Last Updated: 20 August 2026
Effective Date: 20 August 2026
This Privacy Policy explains how ITC Co Pty Ltd("ITCC", "we", "us" or "our") collects, uses, discloses, stores and protects personal information when you visit itcc.co, contact us, subscribe to our communications, or engage us for digital marketing, SEO, web development, advertising or technology consulting services.
ITCC is an Australian digital agency based in South Melbourne, Victoria. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we handle the personal information of people located in the European Economic Area, the United Kingdom, or California, the additional rights described in Sections 11 and 12 also apply to you.
Please read this policy alongside our Cookie Notice and Terms of Service. If you do not agree with this policy, please do not use our website or submit information to us.
Our Privacy Officer is responsible for handling access requests, correction requests, opt-out requests and complaints. Write to privacy@itcc.co and mark your message "Attention: Privacy Officer".
We aim to acknowledge privacy enquiries within 5 business days and to resolve them within 30 days.
We do not seek sensitive information as defined by the Privacy Act 1988 (Cth), such as health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation or criminal record. Please do not send us sensitive information unless we have specifically asked for it.
We use cookies, pixels, tags, local storage and similar technologies. Our cookie consent banner is provided by Cookie Script, which records your consent choices and controls which non-essential technologies load.
| Technology | Provider | Category | Purpose | Provider privacy information |
|---|---|---|---|---|
| Google Analytics 4 | Google LLC / Google Ireland Ltd | Analytics | Measures how visitors find and use our website, which pages perform, and which channels drive enquiries. Sets _ga and _ga_* cookies. | policies.google.com/privacy |
| Brevo | Brevo SAS (France) | Email marketing and marketing automation | Sends and tracks our newsletters and client communications, records opens and clicks, and manages subscription lists. May set an identifier to link website activity to a subscriber record. | brevo.com/legal/privacypolicy |
| Cookie Script | Cookie Script | Consent management | Displays the cookie banner and stores your consent preferences so we can honour them on return visits. | cookie-script.com/privacy-policy |
Google Analytics. We use Google Analytics 4 with IP address handling as configured by Google. Google may process this data in the United States and other countries. You can prevent Google Analytics from collecting your data by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout, or by declining Analytics cookies in our cookie banner.
Brevo. Brevo processes data within the European Union. Every marketing email we send includes a one-click unsubscribe link. Unsubscribing stops marketing email but does not stop service or account emails relating to work we are delivering for you.
Where the GDPR applies, our lawful bases are consent (marketing and non-essential cookies), contract (delivering services you have engaged us for), legal obligation (tax and record keeping) and legitimate interests (site security, service improvement, business-to-business communications).
You can exercise any of the following at any time, free of charge.
Click the unsubscribe link at the foot of any marketing email, or email privacy@itcc.co with "Unsubscribe" in the subject line. We action these within 5 business days.
Decline the relevant categories in our cookie banner, or use the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
Adjust your Google ad settings at myadcenter.google.com, and use the industry opt-out tools at optout.aboutads.info and youronlinechoices.com.au.
We recognise and honour the Global Privacy Control signal. If your browser or a browser extension sends a GPC signal, we treat it as a valid instruction to opt out of the sale or sharing of your personal information and to disable non-essential advertising and analytics technologies for that browser. Because GPC is a browser-level signal, it applies to the specific browser and device that sends it. You can learn more at globalprivacycontrol.org.
ITCC does not sell your personal information for money, and we have not done so in the preceding 12 months.
We do use third-party analytics and advertising technologies which, under the California Consumer Privacy Act as amended, may be treated as "sharing" personal information for cross-context behavioural advertising.
We will not discriminate against you for exercising this right. You will receive the same service, price and quality.
We do not sell your personal information.
Some of our providers are located outside Australia. Google processes data in the United States and other countries. Brevo processes data in the European Union. Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it in a way consistent with the Australian Privacy Principles, including through contractual protections such as Standard Contractual Clauses.
| Information type | Retention period |
|---|---|
| Website enquiry and quote requests | 24 months from last contact |
| Client records and project files | 7 years after the engagement ends, to meet tax and record-keeping obligations |
| Marketing subscriber records | Until you unsubscribe, plus a suppression record kept indefinitely so we do not contact you again |
| Analytics data | As configured in Google Analytics 4, currently 14 months |
| Unsuccessful job applications | 12 months, unless you ask us to keep your details longer |
| Server and security logs | 12 months |
We destroy or de-identify personal information when it is no longer needed for any purpose permitted by law.
We use TLS encryption in transit, access controls limiting client data to team members who need it, multi-factor authentication on business systems, staff confidentiality obligations, and regular review of third-party access.
No method of transmission or storage is completely secure. If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
Our website and services are directed at businesses and are not intended for children.
We do not knowingly collect personal information from anyone under 18 years of age. We do not knowingly market to children, and we do not use tracking technologies to build profiles of children.
If you believe a child has provided us with personal information, contact privacy@itcc.co immediately. On verification we will delete that information from our records and instruct our processors to do the same.
Where a young person aged 15 or over engages with us directly, such as through a job application, we will assess on a case-by-case basis whether they have the capacity to give consent, consistent with guidance from the Office of the Australian Information Commissioner.
How to make a request. Email privacy@itcc.co or write to the postal address in Section 2. Tell us which right you are exercising and give us enough detail to locate your records. We will verify your identity before acting, usually by confirming details we already hold. We respond within 30 days and do not charge a fee for reasonable requests. If we refuse a request, we will tell you why in writing and explain how to complain.
An authorised agent may make a request on your behalf if they provide written authorisation signed by you.
You have the rights set out in Articles 15 to 22 of the GDPR, including access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects. You may lodge a complaint with your national supervisory authority or, in the UK, the Information Commissioner's Office at ico.org.uk.
Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect, use, disclose and share; to delete it; to correct it; to opt out of sale or sharing; to limit use of sensitive personal information; and to be free from discrimination for exercising these rights. See Section 6.5 for the opt-out. In the preceding 12 months we have collected identifiers, internet activity information, commercial information and professional information, as described in Section 3, for the purposes described in Section 5.
We do not use automated decision-making that produces legal or similarly significant effects about you.
We do use automated tools to segment marketing audiences, score enquiry quality and personalise website content. These do not determine access to services, pricing or credit. You can ask us to review any automated outcome by emailing privacy@itcc.co.
If you are unhappy with how we have handled your personal information, email privacy@itcc.co with "Privacy Complaint" in the subject line. We will acknowledge within 5 business days, investigate, and give you a written response within 30 days.
Our website links to third-party sites and platforms we do not control. This policy does not apply to them. Review their privacy policies before providing personal information.
Third parties may use cookies, web beacons and similar technologies to collect or receive information from our website and elsewhere on the internet, and use that information to provide measurement services and target ads.
We review this policy at least annually. When we change it, we update the "Last Updated" date at the top of this page. If a change materially affects how we handle your personal information, we will notify you by email or through a prominent notice on our website before it takes effect.
Previous versions are available on request from privacy@itcc.co.
This policy was last reviewed on 20 August 2026.