Privacy Policy

METHOD & MACHINE PTY LTD • Trading as Method & Machine

Effective date: 2 November 2026 • Version: 1.0

1. Who we are and what this policy covers

Method & Machine helps businesses and individuals improve how they work through operational analysis, process improvement, better systems, automation and appropriate use of artificial intelligence (AI). We are based in Broome, Western Australia.

This policy explains how we collect, hold, use and disclose personal information when you enquire about or use our services, interact with our website or communications, supply services to us, or participate in a client project. Personal information is information or an opinion about an identified person, or a person who is reasonably identifiable, whether or not it is accurate or recorded in a material form.

We handle personal information in accordance with this policy and the laws that apply to us. We use the Australian Privacy Principles as our privacy-management baseline. This statement does not represent that we have formally opted into the Privacy Act 1988 (Cth), or that every activity is subject to the same legal requirements.

Where we handle information for a client, the client's privacy notice may also apply. We remain responsible for our own obligations. A project notice may explain a particular collection or use more specifically. This policy does not itself give consent to a new use of your information.

2. Information we collect

We collect information reasonably needed for the relevant interaction or agreed service. Depending on the circumstances, this may include:

• Contact and relationship details: your name, business, role, email address, telephone number, enquiry, correspondence, preferences and information about how you heard about us.

• Engagement and administration records: proposals, agreements, approvals, invoices, payment status, service history, feedback, complaints and records needed to administer the engagement.

• Business project information: relevant customer, employee, supplier or other contact information; workflow records; documents; messages; booking or transaction information; and system or usage records needed for the agreed work.

• Personal service information: priorities, tasks, schedules, appointments, documents, subscriptions, household administration and selected financial administration information you choose to provide for the agreed service.

• Project outputs: analysis, reports, configurations, task records, AI inputs and outputs, test results and support records, where these contain personal information.

• Technical information: device and browser details, IP address, access times, activity and security logs, and website interaction information collected by the tools actually used.

We do not need unrestricted access to your email, files, bank accounts or other systems merely to discuss a possible engagement. We agree the information and access needed before substantive work begins and prefer limited samples, summaries or appropriately de-identified information where suitable.

3. Sensitive information, other people's information and credentials

Health information and other legally defined sensitive information require additional care. We do not routinely request this information. If an agreed service requires it, we first assess necessity, explain the purpose, arrange appropriate safeguards and obtain consent where required, unless a lawful exception applies. Financial information can be highly private even when it is not legally classified as sensitive information.

Please do not send passwords, authentication codes, recovery keys, tax file numbers, identity-document copies, full payment-card details or unnecessary health information through an enquiry form, email or chat. Where system access is necessary, we arrange an approved access method, preferably a separate named account or limited delegated access.

If you provide information about a colleague, customer, family member or another person, you must have an appropriate basis to do so. We may ask you to remove irrelevant information or obtain the necessary authority. Your access to an employer's system does not by itself authorise you to share its information with us.

Our Personal service is intended for adults. Work involving a child's information requires a separate necessity and authority assessment and appropriate parent or guardian involvement. We do not knowingly seek information from children through our general enquiry process.

4. How we collect information

We generally collect information directly from you through conversations, questionnaires, email, meetings, forms and the records you provide. We may also collect relevant information through authorised access to client systems, from a person authorised to represent you, from referral partners or from public business sources.

Where a client supplies information about other people, we agree responsibilities for notices and lawful collection with that client. We provide a separate collection notice, or take other appropriate steps to explain the collection, when the circumstances require it. Public availability does not automatically permit unrestricted reuse or marketing.

We do not record or transcribe a meeting or call without first explaining the purpose, the proposed tool, who can access the recording or transcript, and the retention arrangements, and obtaining the agreement and consent required for that activity. You can request a non-recorded discussion.

If we receive personal information we did not ask for, we assess whether we could lawfully and appropriately have collected it. Where it should not be retained, we securely destroy or de-identify it when lawful and reasonable, taking account of any obligation to preserve evidence or records.

5. Your choices and the effect of not providing information

You can make a general enquiry anonymously or use a pseudonym where practical and lawful. We may need to identify you to enter an agreement, issue an invoice, verify authority, provide a personalised service or respond securely to a request about your information.

You may decline optional questions or permissions. If necessary information or access is not available, we will explain whether we can use a less intrusive approach or whether part of the service cannot proceed. Marketing and case-study permission are optional and are not conditions of receiving our paid services.

6. Why we use information

We use personal information to respond to enquiries; assess fit and scope; deliver, administer and support agreed services; understand and improve workflows; prepare and verify deliverables; manage payments and records; protect systems and prevent misuse; respond to requests or complaints; and meet legal obligations or manage legal claims.

We may use contact details for lawful, relevant marketing as explained below. We seek separate permission before publishing an identifiable testimonial, case study, client name, image or logo. We do not use a client's project information to market to that client's customers.

We do not sell or barter personal information. We do not reuse identifiable client information for unrelated projects, cross-client knowledge libraries or general AI-model training. We only use or disclose information for another purpose where permitted by law, including where valid consent is required and obtained.

7. Information handled for clients

For client projects, we agree the purpose, information categories, systems, authorised people, permitted actions, providers and exit arrangements. The client generally manages its relationship with its customers, personnel or other affected people. Method & Machine handles the agreed information to provide the service and administer its own business obligations.

We do not treat a client's instruction as permission to act unlawfully. We may pause or narrow work where authority or safeguards are unclear. Personal engagements involving work and home information use separate access and sharing arrangements where appropriate.

If your request concerns information we hold for a client, we will help identify the appropriate contact and coordinate a response. We will also assess and meet any obligations we have ourselves; we will not simply redirect a request where we are required to deal with it.

8. AI and automation

An agreed service may use AI to assist with drafting, summarising, categorising, extracting or analysing information. Automation may move information between approved systems or carry out agreed routine tasks. The project notice or agreement identifies material AI uses, information involved and relevant safeguards before those uses begin.

We assess the provider, account type, contractual terms, settings, retention and access arrangements before using personal or confidential information. We minimise the information submitted and use synthetic or appropriately de-identified information where practical. Removing a name alone may not de-identify a record.

We do not enter personal or confidential client information into public or unapproved AI services. We do not authorise providers to use that information to train general-purpose models. Any proposed change to that position requires a separate assessment, a lawful basis and specific informed authority; acceptance of this policy is not that authority.

AI output can be inaccurate or misleading. We require appropriate checking and meaningful human review before consequential use. Our standard services exclude automated decisions about employment, credit, insurance, health, eligibility or comparable matters that could significantly affect a person's rights or interests. Such work requires separate assessment and approval, including where software assists a human decision. Human involvement does not automatically remove privacy obligations.

9. Who may receive information

We may disclose relevant information to approved technology and cloud providers, authorised contractors, the relevant client or its authorised representatives, and professional advisers such as accountants, lawyers and insurers where needed for the stated purpose. Recipients receive only the information reasonably needed and are subject to appropriate contractual or professional protections.

We may disclose information where required or authorised by law, court order or a regulator, or as otherwise permitted to address a serious threat or protect legal rights. Any proposed business transfer involving personal information would be assessed for lawful handling, appropriate confidentiality and any required notice or consent.

A supplier may have its own legal obligations and privacy terms. Those terms do not remove our responsibilities for selecting and using that supplier appropriately.

10. Overseas handling

Cloud storage, AI processing, technical support, subprocessors or backups may involve overseas handling. A provider's Australian office or an Australian hosting choice does not establish that all access and processing remain in Australia.

Netlify hosts our website in the United States. Our email is hosted in Microsoft 365, which stores messages in Exchange.

The Microsoft 365 tenant data region is being confirmed. We have not yet confirmed all countries used for Microsoft processing, technical support, subprocessors and backups. We do not represent that enquiry and email information stays in Australia.

We assess overseas arrangements and take the steps required by applicable law to protect the information. Engagement-specific notices identify additional overseas arrangements where relevant. We do not rely on general acceptance of this policy as a waiver of Australian privacy protections or as blanket consent to overseas disclosure.

11. Website, cookies and third-party links

At launch, the Method & Machine site sets no cookies and uses no analytics, advertising pixels or tracking scripts. It embeds no third-party services and loads no third-party scripts. Instrument Sans fonts are served from our own website.

Netlify serves the website and receives technical information, including your IP address and browser details, to deliver and protect it. “Book a chat” opens your own email program; what you write goes to us by email, not through the website.

You can manage cookies through your browser. There is no marketing signup on this site. Links to external websites lead to services with their own privacy practices.

12. Marketing and opt-out

We send commercial electronic messages only where we have a lawful basis, including the consent required by Australian spam law. We identify Method & Machine and provide a clear, functional way to unsubscribe. We do not use harvested address lists or assume that a publicly listed address alone is consent.

You can unsubscribe through the message or contact us directly. We action electronic-message unsubscribe requests within five working days, without a fee or requiring an account login. The unsubscribe facility remains functional for at least 30 days after the message is sent. We may retain the minimum suppression record needed to respect your choice.

Service messages necessary to deliver an engagement, respond to a request or meet a legal obligation may continue. We do not disguise advertising as a service message. You can also ask us to stop other direct marketing.

13. How we protect information

We take reasonable technical and organisational steps appropriate to the information and risks. These include limiting access, approving systems and providers, protecting accounts and devices, using secure transfer methods, separating client information, training authorised personnel and reviewing access and retention.

We use contractual confidentiality and security requirements for relevant service providers and respond to suspected incidents. No method is completely risk-free. If an incident affects personal information, we assess it, take reasonable containment and remedial steps, and notify affected people, clients or regulators where required.

14. Retention and disposal

We keep personal information only for as long as reasonably needed for a permitted purpose or required by law. Relevant factors include the engagement, support needs, accounting and company recordkeeping, complaints, legal claims and any court order or lawful preservation requirement.

Project working copies are handled according to the agreed return and deletion arrangements. We distinguish these copies from the limited contract, approval and accounting records we may need to retain. A requirement to keep an invoice does not justify retaining every underlying client document.

When information is no longer needed, we take reasonable steps to securely destroy or de-identify it. Some information may remain temporarily in protected backups until scheduled expiry. If restored, previously required deletions are reapplied. We explain material provider limitations rather than promising immediate deletion from every system.

You may ask us to delete information or withdraw consent for a consent-based use. We assess the request, explain any lawful retention requirement and stop future uses where required. Withdrawal cannot reverse a lawful use that has already occurred.

15. Access and correction

Contact the Privacy Contact below to ask for access to your personal information or to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. You do not need a special form. We take proportionate steps to verify identity and authority and avoid collecting unnecessary identification copies.

We aim to respond within 30 calendar days and will explain any delay. There is no fee to make a request or seek a correction. If a reasonable charge for providing access is permitted and proposed, we explain it before proceeding.

If we cannot provide access or make a requested correction, we give written reasons where lawful and explain complaint options. We consider alternative access arrangements and, where required, associate your statement of disagreement with the record. Where appropriate and required, we take reasonable steps to notify other recipients of a correction you request us to communicate.

16. Questions and complaints

Please tell us what happened, the information involved and the outcome you seek. We will acknowledge your complaint, investigate it and aim to provide a substantive response within 30 calendar days. If more time is needed, we explain why and provide an expected response date.

If you remain dissatisfied, you can contact the Office of the Australian Information Commissioner (OAIC), where it has jurisdiction, or another relevant regulator. The OAIC generally expects you to complain to the organisation first and allow a reasonable opportunity to respond. Information is available at OAIC privacy complaints or on 1300 363 992. Your other legal rights are not restricted by this process.

17. Contact and changes

Privacy Contact — Method & Machine

METHOD & MACHINE PTY LTD • ABN 28 701 379 339 • ACN 701 379 339

Broome, Western Australia

Email Method & Machine

Postal contact: PO Box 3395, Broome WA

Telephone: 0497 521 471

You may request a copy of this policy in another reasonably available format. We review it when our services, systems or legal obligations change and at least annually. The published version shows its effective date. Where appropriate or required, we notify you of material changes directly. A policy update does not retrospectively authorise an incompatible use of information or change an existing client agreement.

Contact Method & Machine about privacy