// 01. Who We Are

XCOM Space ("XCOM Space", "we", "us", or "our") is an Australian research and technology organisation specialising in cyber security, resilience for GNSS and space-enabled systems. We are incorporated in Australia and operate at xcomspace.com.

This Privacy Policy is made in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Contact: contact@xcomspace.com

// 02. Information We Collect

We may collect the following types of personal information:

• Contact information — name, email address, phone number, organisation
• Enquiry details — information you provide when contacting us or submitting forms
• Technical data — IP address, browser type, pages visited, time and date of access
• Business information — ABN, company name, and details provided in commercial engagements

We do not collect sensitive information (such as health or financial information) unless specifically required for a contracted service and with your explicit consent.

// 03. How We Collect Information

We collect personal information:

• Directly from you when you contact us, submit an enquiry or engage our services
• Through our website using cookies and analytics tools
• From publicly available sources such as LinkedIn or government registers, in the course of business development

// 04. Why We Use Your Information

We use your personal information to:

• Respond to your enquiries and provide requested services
• Deliver cyber security assessments, research and advisory services under contract
• Send relevant updates or service information (with your consent)
• Comply with legal, regulatory and contractual obligations
• Improve our website and service offerings

We will not use your personal information for any purpose incompatible with the reason it was collected without your consent.

// 05. Disclosure of Personal Information

We may share your personal information with:

• Service providers — trusted third-party providers assisting in service delivery, under confidentiality obligations
• Government and regulatory bodies — where required by law, including the ASD, AFP, or other authorised agencies
• Research partners — only in anonymised or aggregated form, unless specific written consent is obtained

We do not sell, rent or trade your personal information to any third party.

// 06. Overseas Disclosure

XCOM Space is an Australian-based organisation. We do not routinely transfer personal information overseas. Where overseas disclosure is required (for example, through internationally hosted software platforms), we take reasonable steps to ensure recipients handle your information in accordance with the Australian Privacy Principles or an equivalent standard.

// 07. Data Security

As a cyber security organisation, we apply appropriate technical and organisational controls to protect personal information from unauthorised access, disclosure, alteration or destruction:

• Encrypted communications — TLS/HTTPS across all web services
• Access controls — authentication and authorisation for internal systems
• Security controls — aligned with ASD Essential Eight
• Vulnerability disclosure — xcomspace.com/security-policy

// 08. Cookies and Analytics

Our website uses cookies and similar technologies to improve functionality and analyse traffic. We do not use tracking cookies for advertising purposes.

Cookie categories:

• Necessary — essential for site security, load balancing, and storing your consent preferences. Always active.
• Analytics — Google Analytics (GA4), used to understand how visitors interact with the website (visitor counts, traffic sources, page performance). Only loaded after you grant explicit consent via our cookie banner.

Cloudflare Turnstile: We use Cloudflare Turnstile, a privacy-preserving bot-detection service, to protect our contact forms from automated abuse. Turnstile may set cookies or use browser storage to perform its challenge. This is operated under our legitimate interest in maintaining site security and preventing spam. No personally identifiable information is collected by Turnstile. See Cloudflare's privacy policy at cloudflare.com/privacypolicy.

You can manage your cookie preferences at any time via the Cookie Settings link in the site footer.

// 09. Your Rights

Under the Privacy Act 1988 (Cth), you have the right to:

• Access — request access to personal information we hold about you
• Correction — request correction of inaccurate or outdated information
• Deletion — request deletion of your personal information (subject to legal obligations)
• Withdrawal — withdraw consent for marketing communications at any time
• Complaint — lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

// 10. Retention

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Client engagement records are retained for a minimum of 7 years in accordance with Australian tax and corporate record-keeping requirements.

// 11. Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be posted on this page with an updated effective date. Continued use of our website after such changes constitutes acceptance of the updated policy.