Privacy policy
Last updated 16 October 2026. Applies to Lexora.
Draft for review. This document will be finalised with Lexora's registered business details before launch.
Lexora respects your privacy. This policy explains how we handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We apply the APPs to our own business whether or not an exemption would otherwise apply. For a summary of our practices, see the Trust Centre.
1. Who we are and how to contact us
Lexora provides privacy, data and AI governance advisory services. Contact us about privacy at info@lexora.global.
2. What personal information we collect (APP 3)
| When | What we collect |
|---|---|
| You send an enquiry | Name, work email, organisation, role (optional), organisation size, area of interest and your message |
| You subscribe to the newsletter | Work email, first name (optional), where you signed up, the consent wording you agreed to and when |
| You download a resource | First name, work email, organisation (optional), which resource, and whether you separately opted in to the newsletter |
| You book a call | Name, email, meeting time and anything you add to the booking |
| We work with you | Contact details of the people we deal with, and information you choose to share so we can deliver the agreed work |
| You visit the website | Our host's standard server logs (such as IP address, browser and pages requested), used for security and reliability |
We do not ask for sensitive information (such as health information) through this website. Please do not include personal information about other people in enquiries. You can contact us anonymously or under a pseudonym where practicable (APP 2), though we will need a way to reply.
Cookies and tracking. This website uses no advertising, analytics or tracking cookies, no third-party scripts and no embedded social media. Our readiness checks run entirely in your browser; your answers are not sent to us unless you choose to email them.
3. Why we collect, use and disclose it (APP 6)
- To respond to enquiries and prepare proposals.
- To provide downloads you request and understand which resources are useful.
- To send the newsletter, only if you opted in.
- To deliver, manage and invoice engagements.
- To keep the website secure, and to meet our legal obligations.
We do not sell or rent personal information, and we do not use it for purposes you would not reasonably expect.
4. Direct marketing (APP 7 and the Spam Act)
We send marketing email only to people who gave express consent by ticking an unticked box, or who asked us directly. Downloading a resource or sending an enquiry does not subscribe you. Every email identifies Lexora and includes a one-click unsubscribe, which we action within five business days. You can also email us to opt out at any time.
5. Who we disclose it to, including overseas (APP 8)
We use service providers to run our business. They handle personal information on our behalf under contract and only for that purpose.
- Netlify, Inc.: website hosting, enquiry forms, newsletter sign-ups and resource download requests (United States).
- Email, booking and document storage providers, listed in the service provider register as they are confirmed.
Some providers store information outside Australia, including in the United States. We take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs. We disclose personal information to others only with your consent or where required or authorised by law.
6. Automated decisions (APP 1.7 to 1.9)
Lexora does not use computer programs to make, or substantially assist in making, decisions about individuals that could significantly affect their rights or interests. Read how Lexora uses AI.
7. Keeping information accurate and secure (APPs 10 and 11)
We take reasonable steps to keep personal information accurate and to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. Our website security practices are described in the Trust Centre. When we no longer need information, we delete or de-identify it according to our retention schedule. For example, enquiries that do not lead to an engagement are deleted after two years.
If we experience a data breach likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
8. Client information we handle during engagements
Our engagements are designed so that we see as little personal information as possible. We ask clients to redact or summarise wherever practical. Information shared during an engagement is used only for that engagement, handled under its written confidentiality terms, and returned or destroyed within 90 days of the engagement ending unless the client asks otherwise.
9. Access and correction (APPs 12 and 13)
You can ask to access or correct the personal information we hold about you by emailing info@lexora.global. We will confirm your identity, respond within 30 days, and not charge you for making the request. If we refuse, we will tell you why in writing and how to complain.
10. Complaints
If you have a concern about how we handled your information, contact us first. We acknowledge complaints within two business days and respond in writing within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner.
11. Changes
We review this policy at least once a year and when our practices change. The date at the top shows when it was last updated.