Privacy Policy

Last updated: 3 April 2026  |  Effective date: 3 April 2026

1. Definitions

In this Privacy Policy:

• "Personal Information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether recorded in a material form or not (as defined in the Privacy Act 1988).
• "Sensitive Information" means information about an individual's racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, health information, genetic information, biometric information, or membership of a professional or trade association, as defined under APP 1.
• "Services" means all services provided by DevLuxme, including but not limited to web design, web development, search engine optimisation (SEO), digital marketing, social media management, email marketing, e-commerce solutions, content creation, cloud hosting, website maintenance, and digital consulting.
• "Website" means devluxme.com.au and all associated subdomains.
• "You" / "Your" means any individual whose personal information we collect or process, including website visitors, clients, prospective clients, suppliers, and job applicants.

2. Information We Collect

2.1 Information You Provide Directly

We may collect the following personal information when you contact us, request a quote, book a discovery call, subscribe to our newsletter, enter into a service agreement, or otherwise interact with us:

• Full name and title
• Business or company name and ABN/ACN
• Email address
• Phone number(s)
• Postal address and billing address
• Website URL(s)
• Payment information (credit card details, bank account details, billing records)
• Login credentials you create for accounts we manage on your behalf
• Content you provide for your website, marketing materials, or campaigns (which may include photographs, biographical information, testimonials, and reviews)
• Correspondence and communications between you and DevLuxme (including email, phone, chat, and meeting notes)
• Job application materials (resume/CV, cover letter, qualifications, references, work history)
• Any other information you voluntarily provide to us

2.2 Information Collected Automatically

When you visit our Website, we may automatically collect:

• Device information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences
• Usage data: Pages visited, time spent on pages, click patterns, scroll depth, referring/exit URLs, and navigation paths
• Location data: Approximate geographic location based on your IP address
• Cookies and similar technologies: As described in Section 8 below

2.3 Information from Third Parties

We may receive personal information about you from:

• Third-party analytics providers (e.g., Google Analytics)
• Advertising platforms (e.g., Google Ads, Meta/Facebook Ads, LinkedIn Ads)
• Social media platforms where you interact with our profiles
• Referral partners or third parties who introduce you to our services
• Publicly available sources such as business directories, ASIC records, and ABN Lookup
• Payment processors and financial institutions

2.4 Sensitive Information

We do not intentionally collect sensitive information as defined by the Privacy Act 1988. If sensitive information is provided to us unsolicited, we will either destroy or de-identify it (unless we are required by law to retain it) or, if it is reasonably necessary for our functions, we will seek your consent before any further use.

3. How and Why We Use Your Information

We collect and use your personal information only for purposes that are reasonably necessary for, or directly related to, our business functions. These purposes include:

4. Disclosure of Your Information

We may share your personal information with the following categories of recipients, strictly on a need-to-know basis and in compliance with applicable privacy laws:

4.1 Service Providers and Contractors

• Web hosting providers (e.g., Cloudflare, Amazon Web Services, WP Engine)
• Email service providers (e.g., Google Workspace, Mailchimp, ActiveCampaign)
• Payment gateways (e.g., Stripe, PayPal, Square)
• Analytics services (e.g., Google Analytics, Hotjar, Microsoft Clarity)
• Advertising platforms (e.g., Google Ads, Meta Business Suite, LinkedIn Ads)
• CRM and project management tools (e.g., HubSpot, Trello, Asana, Slack)
• Accounting and invoicing software (e.g., Xero, MYOB, QuickBooks)
• Domain registrars and DNS providers
• Subcontractors such as freelance developers, designers, copywriters, or SEO specialists engaged by DevLuxme to deliver Services

All third-party service providers are contractually obligated to handle your data securely and only for the purpose for which it was provided.

4.2 Legal and Regulatory Disclosure

We may disclose your personal information where required or authorised by:

• Australian law, regulation, or court order
• A request from a law enforcement agency or government authority
• The Australian Taxation Office (ATO) or other regulatory bodies
• Legal proceedings or disputes involving DevLuxme

4.3 Business Transfers

In the event of a merger, acquisition, sale of assets, restructuring, or insolvency, your personal information may be transferred to the relevant successor entity. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

4.4 With Your Consent

We may disclose your personal information to other parties with your express informed consent.

4.5 No Sale of Personal Information

We do not sell, rent, trade, or otherwise commercially distribute your personal information to third parties for their own marketing purposes.

5. International Data Transfers

Some of the third-party services we use (e.g., Google, Cloudflare, Stripe, Mailchimp) may process or store data on servers located outside of Australia, including in the United States, European Union, and other jurisdictions.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient:

• Does not breach the Australian Privacy Principles in relation to that information (in accordance with APP 8); or
• Is subject to a law or binding scheme that is substantially similar to the APPs and includes mechanisms for enforcement; or
• Has consented to the transfer after being expressly informed that APP 8.1 will no longer apply.

For individuals in the EU/UK, we ensure that international transfers comply with GDPR requirements through appropriate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions.

6. Data Security

We take the security of your personal information seriously and implement reasonable technical and organisational measures to protect it from misuse, interference, loss, unauthorised access, modification, or disclosure. These measures include:

• Encryption: SSL/TLS encryption on all web traffic; encryption of stored sensitive data (e.g., payment records)
• Access controls: Role-based access restrictions ensuring only authorised personnel can access personal information
• Authentication: Use of strong passwords, multi-factor authentication (MFA), and secure credential management
• Infrastructure security: Firewalls, intrusion detection systems, DDoS protection, and regular security patching
• Backups: Regular encrypted backups of data with secure offsite storage
• Staff training: All team members and contractors are trained on data privacy obligations and secure data handling practices
• Vendor assessment: Third-party service providers are evaluated for compliance with applicable data protection standards before engagement
• Physical security: Physical access to devices and workspaces containing personal information is restricted

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data, but we commit to promptly addressing any security incidents in accordance with our obligations (see Section 11).

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention practices include:

When personal information is no longer needed, we will take reasonable steps to securely destroy or permanently de-identify it.

8. Cookies and Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help the website recognise your device and remember information about your visit.

8.2 Types of Cookies We Use

8.3 Third-Party Cookies

We use cookies set by the following third-party services:

• Google Analytics — website traffic analysis and reporting
• Google Ads / Google Tag Manager — conversion tracking and remarketing
• Meta (Facebook) Pixel — conversion tracking, audience building, and remarketing
• LinkedIn Insight Tag — conversion tracking and professional audience targeting
• Hotjar / Microsoft Clarity — heatmaps, session recordings, and user experience analysis
• Cloudflare — security, performance, and bot detection

8.4 Managing Cookies

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our Website. You can also opt out of specific tracking services:

• Google Analytics: Google Analytics Opt-Out Browser Add-on
• Google Ads personalisation: Google Ads Settings
• Meta (Facebook): Facebook Ad Preferences
• General opt-out: Your Online Choices (Australia)

9. Your Rights

9.1 Rights Under the Australian Privacy Act

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you (APP 12)
• Request correction of any personal information that is inaccurate, out-of-date, incomplete, irrelevant, or misleading (APP 13)
• Complain about a breach of the APPs (see Section 14)
• Opt out of receiving direct marketing communications at any time (APP 7)
• Request anonymity or use a pseudonym when dealing with us, where it is lawful and practicable (APP 2)

9.2 Additional Rights Under GDPR (EU/UK Residents)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following additional rights under the GDPR:

• Right of access — to obtain confirmation and a copy of your personal data
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — to request deletion of your data in certain circumstances
• Right to restriction of processing — to request that we limit processing of your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing
• Right not to be subject to automated decision-making — including profiling that produces legal or significant effects

To exercise any of these rights, please contact us using the details in Section 15. We will respond to all legitimate requests within 30 days (Australian) or one calendar month (GDPR). We may request verification of your identity before processing your request.

10. Direct Marketing and Communications

We may use your personal information to send you marketing communications about our Services, industry insights, and special offers, but only where:

• You have given your express opt-in consent (e.g., by subscribing to our newsletter); or
• You are an existing client and the communications relate to similar services, and you have not opted out

Every marketing email we send includes a clear and functional unsubscribe link. You may also opt out at any time by contacting us directly. We will process your opt-out request promptly and within 5 business days at most.

We comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth), and we do not send unsolicited commercial electronic messages without consent.

11. Data Breach Notification

In the event of an eligible data breach (as defined under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988), we will:

1. Conduct a prompt assessment to determine if the breach is likely to result in serious harm to any affected individual
2. Take immediate steps to contain the breach and mitigate any potential harm
3. Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable
4. Notify all affected individuals as soon as practicable, including details of the breach, the information involved, and recommended steps they should take

For individuals covered by the GDPR, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach that poses a risk to individuals' rights and freedoms, and will notify affected individuals without undue delay where the breach is likely to result in a high risk.

12. Third-Party Websites and Services

Our Website may contain links to third-party websites, platforms, or services that are not owned or controlled by DevLuxme. This Privacy Policy applies only to our Website and Services. We are not responsible for the privacy practices, content, or security of third-party websites. We strongly encourage you to review the privacy policy of every website you visit.

When we integrate third-party tools or platforms into your project (e.g., WooCommerce, Shopify, Google Analytics, payment gateways), those platforms operate under their own privacy policies. We will inform you of any significant third-party integrations during the project engagement process.

13. Children's Privacy

Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under 18 without parental consent, we will take immediate steps to delete that information. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

14. Complaints

If you believe that we have breached the Australian Privacy Principles or mishandled your personal information, you are entitled to make a complaint. Please follow these steps:

1. Contact us first — Submit your complaint in writing to our Privacy Officer using the contact details in Section 15. Please include a detailed description of the issue and the outcome you seek.
2. Our response — We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. We may need to contact you for further information.
3. Escalation — If you are not satisfied with our response, or if we do not respond within 30 days, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

For EU/UK residents, you also have the right to lodge a complaint with your local data protection supervisory authority.

15. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or your personal information, please contact our Privacy Officer:

16. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make changes, we will:

• Update the "Last updated" date at the top of this page
• Post the revised policy on our Website
• For material changes that significantly affect how we use your personal information, we will take reasonable steps to notify you (e.g., via email or a prominent notice on our Website)

Your continued use of our Website or Services after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to periodically review this page for the latest information.

17. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Australian Capital Territory and the Commonwealth of Australia. Any disputes arising under or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of the Australian Capital Territory.

18. Consent

By using our Website or engaging our Services, you consent to the collection, use, storage, and disclosure of your personal information as described in this Privacy Policy. Where specific consent is required (e.g., for marketing communications, cookies, or sensitive information), we will obtain that consent separately in a clear and informed manner.

You may withdraw your consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.