Trust Centre
We hold ourselves to the standard we advise on.
A governance adviser should be able to show its own working. This page sets out how Lexora handles information, uses AI, chooses service providers and responds when things go wrong.
- Tracking
- None. No analytics or ad cookies
- AI use
- Published rules
- Registers
- Providers and retention, public
- Last reviewed
- 16 October 2026
Our commitments
- We apply the Australian Privacy Principles to ourselves, whether or not an exemption for small businesses would otherwise apply.
- We collect the minimum. Forms ask only for what we need to reply. Readiness checks run in your browser and send nothing unless you choose to.
- No tracking. This website uses no advertising, analytics or tracking cookies, no third-party scripts and no embedded social media. Fonts are hosted on our own site.
- Consent is never bundled. Downloading a resource or sending an enquiry never signs you up for marketing. Newsletter consent is a separate, unticked box.
- We say what is law and what is not. Every briefing is labelled: law in force, law commencing later, bill, exposure draft, consultation, regulator guidance or voluntary standard.
- We see as little client data as possible. We ask for redacted or summarised information and work from samples, not full datasets.
How Lexora uses AI
We advise on AI governance, so we publish our own rules.
| We may use AI tools to | We do not |
|---|---|
| Summarise public legislation, guidance and consultation papers when preparing briefings | Publish anything an adviser has not read, checked against the primary source and approved |
| Draft structure and first versions of documents, checklists and templates | Let AI decide findings, risk ratings or recommendations in client work |
| Check spelling, plain English and consistency | Enter client personal information or confidential documents into AI tools that use inputs for training or that we have not assessed |
| Help build and test this website | Use AI-generated images of people, or present AI output as human expert opinion |
Before using any AI tool on client material we check, and record, where the data goes, whether it is retained or used for training, and whether the client has agreed. A named person at Lexora is accountable for every deliverable. We do not use AI to make decisions about individuals.
Website photographs are licensed stock photography of real scenes. None are AI-generated.
Service providers that handle personal information
These organisations process personal information on our behalf. Some are located overseas; we disclose this so you can make an informed choice, consistent with APP 8.
| Provider | What for | Information | Where | Safeguards |
|---|---|---|---|---|
| Netlify, Inc. | Website hosting, enquiry forms, newsletter sign-ups and resource download requests | Name, work email, organisation, role, message, IP address in server logs | United States | Contractual data processing terms; encryption in transit (TLS) |
This register lists providers in use today. It is updated before any new provider handles personal information.
Retention schedule
We keep personal information only as long as we need it (APP 11.2), then delete or de-identify it.
| Record | Kept for | Then |
|---|---|---|
| Website enquiries with no engagement | 2 years from last contact | Deleted |
| Newsletter subscriber records and consent evidence | While subscribed, plus 2 years after unsubscribing (to evidence consent) | Deleted; email kept on a suppression list only so we never re-add you |
| Resource download requests | 2 years | Deleted |
| Engagement working files and client documents | Returned or destroyed within 90 days of engagement close, unless the client asks otherwise in writing | Destroyed or returned |
| Final deliverables, proposals and engagement letters | 7 years | Destroyed |
| Invoices and financial records | 5 years after the transaction, as required by tax law | Destroyed |
| Privacy complaints and access or correction requests | 3 years after resolution | Destroyed |
| Website server logs (held by our host) | Set by our host's retention | Deleted by the host |
Security practices on this website
- Encrypted connections only (HTTPS with HSTS).
- A strict Content Security Policy, and headers that block framing, limit referrer data and switch off browser features we do not use (camera, microphone, location).
- A static website: no database, no logins and no server code on the public site, which keeps the attack surface small.
- Spam protection on forms uses a hidden field, not a third-party CAPTCHA that would track you.
- Access to form submissions and the content manager is limited to the people who need it.
Found a security issue? Email info@lexora.global with the subject "Security report". We will acknowledge it within two business days. See also security.txt.
If something goes wrong
We follow the same breach response we recommend to clients, aligned to the Notifiable Data Breaches scheme:
- Contain the incident as soon as we become aware of it.
- Assess whether it is likely to result in serious harm, within 30 days and sooner where we can.
- Notify affected people and the Office of the Australian Information Commissioner as soon as practicable if it is an eligible data breach.
- Review what happened and fix the cause. If a breach affects a client's information, we tell the client promptly so they can meet their own obligations.
Our free data breach response checklist shows the same steps.
Complaints
If you are unhappy with how we handled your personal information, or with our service, tell us. It costs nothing.
- Email info@lexora.global with the subject "Complaint", saying what happened and what you would like us to do.
- We acknowledge your complaint within two business days.
- We investigate and give you a written response within 30 days. If we need longer, we tell you why and when to expect it.
- If you are not satisfied, you can complain to the Office of the Australian Information Commissioner.
Email and marketing
We send commercial email only in line with the Spam Act 2003:
- Consent: only to people who ticked the newsletter box, or who ask us directly. We record when and where you gave consent.
- Identification: every email says it is from Lexora and how to contact us.
- Unsubscribe: every email has a one-click unsubscribe link, actioned within five business days (usually immediately).
- We never buy lists, and we never add enquiry or download contacts to the newsletter without consent.
Professional boundaries
- Not a law firm. Lexora provides governance advisory services. We do not give legal advice. Where you need a legal opinion, we will say so and can work alongside your lawyers.
- Not a certifier. We do not certify, accredit or audit against ISO standards. Our reviews prepare you; they are not a certificate.
- Independent. We do not resell software and our recommendations are not tied to any vendor.
- Fixed scope and fee. Every engagement is fixed-fee. We confirm scope and fee in writing after a free scoping call, before any work starts.
- Confidential. Engagements are covered by written confidentiality terms. We do not name clients without their written permission.