Privacy Policy

Last updated: 13 October 2026  ·  PraetorianX (ABN 68 549 085 355)

1. Who we are

PraetorianX (ABN 68 549 085 355) ("PraetorianX", "we", "us" or "our") is an Australian provider of digital forensics, electronic discovery, managed IT services and ICT consulting. Our technical headquarters is in Western Australia, and we serve clients in Sydney, Melbourne, Perth and across Australia.

This policy explains how we handle "personal information" and "sensitive information" as those terms are defined in the Privacy Act 1988 (Cth) (the "Privacy Act").

2. Scope of this policy

This policy applies to personal information we handle when you:

• visit praetorianx.au;
• contact us by phone, email or any other channel;
• engage us, or are a representative of an organisation that engages us, for forensic, eDiscovery, managed IT or consulting services; or
• are an individual whose information appears in material provided to us during an engagement, such as evidence, devices or data sets.

Where an engagement letter, statement of work, non-disclosure agreement or court order imposes stricter obligations, those obligations apply in addition to this policy.

3. Information we collect

Enquiries and communications

• Name, job title, organisation, phone number and email address.
• The content of your enquiry and our correspondence with you.

Client engagements and billing

• Contact details for client representatives, instructing solicitors and authorised personnel.
• Matter or case references, engagement instructions and authorisations.
• Billing details such as invoice addresses and payment references. We do not store payment card numbers.

Managed IT services

• User account details, device identifiers and network or security logs needed to operate, monitor and secure client systems.

Anonymity and pseudonymity

You may make a general enquiry without identifying yourself or by using a pseudonym. We will usually need your identity, and evidence of your authority, before we can act on an engagement.

4. Evidence & client data

Forensic and eDiscovery work often involves devices, accounts and data sets that contain personal and sensitive information about clients, employees, counterparties or other third parties. This can include health, financial, communications and location information. For this material:

• We handle it only on the client's lawful instructions and only for the purpose of the engagement.
• We rely on the client's warranty that it has the lawful authority to provide the material to us. Clients must have that authority before handing over material.
• We record its acquisition, handling and transfer under a documented chain of custody, and we verify its integrity using cryptographic hashing (for example SHA-256).
• We process it on controlled, access-restricted infrastructure. We do not upload it to public AI services, public web APIs or unauthorised cloud services.
• Where material may be subject to legal professional privilege, we handle it so as to preserve that privilege, as directed by the client or its lawyers.

5. How we collect it

We collect personal information directly from you where reasonable and practicable. We also collect it from your organisation, your legal representatives, courts and tribunals, publicly available sources, and from material provided to us during an engagement.

6. How we use it

• To respond to enquiries and prepare quotes and proposals.
• To deliver forensic, eDiscovery, managed IT and consulting services, including preparing reports and expert evidence.
• To maintain chain of custody and the integrity of evidence.
• To administer accounts, invoicing and payments.
• To secure and monitor our own and our clients' systems.
• To comply with legal, regulatory, court and tax obligations.

We do not use client data or evidence for marketing, profiling or training of any AI model. We send business communications only where you have agreed to receive them or where the Spam Act 2003 (Cth) otherwise permits, and every such message includes a way to opt out.

7. When we disclose it

We never sell, rent or trade personal information. We disclose it only:

• to the client, and its legal representatives, for whom the work is performed;
• to courts, tribunals and parties to proceedings, where the client instructs us or the law requires;
• to carefully selected contractors and specialists who are bound by confidentiality obligations no less strict than ours;
• to service providers that support our business operations, such as email, accounting and secure storage providers; or
• where required or authorised by law, such as under a valid subpoena, warrant or court order. Where the law permits, we will notify the affected client first so it can seek protection.

8. Overseas disclosure

Evidence and engagement data are processed and stored in Australia unless the client agrees otherwise in writing. Some business service providers, such as email or accounting platforms, may store limited business information, such as contact and billing details, on servers outside Australia. Where this occurs, we take reasonable steps under APP 8 to make sure those providers protect the information in a manner consistent with the APPs.

9. How we protect it

• Encryption of data at rest and in transit, using industry standards such as AES-256 and TLS.
• Role-based access, limited to personnel who need it for an engagement.
• Isolated, zero-trust processing environments for forensic material.
• Physical security and sealed evidence storage, logged at each transfer.
• Confidentiality agreements with all personnel and contractors.

No system is completely secure, but we keep our controls under regular review.

10. Retention & destruction

• Evidence and engagement data are kept for the period set out in the engagement terms or required by the court. At the end of an engagement, or on the client's written request, they are returned or securely destroyed, and we can provide a written certificate of destruction.
• Business and financial records are kept for at least the period required by Australian tax and corporate law.
• General enquiries that do not lead to an engagement are deleted once they are no longer needed.

11. Website, cookies & logs

• We do not use advertising cookies, tracking pixels or third-party analytics such as Google Analytics.
• Our hosting and security providers may set strictly necessary cookies and record server logs, including IP addresses, browser types and request times. These are used only to keep the site secure, prevent abuse and keep it available.
• Our site may link to third-party websites. We are not responsible for their privacy practices.

12. Data breaches

If we suspect a data breach, we contain it and assess it promptly. If an eligible data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. We will also notify affected clients as required by their engagement terms.

13. Access & correction

You may ask to access, or correct, the personal information we hold about you. We will respond within a reasonable time, usually within 30 days. We may need to verify your identity first.

The Privacy Act permits us to refuse or limit access in some situations, for example where access would breach a court order, legal professional privilege or confidentiality owed to a client, or would unreasonably affect another person's privacy. If we refuse, we will tell you why in writing.

14. Complaints

If you believe we have breached the APPs, please contact our Privacy Officer with the details. We will acknowledge your complaint, investigate it and respond in writing, usually within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner: oaic.gov.au or phone 1300 363 992.

15. Changes to this policy

We may update this policy to reflect changes in our services, practices or the law. The current version is always published on this page, with the date it was last updated.

16. Contact us