Legal
Privacy Policy
How Humsick Studios Pty Ltd collects, uses and protects personal information across humsick.com.au, Humsick Studios and Humsick Consulting.
Our commitment
Humsick Studios Pty Ltd (ABN 82 694 808 010) ("Humsick", "we", "us") operates humsick.com.au and the Humsick Studios and Humsick Consulting divisions. We treat personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we apply those principles whether or not we are strictly bound by them at a given size.
- We never rent, trade or sell personal information.
- We never publicly display your email address or other identifying details.
- We do not use advertising networks, remarketing tags or social media tracking pixels.
- We collect only what is needed to run the business and answer you.
What we collect
Personal information we may hold includes your name, role, business and postal addresses, phone number and email address, billing details for agreed invoicing (business name, ABN, address), and anything else you choose to share with us. We collect it when you:
- complete a contact form on this site;
- email, call or message us;
- scope, sign or receive an engagement, proposal or invoice; or
- attend an event, playtest or demonstration we run.
This site has no user accounts, logins or purchases, so we hold no passwords or payment details for it. We do not knowingly collect sensitive information through the website.
Cookies, analytics and this site
This site sets no cookies of its own and works with cookies switched off.
How we measure visits
We use Cloudflare Web Analytics to count visits and page views. It sets no cookies, does not fingerprint visitors and does not follow you to other websites. It reports counts only: page views, referring site, browser type and country.
Security and spam protection
The site is served through Cloudflare, which filters malicious traffic before it reaches us. Contact forms use Cloudflare Turnstile, a bot check that usually needs nothing from you. Both may run a check in your browser and set a short-lived cookie, used only to tell people from bots.
IP addresses and logs
Like any website we receive your IP address and basic connection information. We keep server logs for security and to detect misuse, and for no other purpose.
Other services your browser contacts
Typefaces are served from this site. Where we link to Steam or other platforms, nothing loads from them unless you click, and that organisation's own policy applies from there.
How we use and disclose it
We use personal information only for the purpose it was collected for, or a directly related purpose you would reasonably expect: to respond to you, to scope, deliver and invoice work, to keep business records, to protect this site, and to improve what we make.
We disclose personal information only to:
- service providers that run our operations (email and document storage, e-signature, accounting and hosting), each bound by confidentiality and privacy commitments;
- our professional advisers and insurers, under confidentiality;
- your authorised representatives, when you ask us to; and
- government or regulatory authorities where the law requires.
Some service providers store or process data outside Australia. We select providers with contractual privacy and security commitments and list them, with their data location, in our engagement Data Handling Policy.
Humsick Consulting
Consulting engagements
Security testing and IT consulting involve access to client systems, and sometimes to personal information inside them. That work is governed by our Data Handling and Privacy Policy, which forms part of every statement of work at the version it names. Its core commitments:
- Authorisation first. No data is collected from a client system without a signed authorisation covering that system.
- Minimum collection and least data. Findings are evidenced with metadata, record counts or test-account data. If a test reaches a client's own customers' production data, it stops, nothing further is read or retained, and the client is told immediately.
- Redaction. Personal information and secrets are masked in evidence and reports. Sensitive information is never captured as evidence.
- Purpose limitation. Engagement data is used only to deliver that engagement, never reused, published or used in marketing. Clients are never named without written consent.
- Deletion. Raw output, evidence and logs are deleted within 30 days of the final retest report, with written confirmation on request. The signed statement of work, authorisation, activity log and final reports are kept for a fixed period, encrypted and access-restricted, to evidence what was authorised and done.
- Incidents. Any actual or suspected unauthorised access to engagement data is contained, assessed and reported to the affected client within 72 hours of becoming aware.
The full policy is supplied with every proposal.
Humsick Studios
Games and other products
Our games are in development and not yet released. When a game, playtest or companion app collects any personal information (for example save data synced to an account, crash reports or a community sign-up), it will carry its own privacy notice describing exactly what is collected and why, and this policy will be updated to reference it. Purchases through storefronts such as Steam are processed by the storefront under its own policy; we do not see your payment details.
Storage, security and retention
Personal information is stored electronically in our business systems and with our hosting and productivity providers. Every device holding it uses full-disk encryption, every account that can reach it from outside our private network uses multi-factor authentication, and our own secrets are held in a password manager rather than in code, logs or documents. Infrastructure is patched on a schedule and before every engagement.
We keep personal information only as long as needed for its purpose and any legal, accounting or reporting requirement. Contact details of people who do not become clients are deleted after a fixed period following last contact. Client contact details stay with the engagement record. At the end of a retention period information is deleted or anonymised, and you can ask us to delete it sooner.
Access, correction and complaints
You may ask to access or correct the personal information we hold about you by emailing the contact below. We answer within 30 days and do not charge for the request itself. In limited cases the law allows us to refuse access, for example where it would unreasonably affect another person's privacy; if we refuse, we will tell you why.
If you believe we have mishandled your personal information, contact us first and we will respond within 30 days. You may also contact the Office of the Australian Information Commissioner at oaic.gov.au.
Changes and contact
We may revise this policy from time to time, in line with the Privacy Act and the Australian Privacy Principles. Changes take effect when the updated version is posted here, with the date above.
Privacy contact
Humsick Studios Pty Ltd
ACN 694 808 010 · ABN 82 694 808 010 · Australia