Data Privacy Policy

Guident Pty Ltd · Version 1.0 · 13 October 2026

Purpose

Guident Pty Ltd (herein referred to as “Organisation,” “Company,” “we,” “our,” or “us,” etc.) is committed to protecting the privacy of individuals who interact with us. This policy explains how we collect, use, store, and safeguard personal data to ensure transparency and build trust with our users, customers, and partners. The Organisation also establishes structured privacy governance, risk assessment, and accountability mechanisms to ensure compliance with applicable data protection laws and regulations.

Scope

This policy applies to all personal data collected through the organisation’s websites, applications, services, and other interactions with individuals. This policy also applies to all internal systems, third-party processors, cross-border data transfers, and any new or modified processing activities involving personal data.

Definition

  • IP Address: A unique string of characters that identifies each computer using the Internet Protocol to communicate over a network.
  • Personal Data: Any information relating to an identifiable individual (e.g., name, email, IP address).
  • Processing: Any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.
  • Data Controller: The entity that determines the purposes and means of processing personal data.
  • Data Processor: The entity that processes data on behalf of the data controller.
  • Privacy Impact Assessment (PIA/DPIA): A structured process used to evaluate risks to personal data and define mitigation controls before initiating or modifying processing activities.

Responsibilities

  • The Privacy Officer is responsible for developing, implementing, maintaining, and enforcing the policy.
  • Employees are responsible and/or accountable to ensure adherence to this policy’s terms during their job duties.
  • Data Protection Officer (DPO) / Privacy Officer Responsibilities:
    • Oversee privacy impact assessments (DPIA/PIA)
    • Monitor compliance with data protection laws
    • Maintain records of processing activities and disclosures
    • Handle data subject rights requests and breach notifications

Policy

Data We Collect

We may collect the following types of personal data:

  • Identification Information: Name, email, phone number, address, date of birth, etc.
  • Account Information: Username, password, account preferences.
  • Financial Information: Payment details, billing address.
  • Technical Data: IP address, device identifiers, operating system, cookies, and usage analytics.
  • Sensitive Personal Data (if applicable): Health information, biometric data, or other sensitive data only with explicit consent.

How We Collect Personal Data

We collect personal data through the following methods:

  • Directly from you: When you fill out forms, create accounts, or contact us.
  • Automatically: Through cookies, analytics tools, and logs when you use our website or services.
  • Third Parties: From business partners, service providers, or publicly available sources.

We process personal data only when permitted by law. The legal bases include:

  • Consent: When you provide explicit consent (e.g., marketing communications).
  • Contractual Necessity: To fulfil a contract with you (e.g., processing orders).
  • Legal Obligation: To comply with legal and regulatory requirements.
  • Legitimate Interests: For fraud prevention, improving services, or ensuring security.

How We Use Personal Data

We use personal data for the following purposes:

  • Providing and improving our services.
  • Processing transactions and managing accounts.
  • Communicating with you regarding updates, offers, and support.
  • Conducting analytics and research to improve user experience.
  • Ensure security, detect fraud, and comply with legal obligations.

Data Sharing and Disclosure

We may share personal data under these circumstances:

  • Service Providers: With vendors or contractors who perform services on our behalf.
  • Legal Compliance: To comply with laws, subpoenas, or other legal processes.
  • Business Transfers: In the event of mergers, acquisitions, or asset sales.
  • Consent: When you explicitly agree to share your data.
  • Additional Controls:
    • All disclosures must be logged and recorded, including recipient, purpose, and data shared
    • Third parties must sign data processing agreements (DPAs) with defined privacy obligations
    • Sub-processors must be approved and monitored

Data Retention

We retain personal data only as long as necessary to fulfil the purposes for which it was collected unless a more extended retention period is required by law. Afterwards, data is securely deleted or anonymised.

Data Security

We implement industry-standard technical and organisational measures to safeguard personal data, including:

  • Encryption (at rest and in transit).
  • Access controls and authentication protocols.
  • Regular audits and security assessments.
  • Personal data shall be securely deleted or destroyed using approved methods such as:
    • Secure wiping / cryptographic erasure
    • Physical destruction of media
  • Disposal actions must be logged and verified
  • Third-party disposal providers must comply with security requirements

Data Disposal and Destruction

  • Personal data shall be securely deleted or destroyed using approved methods such as:
    • Secure wiping / cryptographic erasure
    • Physical destruction of media
  • Disposal actions must be logged and verified
  • Third-party disposal providers must comply with security requirements

Your Rights

Depending on your jurisdiction, you may have the following rights:

  • Access: Request access to your data.
  • Rectification: Correct inaccurate or incomplete data.
  • Deletion: Request deletion of your data.
  • Data Portability: Obtain a copy of your data in a portable format.
  • Restriction: Request a limitation on the processing of your data.
  • Objection: Object to certain processing activities (e.g., direct marketing).
  • Withdraw Consent: Withdraw your consent when processing is based on consent.
  • Regular security testing including vulnerability assessments and audits
  • Monitoring for unauthorised access and anomalies
  • Formal procedures shall exist to handle data subject requests within defined timelines
  • All requests must be logged and tracked

To exercise your rights, please contact us at privacy@guident.app.

Privacy Impact Assessments (DPIA / PIA)

  • Privacy Impact Assessments must be conducted for:
    • New systems or applications
    • New data processing activities
    • Changes to existing processing
  • DPIA must evaluate:
    • Risks to individuals
    • Data sensitivity
    • Processing scale
  • Mitigation measures must be defined and approved before implementation

Privacy Incident Management & Breach Notification

  • All data breaches must be reported immediately to the ISG/DPO
  • Incidents must be:
    • Investigated
    • Documented
    • Resolved
  • Regulatory and user notifications must be made within legally required timelines
  • Root cause analysis and corrective actions must be implemented

Cross-Border Data Transfers

  • Personal data transfers outside the originating jurisdiction must comply with applicable laws
  • Appropriate safeguards must be implemented, such as:
    • Standard Contractual Clauses (SCCs)
    • Adequacy decisions
    • Binding Corporate Rules (if applicable)

Record Keeping and Accountability

  • The Organisation shall maintain records of:
    • Processing activities
    • Data disclosures
    • Consent records
    • DPIA assessments
    • Breach incidents
  • Records must be retained for audit and compliance purposes

Data Accuracy and Quality Management

  • The Organisation shall ensure personal data is accurate, complete, and up to date
  • Mechanisms shall exist to:
    • Validate data at collection
    • Periodically review and update stored data
  • Inaccurate data must be corrected or deleted without delay

Cookies and Tracking Technologies

We use cookies and other tracking technologies to enhance your browsing experience. You can manage your preferences through our cookie policy or browser settings.

Children’s Privacy

We do not knowingly collect personal data from children under the age of 18 years. If we become aware of such data, we will delete it promptly.

Our website or services may contain links to third-party websites. We are not responsible for their privacy practices and encourage you to review their privacy policies.

Updates to This Policy

The organisation will update this policy periodically to reflect changes in laws, regulations, or business practices.

Policy updates must be reviewed, approved, and communicated to relevant stakeholders.

Version Details

Version Version Date Description of changes Created By Approved By Published By
Version 1.0 Oct 13 2026 Initial Release Rebecca Steve Steve