Privacy Policy

MZAIT is a software and web development studio based in Sydney, Australia. This policy explains how we handle personal information when you visit our website at mzait.com, contact us, or work with us on a project. In this policy, MZAIT (also "we", "us" and "our") means MZA IT Pty Ltd (ACN 160 014 737) as trustee for the MZA IT Trust (ABN 75 424 494 685), trading as MZAIT.

The Privacy Act 1988 (Cth) may not apply to a small business like ours, and we have not opted in under section 6EA to be treated as an organisation. Where this policy refers to the Australian Privacy Principles, the Notifiable Data Breaches scheme, or the Office of the Australian Information Commissioner (OAIC), we are describing standards we follow as a matter of good practice, to the extent the Act does not already require them of us. The OAIC may decline a complaint that falls outside its jurisdiction.

If you have any questions about this policy, email us at hello@mzait.com.

This policy covers the mzait.com website and the enquiries, quotes and client work that follow when you get in touch with us.

Where we are doing paid work for you under a separate signed agreement, that agreement governs how we handle the information involved in your project. This policy explains our general approach.

It does not cover other companies' websites that we link to. When you leave our site, the privacy policy of the site you visit will apply.

We keep collection to a minimum. The personal information we may collect and hold includes the following.

Information you give us

• your name;
• your email address;
• the description of your project or enquiry, and anything else you choose to include.

Information collected automatically (first-party analytics)

Our analytics are built and run by us, and they record the following.

• the requested page path (with the query string removed), approximate time, response status and whether we served the HTML or plain-markdown version;
• clicks on a fixed set of marked contact buttons, recorded by button category and page path;
• the website that referred you to us (its domain only);
• a short category token when a browser identifies itself as a recognised search crawler or AI agent; and
• a pseudonymous daily visitor code, used to estimate how many different browsers or devices visit each day. The code is derived from your IP address, browser details, the current date and a secret held by us. It changes every day. The IP address and full browser details are not stored in our analytics database, but the daily code is still treated as pseudonymous usage data rather than anonymous information. A visitor who returns on another day is counted as new that day.

We honour the "Do Not Track" setting in your browser. If it is on, our first-party analytics create no record of your visit. The hosting, network and security systems that deliver the site may separately keep operational logs, including an IP address and request details, for security, reliability and troubleshooting under the applicable provider and system retention schedules.

Detailed analytics rows are scheduled for deletion after 365 days. The daily retention job normally summarises each completed UTC day before deleting old detail. To protect the database during exceptional traffic or abuse, a hard size limit may instead delete the oldest detail before it can be summarised.

The long-term archive stores the day, successful page path, external referrer domain, approved click category, recognised crawler category, and the related totals (including daily-unique and markdown-view counts). It does not contain the daily visitor code, raw IP address or full browser details. An archive row may sometimes represent only one visit and its page or referrer dimension can still be descriptive, so we treat the archive as site-usage data rather than claiming that every row is anonymous. We keep this archive indefinitely to understand long-term site performance.

Information clients provide during a project

If you engage us, you may share further information so we can do the work. This can include business contact details, and where needed access details for systems we work on and any content or data you ask us to handle. We only ask for what the project needs, and that information is dealt with under your engagement agreement.

We do not ask for sensitive information (such as health information). Please do not include sensitive information in your enquiry.

We collect personal information directly from you when you email us or give us information during a project. We also collect some information automatically through our first-party analytics when you visit the site, as described in Section 3 and Section 6. Where it is reasonable and practical, we collect personal information directly from you rather than from someone else.

We use personal information to respond to your enquiry, prepare quotes and proposals, deliver and manage our projects with you, run and improve our website, and meet our legal and record-keeping obligations.

We do not sell your personal information, and we do not trade it. We only use your information for the purpose you gave it to us, for a related purpose you would reasonably expect, where you have agreed, or where the law allows or requires it.

We use first-party analytics to understand how the site is used so we can improve it. "First-party" means the analytics run for our site only. We do not use third-party advertising or cross-site tracking, and we do not use your visit to build advertising profiles or follow you across other websites.

The typefaces used on this site (Archivo and IBM Plex Mono) are self-hosted on our own servers. No third-party font service is used, and no font-related request is made to any external provider when you visit.

Our analytics collect only the information listed in Section 3, and they run without cookies. Browsing the public pages of this site sets no cookies in your browser. The staff sign-in page and other administrative pages may set strictly necessary cookies for the person using them; those pages are not part of ordinary browsing.

We do not sell your personal information, and we keep sharing to a minimum. We may share personal information with service providers and contractors who help us run our business or deliver a project (for example cloud hosting and email providers), on a need-to-know basis; with professional advisers such as our accountant or lawyer where needed; with a third party where you have asked us to or agreed to it; and with anyone we are required or permitted to share with by law.

When we use service providers, we ask them to handle personal information only for the purpose we engaged them for, and to keep it secure.

We use reputable hosting providers to run our website and store enquiries. We choose Australian data regions where they are offered, so your information is generally held in Australia. Some support functions run by our providers may involve access from outside Australia, and backup copies made by our providers may be stored outside Australia.

Where we engage a provider to store data on our behalf and under our control, we treat this as a use rather than a disclosure. Before disclosing personal information overseas, we take reasonable steps to make sure the overseas recipient handles it in a way consistent with the Australian Privacy Principles.

We use your contact details to respond to your enquiry and to deal with your project. We send electronic marketing only with consent or where the law otherwise permits it. Any marketing message we send says clearly who it is from and includes a working way to opt out. If you opt out, or tell us at any time that you do not want marketing from us, we stop sending it.

We take reasonable steps to protect personal information from misuse, loss, and unauthorised access, change or disclosure. These steps include serving our website over HTTPS, limiting who can access personal information to those who need it, and using reputable providers with their own security measures. No system can be guaranteed to be fully secure, and we cannot promise that information sent over the internet is completely safe, but we work to protect it.

We keep personal information only for as long as we need it for the purposes in this policy, or for as long as the law requires. When we no longer need it, we take reasonable steps to destroy it or de-identify it.

If a data breach happens, we will act quickly to assess it, contain it and reduce any harm. Where a breach is likely to result in serious harm to one or more individuals and we cannot prevent that harm through remedial action, we will notify the affected individuals and the OAIC, following a process consistent with the Notifiable Data Breaches scheme.

You can ask us for a copy of the personal information we hold about you, and you can ask us to correct it if it is wrong, out of date or incomplete. To make a request, email us at hello@mzait.com. We may need to verify your identity first, and we will respond within a reasonable time.

Access is usually free. In most cases we can give you access, but there are some limited situations where the law allows us to refuse. If we cannot give you access or make a correction, we will explain why in writing and tell you how to complain.

You can browse the mzait.com website without giving us your name or contact details, subject to the analytics and operational logging described in Section 3. You also have the option of dealing with us anonymously or under a pseudonym where it is lawful and practical. In many cases we will need your name and contact details to answer your enquiry or deliver a project, and if we cannot help you without those details we will let you know.

We are based in Australia and follow Australian privacy practice. If you visit our site or contact us from outside Australia, the points below may also apply to you.

Your rights in the EU and UK

If you are in the European Union or the United Kingdom, you may have rights under the General Data Protection Regulation (GDPR) or the UK GDPR. These laws apply only in certain circumstances, for example where a business targets people in those places or monitors their behaviour there. Where they apply to us, the data controller is MZA IT Pty Ltd (ACN 160 014 737) as trustee for the MZA IT Trust, contactable at hello@mzait.com.

Subject to the law, you may have the right to access the personal information we hold about you, ask us to correct or erase it, ask us to restrict how we use it, receive it in a portable form, object to certain uses, and withdraw your consent where we rely on it. To exercise any of these, email hello@mzait.com. We keep information only as long as we need it, as set out in Section 10.

Where the law requires safeguards for a transfer of information from the EEA or the UK, we take reasonable steps to make sure appropriate safeguards are in place. You also have the right to complain to your local data protection authority. In the UK this is the Information Commissioner's Office (ICO) at ico.org.uk.

California residents

The CCPA and CPRA may not apply to us, but as a matter of practice we do not sell or share your personal information, and we do not use it for cross-context behavioural advertising. We collect only what you send us and the basic site-usage information described above. To ask what we hold, email hello@mzait.com.

If you think we have mishandled your personal information, please tell us so we can put things right. Email your complaint to hello@mzait.com with enough detail for us to look into it, and we will respond within a reasonable time.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC), which will decide whether it is able to consider your complaint. Website: oaic.gov.au. Phone: 1300 363 992.

If you have any questions, requests or complaints about this policy or your personal information, contact us by email at hello@mzait.com. Our details are MZA IT Pty Ltd (ACN 160 014 737) as trustee for the MZA IT Trust, ABN 75 424 494 685.

We may update this policy from time to time, for example if our practices or the law change. The current version will always be on this page, with the last-updated date shown in the details above. If we make a significant change, we will take reasonable steps to make it clear.