Who we are and our commitment

This website is operated by Epcotec Pty Ltd (Australia) and Epcotec Ltd (Canada), together "Epcotec", "we", "us". We are a senior software engineering studio.

We handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and the fair information principles of Canada's PIPEDA (Personal Information Protection and Electronic Documents Act). Even where a small-business exemption might apply, we hold ourselves to these standards as a condition of working with enterprise and government buyers.

In Canada, where personal information is handled in Alberta, British Columbia or Quebec, we also apply the substantially similar provincial regimes: the Alberta and British Columbia Personal Information Protection Acts (PIPA) and, for Quebec, the private-sector privacy framework modernised by Law 25 (Act 25), including breach notification to the Commission d'accès à l'information (CAI) and privacy-impact assessments where required.

2. Personal information we collect

• Enquiry data you choose to send us through the contact form or by email: name, work email, company, the service and budget selections you make, and your message.
• Estimate tool data. The selections you make in the estimator are processed in your browser only and are not transmitted to us unless you include them in an enquiry.
• Correspondence records: emails, call notes and meeting records relating to an enquiry or engagement.
• Engagement data if you become a client: contact and billing details, project correspondence, and any personal information contained in materials you share with us for delivery.
• Technical logs kept by our hosting provider (such as IP addresses and request timestamps) for security and availability purposes.
• Job-application data you submit through the application form (careers): identity and contact details, availability and work-eligibility declarations, a structured profile replacing a CV (experience, education, certifications, skills), your motivation text and portfolio link, and any optional information you choose to share (adjustment requests, equal-opportunity monitoring, talent-pool consent). Application essentials are processed as steps towards a possible work contract; talent-pool storage and source-of-role analytics rely on your separate consent; adjustment requests and equal-opportunity answers are special-category data collected only with your explicit, revocable consent and kept separated from the hiring panel. Unsuccessful applications are deleted within 6 to 12 months; talent-pool entries are kept up to 24 months or until you withdraw consent. We do not request photos, dates of birth, identity documents or criminal history at application stage.

We do not collect other sensitive information, and we do not use advertising or cross-site tracking technologies on this website.

Our website is not directed at children and we do not knowingly collect personal information from children.

3. How we use personal information

• To respond to enquiries and prepare proposals, estimates and quotes.
• To deliver contracted services and manage engagements, including invoicing and reporting.
• To meet legal, tax, insurance and record-keeping obligations.
• To maintain the security and availability of this website.

We do not use personal information for automated decision-making that affects you, and we do not profile website visitors.

4. Disclosure and no sale

We do not sell or rent personal information. We disclose it only to: service providers acting under contract and confidentiality (hosting, email delivery, accounting); our professional advisers (legal, accounting, insurance) where needed; regulators, courts or law-enforcement bodies where required by law; and a successor entity in a genuine corporate transaction, under confidentiality. We do not disclose personal information to advertising networks or data brokers.

5. AI tooling and your information

We use AI tooling as part of our delivery process, under the control and review of our engineers. Our commitments: client materials are processed under confidentiality; we do not knowingly submit client personal information or confidential client code to tools that would use it to train public models; and no deliverable reaches a client without human review. If an engagement requires specific data-handling commitments beyond this policy, we agree them in writing before work starts.

6. Voice services and call recordings

For hosted telephony clients we process call metadata (numbers, durations, routing) and, where a client has enabled those features, call audio and transcripts. Callers are told when a call is recorded. Call recordings and transcripts are kept for a bounded retention window set per client agreement (14 days unless agreed otherwise) and then deleted. Speech-to-text and text-to-speech conversion is performed by a specialised speech provider under confidentiality; the conversational layer for receptionist deployments can run on infrastructure under the client's control where the agreement provides for it. Booking actions taken by a receptionist are limited to the client's own booking system and are logged.

7. Storage, security and international transfers

Data is encrypted in transit and at rest where the storage system supports it. Access is limited to team members who need it, protected by multi-factor authentication and least-privilege accounts. Our hosting and email providers may store data outside Australia or Canada; where they do, we select reputable providers and remain accountable for how the information is handled.

Key providers we rely on for this website: Cloudflare (edge network and email routing), Oracle Cloud (hosting), Brevo (transactional email delivery) and Google Analytics (measurement, loaded only after you accept analytics cookies). Each processes personal information only to deliver the function described, under contract and confidentiality.

For clients subject to data-residency requirements (such as Canadian federal or provincial government buyers), we agree in writing to store and process the relevant data within the required jurisdiction (for example, within Canada for protected data) using infrastructure in the applicable region.

8. Retention

• Enquiry correspondence: up to 2 years after our last contact, then deleted or de-identified.
• Engagement, billing and project records: 7 years, as required for tax and legal purposes, then securely destroyed.
• Technical logs: rotated on a short cycle for security operations only.

9. Your rights

You may request access to the personal information we hold about you, ask us to correct it, or ask how it has been handled. Use the contact form (topic: Privacy request) and we will respond within 30 days. In Australia you may also complain to the Office of the Australian Information Commissioner (OAIC); in Canada, to the Office of the Privacy Commissioner of Canada, although we would welcome the chance to resolve any concern directly first.

10. Data breaches

If we become aware of a data breach that is likely to result in serious harm, we will contain it, assess it, and notify affected individuals and the relevant regulator (the OAIC in Australia; the Office of the Privacy Commissioner in Canada) as required by law.

11. Marketing

We send marketing messages only where you have enquired with us or consented to receive them, consistent with the Spam Act 2003 (Cth) in Australia and Canada's Anti-Spam Legislation (CASL). Every message identifies us, includes a way to contact us, and provides an unsubscribe option that we honour promptly. Withdrawing consent does not affect messages sent before withdrawal.

12. Cookies and tracking

This website runs a cookieless analytics layer that counts anonymous page views with no cookies and no personal data. Analytics cookies and campaign tags are set only after you accept them in the consent banner; you can choose essential-only or withdraw consent at any time via the banner or our Cookie Policy.

13. Reporting security vulnerabilities

We welcome responsible disclosure of security vulnerabilities. Report them to security@epcotec.com; the disclosure procedure is also published at /.well-known/security.txt.

14. Changes to this policy

We may update this policy from time to time. The "last updated" date above shows the current version; material changes affecting clients will be communicated directly.

15. Contact

Privacy enquiries: use the contact form and choose "Privacy request" as the topic. Postal addresses for each entity: Epcotec Pty Ltd, Level 8, 100 George St, Parramatta NSW 2150, and Suite 1100, 11 Palmerston Lane, Manuka ACT 2603, Australia; Epcotec Ltd, Suite 362, 329 Howe Street, Vancouver, BC V6C 3N2, Canada. They are also listed on the contact page.