Privacy Policy

1.Who this policy covers

This policy applies to Farr Systems (ABN 30 350 909 100), a sole trader business operated by Jack Farrugia from Mackay, Queensland, Australia. It covers:

• The website at farrsystems.com.au and every page on it
• Enquiries by phone, SMS, email, the website contact form, or through Google, Facebook or LinkedIn
• Work carried out onsite, in workshop, or by remote support session
• Quoting, invoicing, payment and follow-up

“I”, “me” and “my” means Farr Systems. “You” means the person or business dealing with me.

This policy sits alongside my Terms and Conditions at farrsystems.com.au/terms, which cover how work is quoted, carried out and paid for. Where the two touch on the same thing, this policy governs how your personal information is handled.

Work I do as a subcontractor is not covered by this policy. Where a job comes to me through another business, such as a technician platform or a managed service provider, that business holds the client relationship and its privacy policy governs the job. I still handle anything I’m given on those jobs to the standards set out below, but your rights in relation to that work sit with them.

Farr Systems is a small business operator, and small businesses with an annual turnover of $3 million or less are currently outside most of the Privacy Act 1988 (Cth). I’ve written this policy to the standard of the Australian Privacy Principles anyway, because the nature of this work — access to your devices, accounts and files — warrants it. What follows is how I handle your information in practice.

2.What information I collect

2.1 Information you give me directly

• Contact details — name, phone number, email address, and the address where the work is to be carried out.
• What’s wrong — whatever you tell me about the problem, in your own words, plus any notes, photos or screenshots you send.
• Business details — where you’re a business client: business name, ABN, contact person, and billing details.
• Payment details — bank transfer reference, PayID, or a record that cash was paid. I do not collect, store or process card numbers. Where an invoice offers online card payment, that is handled entirely by the payment provider and the card details never reach me.

2.2 Information I encounter while doing the work

This is the category that matters most in IT work, so I’ll be specific.

To repair, set up, recover or secure a device, I may need to see or touch:

• Files, photos, documents, email and messages stored on the device
• Browser history, saved passwords, installed software and account names
• Network configuration, device names, and other devices on your network
• Backup contents, where I’m restoring or configuring backups
• Error logs, crash reports and system diagnostics

How I treat it:

• I access only what the job you’ve asked for requires.
• I don’t deliberately read, copy, browse or open anything beyond that. Where I have to move through your files to find what I’m looking for, I don’t go further than the task needs and I don’t take anything with me.
• I don’t transfer your files off your device or network unless you’ve asked me to — for example, moving data to a new computer, or recovering it from a failing drive. Where I do, it’s held on encrypted storage and erased once you’ve confirmed it’s landed safely, or 30 days after the job is completed, whichever comes first.
• Passwords. I don’t ask for, write down or keep your account passwords. Where a job needs you to sign in, you type it in yourself. Any new login I set up for you is handed over to you at the end of the job, and I don’t keep a copy.

2.3 Information collected automatically by the website

The website runs no advertising pixels and no cross-site tracking, and sets no analytics or advertising cookies.

Visitor statistics. I use Cloudflare Web Analytics to see basic, aggregate numbers: how many people visited, which pages they looked at, roughly which country they’re in, what kind of device and browser they used, and which site referred them. It sets no cookies, doesn’t fingerprint your browser, and doesn’t build a profile of you or follow you to other sites. I see totals, not individuals.

Security. Cloudflare, which hosts and serves the site, may set a security cookie to distinguish real visitors from automated traffic, and records standard server request data (IP address, timestamp, requested page, browser type) for security and abuse prevention. I don’t have access to that data in a form that identifies you.

The contact form. Submissions are processed by Web3Forms, which passes them through to my email. The form is protected by hCaptcha, which checks that a real person is sending it. To do that, hCaptcha collects information about your browser and device, your IP address and how you interact with the check, and it may set cookies. That check is run by hCaptcha under its own privacy policy, not by me. If you’d rather not go through it, just email or call instead.

See the table in section 4 for who each of these providers is and where they operate.

If I ever add any other analytics or tracking, I’ll update this section before it goes live, not after.

2.4 Sensitive information

I don’t seek out sensitive information (health, racial or ethnic origin, political or religious views, sexual orientation, criminal record, biometric or genetic data). Where it happens to sit on a device I’m working on, clause 2.2 applies: I don’t open it, copy it or discuss it.

2.5 Children and family devices

I don’t collect personal information directly from children. Where I’m working on a family device or setting up parental controls, I deal with the parent or guardian, and anything I see belonging to a child on that device is treated the same way as anything else on it — accessed only as far as the job requires.

3.Why I collect it

• To answer your enquiry and quote the work
• To do the work you’ve asked for
• To get to your address, contact you about the booking, and follow up afterwards
• To invoice you and keep a record of payment
• To meet my tax, ATO and business record-keeping obligations
• To keep enough of a service history that if the same thing plays up again, I’m not starting from scratch

I will not use your information for any purpose you wouldn’t reasonably expect, and I won’t use it for a new purpose without asking you first.

4.Who I share it with

I do not sell, rent, trade or share your personal information for marketing purposes. Ever. Not to anyone.

I use a small number of service providers to run the business. They hold information only to the extent needed to provide their service to me:

Reviews. If you leave a public Google review, it’s public by definition. I also display real Google reviews — including the reviewer’s display name — in the reviews section of farrsystems.com.au. If you’d rather yours wasn’t shown there, tell me and I’ll remove it, though you’ll need to delete it on Google yourself to take it down entirely.

Subcontractors. If a job ever needs a second pair of hands, I’ll tell you before anyone else is involved, and they’ll only get what’s needed to do the work.

I will otherwise only disclose your information:

• With your consent — for example, if you ask me to deal with your internet provider, your accountant, or a family member on your behalf.
• Where the law requires it — a court order, a subpoena, or a lawful request from a regulator or law enforcement agency. Where I’m legally permitted to tell you that this has happened, I will.
• Where there is a serious and imminent threat to someone’s life, health or safety.
• Where I’m legally obliged to report something. Queensland law requires an adult who reasonably believes another adult has committed a sexual offence against a child under 16 to report it to police. If I ever come across material of that kind on a device, I will stop work and report it. That’s one confidentiality promise I can’t make, and I’d rather say so up front.

4.1 Overseas disclosure

Some of the providers above store data outside Australia (see the table). I take reasonable steps to choose providers with published security practices, I select an Australian or EU data region where the option exists, and I remain responsible for that choice. Where information is stored offshore, it’s your contact details, your correspondence, and the technical data from the contact-form check. It is not your files, and not your credentials. Remote support sessions pass through Cloudflare’s network in transit, which may route outside Australia.

5.How I protect it

• Devices are encrypted at rest and locked when unattended.
• Accounts use unique passwords held in a password manager, with multi-factor authentication enabled.
• Remote support runs over an encrypted connection, either through a server I run myself, reached through Cloudflare’s network, or end-to-end encrypted through a public relay. A session starts only with your consent and stays visible on your screen the whole time. Access ends when the session ends. Where a business client asks for unattended access to be set up, that’s arranged in writing beforehand and removed whenever you ask.
• Remote sessions are not recorded. No video or screenshots of your screen are kept. What I keep is a record of the session itself (the date, how long it ran, and what work was done) as part of your service history.
• Client data recovered or transferred during a job is held on encrypted storage and securely erased once the job is confirmed complete, or within 30 days of completion.
• Client devices in for repair are kept on an isolated network segment, separate from anything else I run.
• Physical devices left with me are stored securely and returned to you or collected by you.
• If a device is never collected, I store it securely and follow clause 12 of my Terms. Its storage is always erased before it leaves my hands.

No system is perfect and I won’t claim otherwise. What I can tell you is that the amount I hold is deliberately small, and it doesn’t sit anywhere for long.

6.How long I keep it

You can ask me to delete anything outside the records I’m legally required to keep, and I will.

7.Marketing

If I send you anything promotional — a service reminder, a security warning, a note that I’m in your area — it’ll be because you’re a client or you’ve asked for it, and every message will carry a way to stop it. One reply saying “stop” is enough; you don’t need to explain.

I comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth). I don’t buy marketing lists and I don’t cold-call.

8.Your rights

You can, at any time:

• Ask what I hold about you. I’ll tell you, in plain English, free of charge, within 30 days.
• Ask me to correct it if it’s wrong.
• Ask me to delete it, except where I’m legally required to keep it.
• Withdraw consent for anything you’ve previously agreed to.
• Deal with me anonymously or under a pseudonym where it’s practical — though for onsite work I’ll obviously need an address, and for an invoice I’ll need a name.

Just ask. There’s no form and no process. Email or call.

9.If something goes wrong

If a data breach occurs that is likely to result in serious harm to you, I will:

1. Contain it and assess it immediately.
2. Notify you directly, in plain English, with what happened, what was affected, and what you should do.
3. If the breach involves information a business client holds under the Privacy Act, tell them straight away so they can meet their own obligations.

I won’t sit on it, and I won’t dress it up.

10.Complaints

If you think I’ve mishandled your information, tell me first — directly, and I’ll take it seriously:

Jack Farrugia, Farr Systems hello@farrsystems.com.au 0485 835 817

I’ll acknowledge it within 5 business days and give you a substantive response within 30 days.

If you’re not satisfied with how I handle it, you can contact the Office of the Australian Information Commissioner. Because Farr Systems is a small business that’s currently exempt from most of the Privacy Act, the OAIC may not be able to investigate a complaint about me, but it can explain your options.

OAIC: oaic.gov.au · 1300 363 992 · GPO Box 5288, Sydney NSW 2001

11.Changes to this policy

If I change this policy I’ll update the date at the top and publish the new version here. If a change materially affects how I handle information about existing clients, I’ll tell those clients directly rather than relying on you to notice.

12.Contact

Farr Systems · ABN 30 350 909 100 Jack Farrugia hello@farrsystems.com.au 0485 835 817 Mackay, Queensland, Australia