SnapOps™ Privacy Policy

1 Who we are

1.1 This Privacy Policy explains how Peter Baker, ABN 63 413 993 900, trading as SnapOps and Resolu (we, us or our), collects, holds, uses and discloses personal information in connection with SnapOps.

1.2 SnapOps supplies Recovery-First Cyber Protection to Australian micro-businesses. Resolu may provide separately authorised recovery, remediation, support and billing administration. Both names are operated by the same sole trader under the same ABN.

1.3 We aim to handle personal information openly and responsibly and to follow the Australian Privacy Principles as good practice. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles to the extent they apply to us.

2 Scope

2.1 This policy applies to information handled through our website, enquiries, subscriptions, billing, deployment, endpoint protection, security monitoring, patch management, device recovery technology, backup, alerts, support, recovery work and business administration.

2.2 It applies to personal information about customers, prospective customers, their owners, personnel, contractors and other individuals whose information is contained in Covered Technology or selected backup data.

2.3 Third-party products and websites have their own privacy terms. This policy explains how we use providers as part of SnapOps; it does not replace a provider's policy where that provider deals directly with you.

3 Information we may collect

• business and contact details, including names, roles, email addresses, telephone numbers and service addresses;
• subscription, quote, Service Order, invoice, payment-status and transaction information;
• details of authorised contacts, users, devices, accounts and the Customer's Recovery Scope;
• device identifiers, operating-system and application details, configuration, patch status, network information, storage use, IP address and security posture;
• security events, detections, quarantines, rollback activity, alerts, logs, system health and backup-job results;
• support records, correspondence, call notes, service history, recovery instructions, feedback and complaints;
• selected backup content and metadata, which may include business documents, email, contacts, calendars, shared files and other information chosen by the Customer;
• technical information generated through remote access, investigation, recovery, remediation and testing; and
• website information such as browser type, approximate location, referring page, pages viewed, cookie identifiers and analytics data, depending on the services enabled.

4 Customer data and sensitive information

4.1 We do not ordinarily ask customers to give us sensitive information about individuals. However, protected devices and selected backups may contain health, financial, identity, employment or other sensitive information. We and our providers may store or encounter it incidentally while supplying, supporting or recovering the service.

4.2 The Customer determines the Recovery Scope and is responsible for having authority to provide and instruct us to process the selected information, including information relating to personnel, clients and other individuals.

4.3 We seek to access file content only where reasonably necessary for setup, verification, troubleshooting, recovery, a lawful instruction or security. Automated systems may inspect files, processes and metadata to identify threats and operate protective features.

5 How we collect information

5.1 We usually collect information directly from you or your authorised contact when you enquire, subscribe, accept a Service Order, make a payment, provide access, choose a Recovery Scope or request assistance.

5.2 We also collect information automatically from installed service software, protected devices, connected accounts, backup jobs, service portals, website technologies and security events.

5.3 We may receive information from your authorised personnel, our billing and business systems, cybersecurity and backup providers, cloud-storage providers, payment providers and professional advisers.

6 Why we use and disclose information

• respond to enquiries, assess suitability and establish the Recovery Scope;
• create, administer and renew subscriptions, invoices and payments;
• deploy, configure, maintain and support the service;
• monitor security and system health, apply supported updates, detect threats and take authorised protective action;
• perform selected backup, retention, immutability, verification, export and recovery functions;
• investigate incidents and provide separately authorised recovery or remediation;
• communicate service notices, backup failures, security alerts, renewal information and changes;
• prevent fraud, misuse, security threats and unlawful activity;
• maintain financial, insurance, security and business records, handle complaints and exercise legal rights; and
• meet legal, tax, insurance and regulatory obligations.

We do not sell customer lists or personal information.

7 Credentials, remote access and protective actions

7.1 We may require administrative access, service accounts, application permissions or remote access to Covered Technology. Where practicable, use delegated access rather than sharing an individual's password and use multi-factor authentication.

7.2 We do not intentionally record personal passwords. Credentials or access tokens required by service software may be stored securely by us or a provider for the period needed to operate the service.

7.3 Depending on configuration, automated tools may block, quarantine, isolate or roll back an event. We record relevant technical and audit information and limit human access to people who reasonably require it.

8 Backup content, retention and immutability

8.1 Selected backup content is encrypted in transit and stored with an authorised cloud-storage provider in the West US region. Relevant account, operational and support information may be stored separately from the backup content.

8.2 The Customer selects or approves backup sources, history and any immutable period. Unless otherwise recorded, our recommended default immutable period is 30 days. During an immutable period, protected data cannot ordinarily be altered or deleted, including in response to an early cancellation or deletion request.

8.3 After the paid service period ends, accessible backup data is ordinarily retained for up to 30 days to allow a requested export or recovery, unless the Service Order states otherwise. Data subject to an unexpired immutable period remains until that period expires. Deletion is then initiated in accordance with provider processes.

8.4 Recovery, export and hands-on restoration may incur additional charges. The Customer should request any required copy before the applicable retention period ends.

9 Service providers and disclosures

9.1 We use service providers for cybersecurity protection, security monitoring, device recovery technology, backup management, cloud storage, remote support, website hosting and analytics, customer and service administration, billing, communications, payment processing, professional advice and insurance.

9.2 We disclose only information reasonably necessary for a relevant service, another authorised purpose, the protection of people or systems, or a legal requirement. Providers handle information under their terms, contracts and applicable privacy and security obligations.

9.3 We may also disclose information to regulators, courts, law-enforcement bodies, insurers, advisers or another person where authorised or required by law, or with the relevant consent.

10 Overseas processing

10.1 Although SnapOps serves Australian businesses, some providers store or process information outside Australia. Backup content is currently configured for the West US region. Depending on the provider, service component, support location and account setting, other personal information may be processed in the United States, Canada, India, the Philippines and the Netherlands.

10.2 Provider locations and infrastructure may change. Where Australian privacy law applies, we take the reasonable steps required for overseas disclosure and consider contractual, technical and organisational protections. You may contact us for current information about material provider arrangements.

11 Cookies and website analytics

11.1 Our website and associated forms may use cookies, local storage, analytics and similar technologies to operate the site, remember choices, understand usage and improve performance.

11.2 You can use available cookie controls and browser settings to manage many cookies. Blocking some technologies may affect functionality. The services actually enabled should be described in the published cookie notice.

12 Direct marketing and service communications

12.1 We may send relevant information or offers where you have consented or where otherwise permitted by law. Commercial electronic messages will identify the sender and provide a functional unsubscribe method. You may opt out at any time.

12.2 We may still send essential subscription, billing, renewal, operational, backup, privacy and security communications that are not marketing.

13 Security

13.1 We take reasonable steps appropriate to the information and service to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

13.2 Measures may include access controls, multi-factor authentication, encryption, immutable storage settings, endpoint security, audit logging, provider review, confidentiality obligations, secure remote-access methods and limiting access to people who need it.

13.3 No internet transmission, device or storage system is completely secure. Customers should protect credentials, maintain authorised-user lists and promptly report suspected unauthorised access, device loss or unusual activity.

14 Retention and deletion

14.1 We retain personal information only for as long as reasonably necessary to provide and support the service, maintain business and security records, resolve disputes, exercise rights or meet legal, tax, insurance and contractual obligations.

14.2 Financial and transaction records may be kept for legally required periods. Security logs, service records, consent and configuration records may be retained while reasonably relevant. Backup content follows section 8.

14.3 When information is no longer required, we take reasonable steps to delete, destroy or de-identify it, subject to lawful retention obligations, an authorised immutable period, provider backup cycles, audit requirements and technical limitations.

15 Access and correction

15.1 An individual may ask for access to personal information we hold about them or ask us to correct it by contacting hello@snapops.com.au. We may need to verify identity, authority and whether the request should be handled through the Customer that controls the relevant business data.

15.2 We will respond within the period required by applicable law. If we refuse a request, we will give reasons and available complaint options where required. We may be unable to delete data before an authorised immutable period expires.

16 Privacy enquiries and complaints

16.1 Contact Peter at hello@snapops.com.au or 02 7912 0137 and provide enough information for us to investigate. We aim to acknowledge and respond to a privacy complaint within 30 days. If more time is reasonably required, we will explain why.

16.2 If you are not satisfied and the Privacy Act applies, you may be able to complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or 1300 363 992.

17 Data breaches

17.1 If we suspect unauthorised access to, disclosure of or loss of personal information, we will take reasonable steps to contain and assess the incident, work with relevant customers and providers and reduce potential harm.

17.2 Where the Notifiable Data Breaches scheme or another notification obligation applies, we will notify affected individuals and the relevant regulator as required. A Customer may also have its own contractual, professional or regulatory notification duties.

18 Automated decisions

18.1 Service software may take automated protective action against devices, files or processes. We do not currently arrange for computer programs to use personal information to make decisions that could reasonably be expected to significantly affect an individual's rights or interests without meaningful human involvement.

18.2 If this changes, we will update this policy as required by applicable law.

19 Changes to this policy

19.1 We may update this policy when our services, providers, storage locations, information practices or legal obligations change. We will publish the current version and effective date and provide additional notice where appropriate for a material change.

20 Contact

Privacy Contact
Peter Baker trading as SnapOps™ and Resolu
ABN 63 413 993 900
Email: hello@snapops.com.au
Telephone: 02 7912 0137
North Ryde, New South Wales, Australia