Privacy Policy

Effective Date: 4 October 2026

Entity: ShieldMaiden Cybersecurity Pty Ltd (ACN 697 898 552)

Websites: www.shieldmaidencyber.com.au

1. Overview & Commitment

ShieldMaiden Cybersecurity Pty Ltd ("ShieldMaiden", "we", "us", or "our") is Australia’s first female-owned sovereign cybersecurity services and technology solutions provider. As a security-first organization, protecting the privacy, confidentiality, and integrity of personal information is fundamental to our business and ethos.

This Privacy Policy sets out how ShieldMaiden collects, holds, uses, and discloses personal information in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy applies to all visitors to our websites, prospective and current enterprise clients, vendor partners, job candidates, and applicants for our social impact and scholarship programs.

2. Information We Collect

We only collect personal information that is reasonably necessary for one or more of our business functions, service delivery models, or social impact initiatives.

2.1 Information You Provide Directly

Business Contact Information: Name, job title, organisational email address, phone number, company name, and industry sector when you submit web inquiry forms, request capability statements, or book discovery sessions.
Commercial & Service Information: Details regarding your organisation’s cybersecurity posture, IT infrastructure requirements, licensing needs, or compliance frameworks (e.g., Essential Eight, ISO 27001 shared during consultations or project scoping.
Scholarship & Cadetship Application Data: Information submitted by candidates applying for ShieldMaiden educational scholarships, cadetships, or re-skilling programs, including educational background, employment history, contact details, and relevant demographic information required to evaluate eligibility for targeted social impact initiatives.
Billing & Administrative Details: Invoicing contact details, billing addresses, and transactional histories.

2.2 Automatically Collected Information

When you access our websites, we may automatically collect limited technical data to ensure site performance, security, and optimisation:

Device & Connection Data: IP address, browser type, operating system, device identifiers, and network location.
Usage & Analytics: Pages visited, time spent on pages, referral URL, and interaction patterns (collected via privacy-compliant analytics tools).

3. How We Collect Personal Information

We collect personal information through lawful and fair means, primarily:

Directly from you when you complete forms on [www.shieldmaidencyber.com](https://www.shieldmaidencyber.com).au
During commercial interactions, contract negotiations, discovery calls, or account management engagements.
Through formal applications submitted for ShieldMaiden corporate scholarships, TAFE/University initiatives, or employment pathways.
From authorized third-party vendor partners when co-marketing or managing technology licensing fulfillments.

4. Purposes of Collection, Use, and Disclosure

ShieldMaiden uses and discloses personal information solely for the purposes for which it was collected, related internal business purposes, or as required or authorized by Australian law.

Primary Business Purposes:

Service Delivery & Architecture: Providing cybersecurity advisory, GRC assessments, offensive security testing, managed detection and response (MDR), and software asset rationalization.
Technology Procurement & Reselling: Processing vendor software licenses, subscriptions, and partner integration services.
Social Impact Program Management: Administering corporate scholarships, paid cadetships/apprenticeships, and tracking progress toward our social dividend goals (including reporting under the Australian Skills Guarantee and WGEA frameworks)
Client Communication & Account Management: Responding to inquiries, delivering technical commentary, issuing billing notices, and managing client relationships.
Website & Infrastructure Security: Monitoring web activity to prevent cyber threats, unlawful access, or system misuse.

5. Disclosure to Third Parties

ShieldMaiden does not sell, rent, or trade personal information. We may disclose personal information to trusted third parties under strict confidentiality and security requirements:

Strategic Vendor & Delivery Partners: Tier-1 technology partners and specialised implementation or engineering delivery partners engaged to fulfill enterprise contract deliverables.
Educational Institutions & Training Bodies: Universities and TAFE networks participating in the administration of ShieldMaiden educational scholarships and cadetship placements.
Professional & Operational Service Providers: External auditors, legal advisors, IT infrastructure hosts, and billing platform providers operating under strict data protection agreements.
Government & Regulatory Authorities: Where required to comply with mandatory reporting obligations under Australian law, including statutory obligations under the Privacy Act 1988 (Cth) or judicial requests.

6. Overseas Data Disclosures & Sovereign Data Handling

As a sovereign Australian cybersecurity firm, ShieldMaiden prioritizes local data residency and sovereign cloud infrastructure wherever practical.

Where software vendors or cloud service providers process data internationally (e.g., global SaaS platforms or vendor license portals), we take reasonable steps to ensure that cross-border recipients comply with the Australian Privacy Principles or operate under privacy standards equivalent to APP 8.

7. Data Security and Safeguards

In accordance with our "Security-by-Design" principle, ShieldMaiden implements technical, administrative, and physical safeguards to protect personal information against loss, unauthorized access, modification, disclosure, or misuse:

Technical Controls: Encryption of data in transit and at rest, identity access management (IAM), multi-factor authentication (MFA), strict access controls, automated patch management (APMS), and regular repository security audits.
Operational Security: Ongoing employee security awareness training, strict non-disclosure obligations and adherence to Australian Signals Directorate (ASD) Essential Eight mitigations.
Notifiable Data Breaches (NDB) Scheme: ShieldMaiden maintains a documented Incident Response Plan[cite: 1, 3, 7]. In the event of an eligible data breach, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in strict compliance with Part IIIC of the Privacy Act 1988 (Cth).

8. Data Retention & Destruction

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy or as required by financial, legal, and operational reporting regulations. When personal information is no longer required, we securely destroy or permanently de-identify the data in accordance with cyber industry best practice.

9. Your Rights: Access and Correction

You have the right to request access to the personal information ShieldMaiden holds about you and to request corrections if you believe the information is inaccurate, out-of-date, incomplete, or misleading.

To submit an access or correction request:

Email: privacy@shieldmaidencyber.com.au

We will respond to your request within 30 calendar days. We may require proof of identity prior to granting access or making corrections.

10. Complaints & Dispute Resolution

If you have concerns about how ShieldMaiden handles your personal information or believe we have breached the Australian Privacy Principles, please contact our Privacy Lead:

Privacy Lead

ShieldMaiden Cybersecurity Pty Ltd

Email: privacy@shieldmaidencyber.com.au

Web: www.shieldmaidencyber.com.au

11. Policy Updates

ShieldMaiden reviews and updates this Privacy Policy periodically to reflect changes in legal requirements, operational practices, or emerging technology standards. Any revisions will be published directly to our primary web platform with an updated effective date.

Privacy Policy

Privacy Policy

Effective Date: 4 October 2026

Entity: ShieldMaiden Cybersecurity Pty Ltd (ACN 697 898 552)

Websites: www.shieldmaidencyber.com.au

1. Overview & Commitment

2. Information We Collect

We only collect personal information that is reasonably necessary for one or more of our business functions, service delivery models, or social impact initiatives.

​

2.1 Information You Provide Directly

Business Contact Information: Name, job title, organisational email address, phone number, company name, and industry sector when you submit web inquiry forms, request capability statements, or book discovery sessions.

​

Commercial & Service Information: Details regarding your organisation’s cybersecurity posture, IT infrastructure requirements, licensing needs, or compliance frameworks (e.g., Essential Eight, ISO 27001 shared during consultations or project scoping.

​

​

Billing & Administrative Details: Invoicing contact details, billing addresses, and transactional histories.

​

2.2 Automatically Collected Information

When you access our websites, we may automatically collect limited technical data to ensure site performance, security, and optimisation:

​

Device & Connection Data: IP address, browser type, operating system, device identifiers, and network location.

​

Usage & Analytics: Pages visited, time spent on pages, referral URL, and interaction patterns (collected via privacy-compliant analytics tools).

3. How We Collect Personal Information

We collect personal information through lawful and fair means, primarily:

Directly from you when you complete forms on [www.shieldmaidencyber.com](https://www.shieldmaidencyber.com).au

​

During commercial interactions, contract negotiations, discovery calls, or account management engagements.

Through formal applications submitted for ShieldMaiden corporate scholarships, TAFE/University initiatives, or employment pathways.

​

From authorized third-party vendor partners when co-marketing or managing technology licensing fulfillments.

​

4. Purposes of Collection, Use, and Disclosure

ShieldMaiden uses and discloses personal information solely for the purposes for which it was collected, related internal business purposes, or as required or authorized by Australian law.

Primary Business Purposes:

Service Delivery & Architecture: Providing cybersecurity advisory, GRC assessments, offensive security testing, managed detection and response (MDR), and software asset rationalization.

Technology Procurement & Reselling: Processing vendor software licenses, subscriptions, and partner integration services.

Social Impact Program Management: Administering corporate scholarships, paid cadetships/apprenticeships, and tracking progress toward our social dividend goals (including reporting under the Australian Skills Guarantee and WGEA frameworks)

Client Communication & Account Management: Responding to inquiries, delivering technical commentary, issuing billing notices, and managing client relationships.

Website & Infrastructure Security: Monitoring web activity to prevent cyber threats, unlawful access, or system misuse.

5. Disclosure to Third Parties

ShieldMaiden does not sell, rent, or trade personal information. We may disclose personal information to trusted third parties under strict confidentiality and security requirements:

Strategic Vendor & Delivery Partners: Tier-1 technology partners and specialised implementation or engineering delivery partners engaged to fulfill enterprise contract deliverables.

Educational Institutions & Training Bodies: Universities and TAFE networks participating in the administration of ShieldMaiden educational scholarships and cadetship placements.

Professional & Operational Service Providers: External auditors, legal advisors, IT infrastructure hosts, and billing platform providers operating under strict data protection agreements.

Government & Regulatory Authorities: Where required to comply with mandatory reporting obligations under Australian law, including statutory obligations under the Privacy Act 1988 (Cth) or judicial requests.

6. Overseas Data Disclosures & Sovereign Data Handling

As a sovereign Australian cybersecurity firm, ShieldMaiden prioritizes local data residency and sovereign cloud infrastructure wherever practical.

7. Data Security and Safeguards

In accordance with our "Security-by-Design" principle, ShieldMaiden implements technical, administrative, and physical safeguards to protect personal information against loss, unauthorized access, modification, disclosure, or misuse:

​

Technical Controls: Encryption of data in transit and at rest, identity access management (IAM), multi-factor authentication (MFA), strict access controls, automated patch management (APMS), and regular repository security audits.

Operational Security: Ongoing employee security awareness training, strict non-disclosure obligations and adherence to Australian Signals Directorate (ASD) Essential Eight mitigations.

​

8. Data Retention & Destruction

9. Your Rights: Access and Correction

You have the right to request access to the personal information ShieldMaiden holds about you and to request corrections if you believe the information is inaccurate, out-of-date, incomplete, or misleading.

To submit an access or correction request:

​

Email: privacy@shieldmaidencyber.com.au

​

We will respond to your request within 30 calendar days. We may require proof of identity prior to granting access or making corrections.

10. Complaints & Dispute Resolution

If you have concerns about how ShieldMaiden handles your personal information or believe we have breached the Australian Privacy Principles, please contact our Privacy Lead:

​

Privacy Lead

​

ShieldMaiden Cybersecurity Pty Ltd

Email: privacy@shieldmaidencyber.com.au

​

Web: www.shieldmaidencyber.com.au

​

​

11. Policy Updates

ShieldMaiden reviews and updates this Privacy Policy periodically to reflect changes in legal requirements, operational practices, or emerging technology standards. Any revisions will be published directly to our primary web platform with an updated effective date.