--- title: "Privacy Policy — Lucid Labs" description: "How Lucid Labs collects, uses, stores and protects your personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles." url: "https://lucidlabs.com.au/privacy" --- # Privacy Policy Effective date: 14 April 2026 · Version 2.0 ## 1\. Who we are Lucid Labs Pty Ltd (ABN 33 678 306 539) (**Lucid Labs**, **we**, **us**, **our**) is an Australian-domiciled professional services company, registered in Queensland, with its principal place of business at 31 Hope Street, Spring Hill QLD 4000. Lucid Labs is the data controller for personal information collected through our website ([lucidlabs.com.au](https://lucidlabs.com.au/)) and during the delivery of our services. We are bound by the _Privacy Act 1988_ (Cth) (the **Privacy Act**), including the Australian Privacy Principles (**APPs**) and the Notifiable Data Breaches scheme. ## 2\. Scope of this policy This policy explains how Lucid Labs collects, uses, holds, discloses and protects: - personal information about visitors to our website; - personal information about clients, prospective clients, partners and suppliers; - personal information about job applicants and candidates; and - any other personal information we may collect in the course of our business. This policy does not apply to personal information that we process on behalf of a client under a contract for services. Where we process personal information on behalf of a client, we act as that client’s service provider and the client’s privacy policy applies. We will hold and use that information only as instructed by our client and in accordance with the Privacy Act. ## 3\. The personal information we collect The personal information we collect about you may include: - **Identity and contact information** — name, role, employer, business email address, business telephone number, postal address; - **Engagement information** — the content of our communications with you, meeting notes, contracts, invoices, project records; - **Website usage information** — IP address, device and browser type, operating system, pages visited, time spent on pages, referring URLs, and similar usage data collected automatically by our website and analytics tools; and - **Recruitment information** — CV, work history, qualifications, references, right-to-work status and any information you choose to provide as part of an application. We do not generally collect sensitive information (as defined in the Privacy Act) and we will only do so where it is reasonably necessary for one or more of our functions or activities and you have consented (or another exception in APP 3 applies). ## 4\. How we collect personal information We collect personal information: - directly from you when you contact us, complete a form, request a service, attend a meeting or apply for a role; - automatically when you visit our website, through cookies and similar technologies (see section 9); - from our clients when they engage us to deliver services; - from publicly available sources, including LinkedIn and other professional directories; and - from third-party service providers we use to operate our business (for example, email and CRM platforms). ## 5\. Why we collect, hold, use and disclose personal information We collect, hold, use and disclose personal information for the following purposes: - to provide our services and respond to enquiries; - to manage our relationships with clients, prospects, partners and suppliers; - to send you information about our services where you have asked us to or where we are otherwise permitted by law; - to recruit and onboard staff and contractors; - to operate, secure, improve and analyse our website and services; - to comply with our legal, regulatory and contractual obligations; and - to investigate and respond to security and privacy incidents. We will not use or disclose your personal information for a purpose other than the purpose for which it was collected unless you have consented, or another exception in APP 6 applies. ## 6\. Direct marketing From time to time we may use your personal information to send you communications about our services, events and insights that we believe will be of interest to you. We will only do this where we are permitted to under APP 7. You can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us using the details in section 13. ## 7\. Disclosure of personal information We may disclose your personal information to: - **Service providers** who help us run our business, including hosting, cloud, email, customer relationship management, accounting, professional advice and analytics providers (for example, Microsoft, GitHub, Xero); - **Our clients**, where personal information about you was collected in connection with a project for that client; - **Government, regulatory and law enforcement agencies**, where required or authorised by law; and - **An acquirer** in connection with a merger, acquisition or sale of all or part of our business, subject to confidentiality obligations. We do not sell your personal information. ## 8\. Overseas disclosure We are an Australian business and our staff and primary infrastructure are located in Australia. Some of the third-party service providers we use may store or process personal information in countries other than Australia, including the United States and other countries where Microsoft, GitHub or other major cloud providers operate. Where we disclose personal information to overseas recipients, we take reasonable steps in accordance with APP 8 to ensure that the recipient does not breach the APPs in relation to that information. ## 9\. Cookies and analytics Our website uses cookies and similar technologies to operate the site, remember your preferences and analyse how the site is used. Cookies are small text files placed on your device by your web browser. You can control cookies through your browser settings, including blocking or deleting them, though this may affect site functionality. We may use analytics services that collect aggregated, de-identified information about site usage. Where these services collect personal information, that information is handled in accordance with this policy and the relevant analytics provider’s privacy policy. ## 10\. How we hold and protect personal information We store personal information in Australian Microsoft 365 and Microsoft Azure tenants and in the systems of carefully selected third-party service providers. We take reasonable steps in accordance with APP 11 to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include: - access controls, multi-factor authentication and the principle of least privilege; - encryption of data in transit and at rest; - endpoint protection, security monitoring and patch management; - staff training and a documented information security policy framework; - independent third-party certification under **SMB1001:2025 Level 3 Gold** by CyberCert; and - a documented Cyber Incident Response Plan. No method of transmission over the internet or electronic storage is completely secure, so while we take reasonable steps to protect personal information, we cannot guarantee absolute security. ## 11\. Data retention We retain personal information only for as long as is necessary for the purpose for which it was collected, or as required by law or contract. When personal information is no longer needed, we will take reasonable steps to destroy or de-identify it. Where personal information is held within a client’s tenant or system, retention is governed by our contract with that client. ## 12\. Notifiable Data Breaches Lucid Labs complies with the Notifiable Data Breaches (NDB) scheme established by Part IIIC of the Privacy Act. Where we suspect that an eligible data breach has occurred, we will assess the breach within the 30-day statutory period and, if a notification is required, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. ## 13\. Your rights and how to contact us Under the Privacy Act and the APPs, you have the right to: - access the personal information we hold about you (APP 12); - request correction of personal information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13); - opt out of direct marketing (APP 7); and - make a complaint about how we have handled your personal information. To exercise any of these rights, please contact our Privacy Officer at [privacy@lucidlabs.com.au](mailto:privacy@lucidlabs.com.au). We will acknowledge your request promptly and respond within a reasonable period (and in any event within 30 days for access and correction requests). ## 14\. Complaints If you believe Lucid Labs has breached the Privacy Act or the APPs, you can make a complaint to our Privacy Officer at [privacy@lucidlabs.com.au](mailto:privacy@lucidlabs.com.au). We will investigate your complaint and respond to you within a reasonable period. If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC): - Online: [oaic.gov.au/privacy/privacy-complaints](https://www.oaic.gov.au/privacy/privacy-complaints) - Phone: 1300 363 992 - Post: GPO Box 5288, Sydney NSW 2001 ## 15\. Compliance with foreign privacy laws Lucid Labs is an Australian-domiciled entity that operates under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We do not currently hold certification against, or claim operational compliance with, any foreign privacy regime such as the European Union General Data Protection Regulation (GDPR), the United Kingdom Data Protection Act 2018, the New Zealand Privacy Act 2020, the United States Health Insurance Portability and Accountability Act (HIPAA) or the California Consumer Privacy Act (CCPA). Where a specific engagement requires alignment with a foreign privacy regime, we will perform a targeted Data Protection Impact Assessment and design controls to meet the applicable regulation for that engagement. ## 16\. Changes to this Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or for other reasons. Material changes will be communicated by posting the updated policy on this page with a new effective date. We encourage you to review this policy periodically. ## 17\. Trademarks and third-party content Microsoft, Azure, Microsoft Fabric, Microsoft Purview, Power BI, Dynamics 365, GitHub and Copilot are trademarks of Microsoft Corporation or its affiliates. All other product names, logos and brands referenced on this site are the property of their respective owners. Lucid Labs references these marks for informational, educational and partner-attribution purposes only and does not claim ownership of, affiliation with, or endorsement by, the trademark owners except where an affiliation is expressly stated (for example, our published Microsoft Solutions Partner designations). If you believe any content on our site infringes your intellectual property rights, please contact us at [privacy@lucidlabs.com.au](mailto:privacy@lucidlabs.com.au) and we will promptly review and address your concern. This policy is provided as general information about how Lucid Labs handles personal information and is not legal advice. For legal advice about your specific circumstances, please consult a qualified legal practitioner.