Privacy Policy.

1. Introduction

At Codex Digital Pty Ltd (“Codex”, “we”, “our” or “us”), we believe trust is built through transparency. Whether you’re exploring our website, engaging us to deliver a digital project, using our AI-powered services or partnering with us to manage critical digital infrastructure, we recognise the importance of protecting the information you share with us.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information across our business. It also explains your rights, the choices available to you, and the measures we take to ensure information is handled responsibly and securely.

As a digital consultancy, our business extends beyond designing and developing websites. We provide digital strategy, software engineering, AI consulting, managed hosting, cloud infrastructure, cybersecurity, website maintenance, integrations, support services and AI-powered customer experiences. Because of the breadth of these services, the information we collect and process may differ depending on how you interact with us.

Our goal is simple:

We only collect information that is reasonably necessary to deliver exceptional digital services, improve our products, maintain secure systems and build long-term relationships with our clients.

We do not sell personal information.

We do not collect information we don’t need.

We believe privacy should be treated as an essential part of every digital experience rather than an afterthought.

This Privacy Policy has been prepared in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where applicable, we also consider internationally recognised privacy and information security practices when designing our systems and processes.

By accessing our website, communicating with Codex or using our services, you acknowledge that you have read this Privacy Policy.

2. About Codex Digital

Codex Digital Pty Ltd is an Australian digital consultancy specialising in designing, building and supporting digital experiences for organisations across a range of industries.

Our services include, but are not limited to:

• Website design and development
• Digital strategy and consulting
• Branding and digital identity
• User experience (UX) and user interface (UI) design
• AI strategy and advisory
• AI Concierge and conversational AI solutions
• Knowledge management and Retrieval-Augmented Generation (RAG) systems
• Website hosting and managed infrastructure
• Cloud architecture
• Website maintenance and support
• Cybersecurity services
• Systems integration
• API development
• Performance optimisation
• Content management systems
• Ongoing managed digital services

Depending on the services you engage us to provide, we may collect different categories of information relevant to that engagement.

3. Scope of this Privacy Policy

This Privacy Policy applies to personal information collected through:

• the Codex Digital website;
• enquiries submitted through our website;
• contact forms;
• email correspondence;
• telephone conversations;
• meetings with our team;
• AI-powered chat experiences, including our AI Concierge;
• project discovery sessions;
• client onboarding;
• proposals and quotations;
• managed hosting services;
• website maintenance services;
• cloud infrastructure services;
• client support requests;
• digital platforms developed and operated by Codex where this Privacy Policy is referenced; and
• any other interaction where we collect personal information in the course of conducting our business.

This Privacy Policy applies whether you are:

• visiting our website;
• making an enquiry;
• requesting a proposal;
• attending a meeting;
• becoming a client;
• representing an existing client;
• interacting with one of our AI services; or
• otherwise communicating with Codex.

Where a separate agreement, statement of work or client contract contains privacy or confidentiality obligations, those obligations operate in addition to this Privacy Policy.

4. Key Definitions

To make this Privacy Policy easier to understand, we use the following terms throughout this document.

Personal Information

“Personal Information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not.

Examples include:

• your name;
• email address;
• telephone number;
• business contact details;
• job title;
• IP address where it identifies an individual;
• correspondence with us;
• information provided during meetings;
• AI conversation history linked to you; and
• any other information that could reasonably identify you.

Client

A Client means any organisation or individual that engages Codex to provide professional services.

Website

Website refers to websites owned or operated by Codex Digital Pty Ltd where this Privacy Policy is published or referenced.

AI Concierge

Our AI Concierge is an AI-powered conversational assistant designed to answer questions, provide information about our services, assist with enquiries, qualify opportunities, recommend solutions and, where appropriate, help arrange meetings with our team.

It is intended to improve your experience by providing timely and relevant information while allowing more complex enquiries to be escalated to a member of our team.

Additional information about how our AI systems operate is provided later in this Privacy Policy.

AI Services

AI Services means any artificial intelligence, machine learning or generative AI capability made available by Codex, including conversational assistants, knowledge retrieval systems, internal AI tools and future AI-enabled products or services.

Third Party Service Provider

A Third Party Service Provider is an organisation engaged by Codex to perform services on our behalf or to support the delivery of our services.

Examples include providers of:

• cloud infrastructure;
• website hosting;
• email delivery;
• customer relationship management (CRM);
• analytics;
• AI platforms;
• booking systems;
• monitoring tools;
• cybersecurity services;
• payment processing; and
• communications services.

These providers are only given access to information reasonably necessary for them to perform their functions.

5. The Information We Collect

The information we collect depends on how you interact with Codex.

In many cases, you can browse our website without directly identifying yourself. However, some information is collected automatically to help us operate, secure and improve our digital services.

Where you choose to contact us, request a proposal, engage our services or interact with our AI Concierge, we may collect additional information relevant to that interaction.

The categories of information we collect include the following.

Information You Provide

You may voluntarily provide information including:

• your name;
• company name;
• organisation;
• position or job title;
• email address;
• telephone number;
• postal address;
• project requirements;
• business objectives;
• budget information where relevant;
• meeting preferences;
• communication preferences;
• files or documents you choose to share;
• correspondence with our team; and
• any other information you voluntarily provide.

Providing this information is generally optional. However, without certain information we may be unable to respond to your enquiry, prepare a proposal or deliver requested services.

Information Collected Automatically

When you access our website, we may automatically collect technical information including:

• IP address;
• browser type and version;
• operating system;
• device information;
• screen resolution;
• pages viewed;
• referring website;
• date and time of access;
• session identifiers;
• website performance information;
• diagnostic information;
• security logs; and
• cookie identifiers.

This information helps us understand how our website is being used, identify technical issues, improve performance, maintain security and better understand visitor behaviour.

Information Generated Through Your Use of Our Services

Depending on the services you use, we may generate additional information as part of delivering those services.

Examples include:

• support history;
• project records;
• meeting notes;
• deployment records;
• hosting logs;
• maintenance records;
• client communications;
• service requests;
• infrastructure monitoring information;
• AI conversation history;
• booking records; and
• service analytics.

This information is primarily used to operate our services, provide ongoing support and improve the quality and reliability of our digital platforms.

6. How We Collect Information

We collect information in a variety of ways depending on how you interact with us.

Information may be collected when you:

• visit our website;
• complete a contact form;
• subscribe to communications;
• communicate with us by email;
• speak with us by telephone;
• attend meetings;
• participate in workshops or discovery sessions;
• request a proposal or quotation;
• engage us to deliver services;
• use our AI Concierge;
• book meetings through our website;
• submit support requests;
• interact with websites or applications developed by Codex where applicable; or
• otherwise communicate with us during the ordinary course of business.

We also collect certain technical information automatically through cookies, analytics technologies, website security systems and infrastructure monitoring tools. This information helps us maintain the performance, reliability and security of our digital platforms.

Where reasonable and practicable, we will collect personal information directly from you. In some circumstances, we may receive information from third parties acting on your behalf, such as colleagues, authorised representatives or referral partners.

7. AI Concierge and AI-Powered Services

Codex develops and operates AI-powered services designed to improve the way people discover information, communicate with our team and access our expertise.

These services are intended to enhance your experience by providing faster responses, surfacing relevant information and streamlining common interactions. They are designed to assist our team—not replace professional advice or human decision-making.

Where AI is used, we aim to be transparent about how it works, the information it uses and the role it plays in delivering our services.

Our AI services may evolve over time as technology develops and new capabilities become available.

How Our AI Concierge Works

Our AI Concierge is an interactive conversational assistant available through our website and other digital channels.

It has been designed to help visitors:

• learn about Codex and our services;
• explore solutions relevant to their business;
• answer common questions;
• identify suitable service offerings;
• recommend relevant content and resources;
• assist with project enquiries;
• help arrange meetings with our team; and
• escalate more complex enquiries to a member of Codex where appropriate.

Unlike a traditional chatbot that follows scripted responses, our AI Concierge may generate responses dynamically using approved information sources and conversational context.

While we strive to provide accurate and helpful responses, AI-generated content may occasionally be incomplete, outdated or incorrect. For this reason, important commercial, contractual or technical decisions should not be based solely on AI-generated responses without confirmation from a member of our team.

Retrieval-Augmented Generation (RAG)

To improve the quality and relevance of responses, our AI systems may use a technique known as Retrieval-Augmented Generation (RAG).

Rather than relying solely on the underlying AI model, RAG allows our systems to retrieve information from approved Codex knowledge sources before generating a response.

Depending on the context, these knowledge sources may include:

• publicly available information published by Codex;
• service documentation;
• knowledge articles;
• technical documentation;
• frequently asked questions;
• internal business information authorised for AI retrieval;
• product documentation; and
• other information specifically made available for conversational use.

This approach helps improve factual consistency while reducing the likelihood of fabricated or misleading responses.

Our knowledge sources are regularly reviewed and updated as part of our ongoing service improvement processes.

Information Processed During AI Conversations

When you interact with our AI Concierge or other AI-powered services, we may process information including:

• questions you ask;
• prompts you submit;
• responses generated by the AI;
• files or documents you choose to upload;
• conversation history;
• conversation timestamps;
• session identifiers;
• technical information associated with your session;
• browser and device information;
• meeting requests;
• contact details you voluntarily provide; and
• feedback submitted about AI responses.

The information processed will depend on the nature of your interaction.

We recommend that you do not submit sensitive personal information, financial information, government identification documents or other confidential information unless specifically requested as part of a legitimate business process.

Conversation History

To provide a more useful and consistent experience, conversations with our AI services may be temporarily or permanently stored.

Conversation history may be used to:

• maintain conversational context during your session;
• continue discussions across multiple interactions where appropriate;
• improve service quality;
• troubleshoot technical issues;
• investigate suspected misuse;
• respond to enquiries;
• improve our internal knowledge resources;
• maintain appropriate business records; and
• protect the security and integrity of our systems.

Conversation history may be associated with your enquiry where you choose to provide identifying information such as your name or email address.

Anonymous visitors may still have conversations stored using technical session identifiers without directly identifying them.

Human Review

Although many interactions are handled automatically, authorised members of the Codex team may review AI conversations where reasonably necessary.

Examples include:

• responding to enquiries;
• preparing proposals;
• arranging meetings;
• providing client support;
• investigating technical issues;
• monitoring service quality;
• improving our knowledge base;
• investigating suspected misuse;
• complying with legal obligations; or
• protecting the security of our systems.

Human review is limited to personnel with appropriate business responsibilities and access permissions.

AI Learning and Improvement

We continually improve our AI systems to deliver more accurate, useful and relevant experiences.

This may involve reviewing conversation trends, identifying gaps in our knowledge base, improving prompts, refining workflows and enhancing the quality of information available to our AI services.

Where conversation data is used for service improvement, we take reasonable steps to minimise unnecessary personal information and focus on improving system performance rather than profiling individuals.

Our objective is to improve the quality of our services—not to build profiles about our users.

AI Limitations

Artificial intelligence is an evolving technology and should not be considered infallible.

While we make reasonable efforts to ensure the quality of information generated by our AI systems, responses may occasionally:

• contain inaccuracies;
• be incomplete;
• reflect outdated information;
• misunderstand context;
• require clarification; or
• recommend that you speak with a member of our team.

Our AI services are provided to assist users in accessing information more efficiently and should not be interpreted as professional legal, financial, accounting, engineering or other regulated advice.

Where appropriate, our AI systems may recommend contacting a member of Codex for tailored advice.

8. Contact Forms, Project Enquiries and Business Communications

When you contact Codex through our website, email, telephone or other communication channels, we collect the information necessary to respond to your enquiry and provide the services you have requested.

Depending on the nature of your enquiry, this may include:

• your name;
• organisation;
• contact details;
• project requirements;
• preferred timeframe;
• estimated budget where voluntarily provided;
• technical requirements;
• existing technology platforms;
• project documentation;
• correspondence; and
• any other information you choose to provide.

We use this information to:

• respond to enquiries;
• prepare proposals and quotations;
• arrange meetings;
• understand your business requirements;
• identify suitable services;
• communicate throughout the sales process;
• deliver projects;
• provide support; and
• maintain appropriate business records.

If you become a client, information collected during the enquiry process may form part of your client records.

9. Meeting Bookings

Where you choose to schedule a meeting with Codex using an online booking system or through our website, we collect the information reasonably necessary to organise and manage that meeting.

This may include:

• your name;
• organisation;
• email address;
• telephone number;
• preferred meeting times;
• meeting topic;
• project information;
• calendar preferences; and
• any additional information you voluntarily provide.

Booking information is used solely to arrange meetings, communicate with attendees, prepare for discussions and maintain appropriate business records.

Meeting confirmations, reminders and related communications may be sent electronically.

Where meetings are conducted using third-party scheduling or video conferencing platforms, those providers may also process information in accordance with their own privacy policies.

10. Client Communications and Service Delivery

Throughout the course of delivering our services, we may collect and generate information relating to client engagements.

This may include:

• project correspondence;
• meeting notes;
• workshop outputs;
• design feedback;
• technical documentation;
• support requests;
• project approvals;
• deployment records;
• service requests;
• maintenance activities;
• infrastructure changes; and
• ongoing operational communications.

We use this information to deliver contracted services, maintain project continuity, provide ongoing support, manage client relationships and ensure the quality and reliability of the services we provide.

Where appropriate, these records may be retained as part of our normal business operations in accordance with our data retention practices.

11. Managed Hosting and Infrastructure Services

In addition to digital strategy, design and software development, Codex provides managed hosting, infrastructure management and ongoing operational support for many of the digital platforms we build.

Where we provide these services, we may process information necessary to securely operate, monitor and maintain client environments.

Depending on the services provided, this may include:

• server and application logs;
• infrastructure monitoring data;
• website availability and uptime information;
• deployment records;
• software version information;
• performance metrics;
• diagnostic information;
• security events;
• authentication logs;
• backup records;
• maintenance activities;
• domain and DNS configuration; and
• system health information.

This operational information is collected to support the reliable delivery of our managed services and is not used for marketing or unrelated commercial purposes.

We only access client environments where reasonably necessary to provide contracted services, perform maintenance, investigate incidents or fulfil our legal and contractual obligations.

Infrastructure Monitoring

We continuously monitor infrastructure and digital platforms to help maintain service availability, identify technical issues and protect against unauthorised activity.

Monitoring activities may include:

• availability monitoring;
• application health monitoring;
• resource utilisation;
• network performance;
• security monitoring;
• error reporting;
• deployment verification;
• backup verification;
• SSL certificate monitoring;
• domain monitoring; and
• operational alerting.

Monitoring data is primarily technical in nature and is used to maintain the reliability, stability and security of our managed environments.

Maintenance and Support

As part of our managed services, we may access client systems to:

• perform software updates;
• deploy approved changes;
• investigate incidents;
• resolve support requests;
• improve performance;
• apply security updates;
• restore backups where required;
• monitor platform health; and
• maintain operational continuity.

Where access to client systems is required, it is restricted to authorised personnel with responsibilities relevant to the services being delivered.

12. Cookies and Similar Technologies

Our website uses cookies and similar technologies to improve functionality, enhance user experience, understand how visitors interact with our website and support the secure operation of our digital platforms.

Cookies are small text files that are stored on your device when you visit a website. They allow websites to recognise your browser, remember preferences and collect information about how services are used.

We use cookies for several purposes, including:

• maintaining website functionality;
• remembering user preferences;
• improving website performance;
• understanding visitor behaviour;
• measuring the effectiveness of content;
• maintaining secure user sessions;
• detecting fraudulent or malicious activity; and
• supporting analytics and reporting.

Where appropriate, we may also use similar technologies such as local storage, session identifiers or other browser-based technologies that perform comparable functions.

Most web browsers allow you to manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality or performance of parts of our website.

Analytics

We use analytics technologies to better understand how visitors use our website and digital services.

Analytics information helps us:

• understand which content is most useful;
• improve navigation and user experience;
• identify technical issues;
• monitor website performance;
• evaluate marketing effectiveness;
• understand trends over time; and
• make informed decisions about future improvements.

Where practical, we seek to analyse information in aggregated or de-identified form.

Analytics data is not used to make automated decisions about individuals.

13. Security of Personal Information

Protecting the information entrusted to us is an important part of how we operate.

We maintain a range of administrative, technical and organisational safeguards designed to protect personal information against unauthorised access, disclosure, alteration, misuse or loss.

Our security practices evolve over time to reflect changing technologies, emerging threats and recognised industry standards.

Depending on the services provided, these measures may include:

• role-based access controls;
• strong authentication practices;
• encryption of data in transit where appropriate;
• secure hosting environments;
• network security controls;
• monitoring and alerting;
• vulnerability management;
• software updates and patch management;
• backup and recovery procedures;
• audit logging;
• least-privilege access principles;
• secure development practices; and
• ongoing review of our operational controls.

While we take reasonable steps to protect personal information, no method of transmitting information over the internet or storing information electronically can be guaranteed to be completely secure.

Accordingly, we cannot guarantee absolute security, although we continually work to minimise risk and improve our security practices.

Data Breaches

If we become aware of a data breach involving personal information, we will investigate the incident promptly and take reasonable steps to minimise any potential impact.

Where required under applicable law, including the Notifiable Data Breaches scheme established under the Privacy Act 1988 (Cth), we will notify affected individuals and relevant regulatory authorities.

We continually review incidents and security events to strengthen our systems and reduce the likelihood of future occurrences.

14. Disclosure of Personal Information

We only disclose personal information where it is reasonably necessary to operate our business, deliver our services or comply with legal obligations.

Depending on the circumstances, information may be disclosed to:

• service providers supporting the delivery of our services;
• cloud infrastructure providers;
• managed hosting providers;
• customer relationship management platforms;
• communication providers;
• booking and scheduling providers;
• analytics providers;
• cybersecurity providers;
• professional advisers including accountants, auditors and legal advisers;
• regulatory authorities where required by law;
• law enforcement agencies where legally required; or
• parties involved in a corporate transaction affecting Codex.

We do not sell personal information to third parties.

We also do not disclose personal information for unrelated third-party marketing purposes.

15. Third-Party Service Providers

To deliver our services efficiently and securely, we engage carefully selected third-party providers.

Depending on the services you use, these providers may assist with:

• website hosting;
• cloud infrastructure;
• artificial intelligence services;
• email delivery;
• appointment scheduling;
• customer relationship management;
• website analytics;
• monitoring and observability;
• cybersecurity;
• domain management;
• payment processing;
• software development; and
• business communications.

These providers are contractually or otherwise required to handle information appropriately and only for the purposes of providing services to Codex or our clients.

Where practical, we select providers that demonstrate strong security and privacy practices.

As our business and technology stack evolve, the providers we use may change from time to time. This Privacy Policy therefore describes the categories of providers we engage rather than maintaining a fixed list of vendors.

16. International Data Processing

Some of the service providers we engage may store or process information outside Australia.

This is common when using cloud computing platforms, AI technologies, software-as-a-service (SaaS) providers and global technology infrastructure.

Where information is transferred internationally, we take reasonable steps to ensure it is handled appropriately, including by:

• engaging reputable service providers;
• assessing security practices where appropriate;
• using contractual protections where available;
• limiting access to authorised personnel; and
• applying internal governance processes when selecting providers.

By using our website or services, you acknowledge that information may be processed in jurisdictions outside Australia where necessary to deliver the services you have requested.

17. Data Retention

We retain personal information only for as long as it is reasonably necessary to fulfil the purposes for which it was collected, to deliver our services, meet our contractual and legal obligations, resolve disputes, maintain appropriate business records and protect the integrity of our systems.

Retention periods vary depending on the nature of the information, the services provided and applicable legal, regulatory and operational requirements.

Examples include:

 

When information is no longer required, we will take reasonable steps to securely delete, anonymise or de-identify it, unless we are required or authorised by law to retain it for a longer period.

Where complete deletion is not immediately practicable, such as where information forms part of encrypted backups or archived disaster recovery systems, we will continue to protect that information until it is securely removed through our normal retention processes.

18. Marketing Communications

From time to time, Codex may send communications relating to our services, insights, events, publications or other information that may be relevant to your business.

We will only send marketing communications where permitted by applicable law or where you have requested or consented to receive them.

Marketing communications may include:

• industry insights;
• articles and resources;
• invitations to events or webinars;
• announcements regarding new services;
• product updates;
• company news; and
• other information we believe may be relevant to organisations interested in our services.

You may unsubscribe from marketing communications at any time by following the unsubscribe instructions contained within the communication or by contacting us directly.

Operational communications relating to active projects, support requests, invoices, security notifications or contractual matters are considered essential service communications and may continue where necessary.

19. Your Privacy Rights

We believe individuals should have meaningful control over their personal information.

Subject to applicable law, you may request to:

• access personal information we hold about you;
• correct inaccurate or incomplete information;
• update your contact details;
• request deletion of personal information where appropriate;
• withdraw consent where processing is based on consent;
• enquire about how information has been handled; or
• lodge a complaint regarding our privacy practices.

Before responding to certain requests, we may need to verify your identity to protect your information and the privacy of others.

We will respond to privacy requests within a reasonable period and in accordance with our legal obligations.

20. Australian Privacy Principles

Codex is committed to managing personal information responsibly and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

These principles govern how organisations collect, use, disclose, store and manage personal information.

Among other things, they require organisations to:

• collect only information reasonably necessary for legitimate business purposes;
• use information fairly and transparently;
• protect information through appropriate security measures;
• provide individuals with access to their information where appropriate;
• correct inaccurate information; and
• maintain clear privacy practices.

We regularly review our privacy practices and internal processes to help ensure they remain appropriate for the services we provide and the evolving digital landscape.

21. Complaints

If you believe we have handled your personal information in a manner that is inconsistent with this Privacy Policy or applicable privacy legislation, we encourage you to contact us in the first instance so we can investigate your concerns.

Privacy enquiries and complaints should be directed to:

Privacy Officer
Codex Digital Pty Ltd
Level 7, 50 Berry Street
North Sydney NSW 2060
Email: hello@codexdigital.com.au
Phone: (02) 8384 6531

We will acknowledge receipt of your complaint and investigate the matter as promptly as reasonably practicable.

If you are not satisfied with our response, you may be entitled to refer your complaint to the Office of the Australian Information Commissioner (OAIC).

Further information is available from the OAIC at www.oaic.gov.au.