Version 2.0 | 30 September 2026
Privacy Policy
1. About this policy
In this Privacy Policy, ‘us’ ‘we’ or ‘our’ means FYB Pty Ltd (ABN 68 108 771 731). We are committed to respecting your privacy. Our Privacy Policy sets out how we collect, use, store and disclose your personal information. We are bound by the Australian Privacy Principles contained in the Privacy Act 1988 (Cth).
Personal information includes information or an opinion about an individual that is reasonably identifiable. For example, this may include your name, age, gender, work information, postcode and contact details.
By providing us with personal information, you consent to the terms of this Privacy Policy and the types of disclosure covered by this Policy. Where we disclose your personal information to third parties, we will request that the third party follow this Policy regarding handling your personal information.
2. Scope: when we are responsible, and when our customer is
2.1 We collect personal information from you in a variety of ways, including when you interact with us electronically or in person, when you access our website or use our products or services, and when we provide our services to you (or your employer or other organisation). We may receive personal information from third parties. If we do, we will protect it as set out in this Privacy Policy.
2.2 We may receive and store personal information when you use software products or related services we have provided to you, or you enter it onto our websites (www.fyb.com.au), or subscribe to our mailing list, or we get from social media, or from your emails, or provided to us directly or given to us in other forms.
2.3 You may provide basic information such as your name, phone number, address and email address to enable us to send information, provide updates and provide services to you. We may collect additional information at other times, including when you apply for employment, provide feedback, when you provide information about your personal, employment or business affairs, change your content or email preference, respond to surveys and/or promotions or provide financial or credit card information.
2.4 Additionally, we may also collect any other information you provide while interacting with us.
3. Dealing with us anonymously
3.1 We may use personal information collected from you to:
verify your identity;
enable you to access and use our website, products and services;
operate, protect, improve and optimise our website, products and services and our users’ experience, such as to perform analytics, conduct research and for advertising and marketing;
send you service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you;
send you marketing and promotional messages and other information that may be of interest to you, including information sent by, or on behalf of, our business partners that we think you may find interesting;
comply with our legal obligations, resolve any disputes that we may have with any of our users, and enforce our agreements with third parties.
3.2 We and/or our carefully selected business partners may send you direct marketing communications and information about our services. This may take the form of emails, SMS, mail or other forms of communication, in accordance with the Spam Act and the Privacy Act. You may opt-out of receiving marketing materials from us by contacting us using the details set out below or by using the opt-out facilities provided (e.g. an unsubscribe link).
4. The personal information we collect
4.1 Depending on your dealings with us, we may collect:nformation for the purposes described in this privacy policy to:
Contact and business information: name, business email address, telephone number, postal address, employer, role, and the content of correspondence with us.es corporate;
Account and authentication attributes: usernames and directory attributes supplied by a customer’s identity provider. Our subscription services do not use FYB-issued passwords, and we do not store user passwords for those services.ice providers (including providers for the operation of our websites and/or our business or in connection with providing our products and services to you);
Usage, audit and technical information: sign-in activity, searches, document actions, downloads, configuration and administrative changes, timestamps, IP address, device and browser information. and agents;
Support information: diagnostic logs, screenshots, configuration extracts, correspondence, and customer-authorised access to the data required to investigate a reported issue.. merchants receiving card payments);
Customer content and metadata: content processed through our software or subscription services may contain personal information, including document metadata, image EXIF metadata, thumbnails, cached previews, annotations, AI-generated tags, saved searches and collections, according to the customer’s configuration.ts, business partners or partners;
Marketing and event information: subscription preferences, event registrations, and survey or feedback responses.ny competition that we conduct via our services;
Recruitment information: where you apply for a role with us, your application materials, work history, referee comments and work eligibility information.usinesses (or any part of them) are transferred;
Supplier and payment information: business banking and payment details of suppliers and, where applicable, customers.sed by you to receive information held by us; and/or
nment agencies, regulatory bodies and law enforcement agencies, or as required, authorised or permitted by law.
4.2 We do not seek sensitive information for our own purposes. Content that a customer manages using our products may contain sensitive information, at that customer’s election and under that customer’s control.eed to disclose personal information to comply with a legal requirement, such as a law, regulation, court order, subpoena, warrant, in the course of a legal proceeding or in response to a law enforcement agency request.
4.3 If we receive personal information that we did not solicit and could not lawfully have collected, we will destroy or de-identify it where the Privacy Act requires us to do so.nformation outside of Australia to Micro Focus, Intelledox, Digitus, and Outback Imaging located in United States of America and England. We will, however, take reasonable steps to ensure that any overseas recipient will deal with such personal information in a way that is consistent with the Australian Privacy Principles.
ntrol in our business or a sale or transfer of business assets, we reserve the right to transfer to the extent permissible at law our user databases, together with any personal information and non-personal information contained in those databases. This information may be disclosed to a potential purchaser under an agreement to maintain confidentiality. We would seek to only disclose information in good faith and where required by any of the above circumstances.
5. How we collect personal information
5.1 We collect personal information: directly from you, through correspondence, forms, meetings, support requests, our website and events; from an organisation that has authorised you to use our software or services, and from that organisation’s identity provider and connected systems; automatically, through your use of our software and services; from publicly available sources and business directories, in the ordinary course of business development; and from recruiters and referees, where you apply for a role with us.ion you provide to us is secure. In order to prevent unauthorised access or disclosure, we have taken commercially reasonable steps to put in place physical, electronic and managerial procedures to safeguard and secure information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure.
5.2 Where we collect your personal information from someone other than you, we take reasonable steps to make you aware of the matters set out in APP 5, unless an exception applies.s carried out at your own risk. We cannot guarantee the security of any information that you transmit to us, or receive from us. Although we take measures to safeguard against unauthorised disclosures of information, we cannot assure you that personal information that we collect will not be disclosed in a manner that is inconsistent with this Privacy Policy.
6. Why we collect, hold and use personal information
6.1 We use personal information to: supply, operate, secure, support and improve our software, subscription services and professional services; authenticate users and apply the permissions our customer has configured; connect to systems the customer has authorised us to connect to; provide search, preview, metadata, auditing and optional AI functionality; prepare proposals and administer subscriptions, licences, invoicing and customer relationships; investigate faults, suspected misuse and security incidents; conduct business development and send marketing communications, subject to section 10; recruit and assess candidates; meet our legal, regulatory, taxation and contractual obligations, and establish, exercise or defend legal claims.n that we hold about you in accordance with the provisions of the Privacy Act. A small administrative fee may be payable for the provision of information. If you would like a copy of the information, which we hold about you or believe that any information we hold on you is inaccurate, out of date, incomplete, irrelevant or misleading, please email us at info@fyb.com.au.
6.2 We do not use customer content for advertising, for unrelated analytics, or for any purpose independent of providing our software and services. We do not sell personal information. We do not use customer data to train artificial intelligence models.with information that we hold about you, in certain circumstances set out in the Privacy Act.
7. Subscription services and temporary processing
7.1 A subscription service is a service that we host and make available over the internet, rather than software installed on the customer’s own systems. Where a customer subscribes to one: The customer’s connected systems remain its systems of record. A subscription service is not intended to be a permanent repository for customer documents and is not intended to be the customer’s only copy of any document. We may retrieve and temporarily store copies of files in secure managed object storage to provide previews, thumbnails, metadata extraction, virus scanning and other configured processing. We may retain supporting application data according to the customer’s configuration, including metadata, EXIF metadata, thumbnails, cached previews, annotations, AI-generated tags, saved searches, collections, configuration settings and audit records. Users authenticate through the customer’s identity provider. The customer controls multi-factor authentication, user access and permissions. User and administrative actions are audited and logged. Where your data is held: We host and process customer data in Australia. See section 12.ices, please feel free to send in details of your complaints by email to info@fyb.com.au, or by mail to PO Box 635, Williamstown, Vic, 3016. We take complaints seriously and will respond shortly after receiving written notice of your complaint.
8. Artificial intelligence
8.1 Some of our products offer optional AI-enabled features that use third-party AI services we have reviewed and approved (Approved AI Services). 8.2 Customers may disable individual AI features or opt out of AI functionality entirely. Where a feature is disabled, no information is submitted to an Approved AI Service for that purpose. 8.3 Where a feature is enabled, selected content or extracted information is processed by an Approved AI Service to produce tags or other configured outputs. We do not provide personal information to Approved AI Services for this purpose, and Approved AI Services process that information in Australian regions. 8.4 Data submitted to an Approved AI Service is not used to train that provider’s models. 8.5 We maintain a register of Approved AI Services and provide it to customers on request. We assess a service before approving it, including its purpose, the information it requires, its storage and retention practices, whether it uses information for model training, its security and privacy controls, its data location, and the controls available to customers. 8.6 AI-generated outputs may be inaccurate or incomplete. They are decision-support only and must be reviewed by a person before being relied on or applied to records, classification, disposal, business decisions or compliance processes.licy in the future. We may modify this Policy at any time, in our sole discretion and all modifications will be effective immediately upon our posting of the modifications on our website. Please check back from time to time to review our Privacy Policy.
9. Automated decision making
9.1 We do not use a computer program to make, or to do a thing that is substantially and directly related to making, a decision that could reasonably be expected to significantly affect the rights or interests of an individual.certain information such as browser type, operating system, website visited immediately before coming to our site, etc. This information is used in an aggregated manner to analyse how people use our site, such that we can improve our service.
9.2 If that changes, we will update this policy to include the information required by Australian Privacy Principle 1.7, which applies from 10 December 2026.bsite/s. Cookies are very small files which a website uses to identify you when you come back to the site and to store details about your use of the site. Cookies are not malicious programs that access or damage your computer. Most web browsers automatically accept cookies but you can choose to reject cookies by changing your browser settings. However, this may prevent you from taking full advantage of our website. Our website may from time to time use cookies to analyses website traffic and help us provide a better website visitor experience. In addition, cookies may be used to serve relevant ads to website visitors through third party services such as Google Adwords. These ads may appear on this website or other websites you visit.
9.3 Customers configure their own classification, retention, disposal and access rules within our products. Where a customer uses those capabilities in a way that engages the automated decision making transparency requirements, the obligation to disclose that use rests with the customer, not with FYB.ther websites not owned or controlled by us. These links are meant for your convenience only. Links to third party websites do not constitute sponsorship or endorsement or approval of these websites, and we are not responsible for the privacy practises of other such websites. We encourage our users to be aware, when they leave our website, to read the privacy statements of each website that collects personal identifiable information.
10. Direct marketing
10.1 We may send you information about our products, services, events and developments in the information governance profession, by email, telephone or post. We do this in accordance with the Privacy Act and the Spam Act 2003 (Cth). 10.2 Every marketing email we send contains an unsubscribe facility. You may also opt out at any time by emailing info@fyb.com.au. We will action an opt-out promptly and at no cost to you. 10.3 We do not use or disclose personal information for the direct marketing purposes of another organisation without your consent, and we do not use sensitive information for direct marketing. 10.4 If you ask us to, we will tell you where we obtained your information, unless it is impracticable or unreasonable to do so.
11. Disclosure of personal information
11.1 We may disclose personal information to: our personnel and related bodies corporate, on a need-to-know basis; service providers who help us deliver, host, secure, support and administer our products and services, including our cloud infrastructure provider; Approved AI Services, in the limited manner described in section 8; the vendors of third-party software we have supplied, where escalating a support request requires it, as described in section 12; our professional advisers, insurers and auditors; a customer, where the information relates to that customer’s users, systems or account; an acquirer or potential acquirer of our business or assets, under obligations of confidentiality; a person you have authorised to receive it; and government agencies, regulators, courts and law enforcement, where required, authorised or permitted by law, including in response to a subpoena, warrant, court order or lawful request. 11.2 We require our service providers to protect personal information in a way that is consistent with the APPs, to use it only for the purpose for which we provide it, and to return or destroy it when it is no longer needed. We remain responsible for their handling of information we provide to them.
12. Data location and overseas disclosure
12.1 We store and process personal information in Australia. Our subscription services are hosted in Australian cloud regions, customer application data is held in Australia, and the AI services we have approved process information in Australian regions. 12.2 We do not transfer personal information outside Australia for storage, backup, analytics or artificial intelligence processing. 12.3 We resell and support software developed by third-party vendors. Where we cannot resolve a support issue ourselves, we may need to escalate it to the vendor, and the information we provide in order to do so may include customer content, log extracts, screenshots or configuration data containing personal information. 12.4 Most of our vendors handle support requests in Australia. OpenText may handle some support requests from outside Australia but within the APAC region. Where that occurs, we limit the disclosure to what is reasonably required to diagnose and resolve the issue. 12.5 Where we disclose personal information to an overseas recipient, we take the reasonable steps required by Australian Privacy Principle 8 to ensure that the recipient does not breach the APPs, including by imposing contractual obligations on it. We remain accountable under the Privacy Act for information we disclose in this way. 12.6 A customer may tell us that it does not want support requests escalated outside Australia. If it does, we will not escalate its requests overseas. Resolving some issues may take longer as a result.
13. How we protect personal information
13.1 We take reasonable technical and organisational steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include: encryption of data in transit using TLS, and encryption of data at rest using AES-256; authentication through the customer’s identity provider, with multi-factor authentication under the customer’s control; role-based access controls and least-privilege access for our personnel; audit logging of user and administrative activity; malware scanning of files processed through upload and document workflows; vulnerability scanning, periodic penetration testing, patch management and platform monitoring; secure development practices, including code review, dependency scanning and secrets scanning; and confidentiality obligations on our personnel and contractors, and privacy training. 13.2 Our personnel do not routinely access customer content. Access is restricted to authorised personnel, is logged, and is used only where required for customer-requested support, troubleshooting, maintenance or security response. 13.3 No method of transmission or storage is completely secure. While we take the steps described above, we cannot guarantee the security of information transmitted to or from us over the internet.
14. Data breaches
14.1 We maintain processes to identify, contain, assess, remediate and review suspected data breaches. 14.2 Where we become aware that there are reasonable grounds to suspect an eligible data breach, we carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days, as required by Part IIIC of the Privacy Act. 14.3 Where we have reasonable grounds to believe an eligible data breach has occurred, we notify the Office of the Australian Information Commissioner and the affected individuals as soon as practicable. 14.4 Where the breach involves information we hold on behalf of a customer, we notify that customer as soon as practicable and in time to allow it to meet its own obligations, and we coordinate with it on notification to individuals.
15. How long we keep personal information
15.1 We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it by law or contract. 15.2 For subscription services, unless we have agreed otherwise with the customer in writing, the customer may export its data for 30 days after the subscription ends, and we permanently delete that data within 60 days after the subscription ends. Backup copies containing that data are overwritten in the ordinary course of our backup cycle, and remain protected by the controls described in section 13 until they are. 15.3 We retain business records, including contracts, invoices and correspondence, for the periods required by taxation, corporations and limitation of actions legislation. 15.4 Where we no longer need personal information and are not required to retain it, we destroy it or de-identify it.
16. Accessing and correcting your personal information
16.1 You may ask for access to, or correction of, the personal information we hold about you by emailing info@fyb.com.au. We will verify your identity before releasing information. 16.2 We will respond within a reasonable period, and no later than 30 days after we receive the request. 16.3 We do not charge you for making a request. If we charge for giving access, the charge will not be excessive and we will tell you what it is before we proceed. 16.4 We may refuse access or correction in the circumstances set out in the Privacy Act. If we do, we will give you written reasons and tell you how to complain. If we refuse to correct information, you may ask us to associate a statement with it noting that you consider it inaccurate, out of date, incomplete, irrelevant or misleading. 16.5 If we hold the information on behalf of a customer, we will refer your request to that customer and tell you that we have done so.
17. Complaints
17.1 If you think we have breached the Privacy Act or the APPs, please tell us. Email info@fyb.com.au with “Privacy complaint” in the subject line, or write to the Privacy Officer, FYB Pty Ltd, Level 4, 380 Collins Street, Melbourne VIC 3000. Please describe your concern and the relevant circumstances. 17.2 We will acknowledge your complaint within 5 business days, investigate it, and respond within 30 days. If we need longer, we will tell you why and when you can expect a response. 17.3 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, GPO Box 5218 Sydney NSW 2001.
18. Our website
18.1 When you visit our website we may collect your IP address, browser type, operating system, the pages you view, and the site you visited immediately before ours. We use this information in aggregate to understand how the site is used and to improve it. 18.2 We use cookies, which are small files a website places on your device. We use them to make the site work, to analyse traffic, and to measure and target our advertising, including through third-party advertising platforms. Ads based on your visit to our site may appear on our site or on other sites you visit. 18.3 Most browsers accept cookies automatically. You can change your browser settings to reject cookies, and you can opt out of interest-based advertising through the settings offered by the relevant advertising platform. Rejecting cookies may prevent parts of our site from working properly. 18.4 Our site may link to sites we do not own or control. Those links are for convenience and are not an endorsement. We are not responsible for the privacy practices of other sites, and we encourage you to read the privacy policy of any site that collects your information.
19. Changes to this policy
19.1 We may update this policy when our practices, our services or our legal obligations change. The current version is available at fyb.com.au/privacy and takes effect when it is posted. Where a change is material and affects a customer, we will notify that customer. We keep a record of previous versions and will provide one on request.
20. Contact us
FYB Pty Ltd
ABN 68 108 771 731
Level 4, 380 Collins Street, Melbourne VIC 3000
General and privacy enquiries: info@fyb.com.au
Security enquiries: security@fyb.com.au
Website: fyb.com.au
