Privacy Policy

1. Overview & Scope

EFFOMA ("EFFOMA", "we", "our", or "us") is committed to protecting the privacy and security of your personal information in accordance with applicable data protection laws. This Privacy Policy describes in detail what personal data we collect, why we collect it, how we process and protect it, who we share it with, and what rights you have over your data.

This policy applies to:

• All visitors to our website at www.effoma.com and any subdomains
• Individuals who enquire about or engage our services
• Client personnel whose data we process in the course of delivering services
• Data subjects whose personal data we process on behalf of our clients (as a data processor)

We operate under the following legal frameworks:

• Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs)
• EU General Data Protection Regulation (EU) 2016/679 ("GDPR") — where we offer goods or services to, or monitor the behaviour of, individuals in the European Economic Area
• UK General Data Protection Regulation ("UK GDPR") and the UK Data Protection Act 2018 — where we process data of UK residents
• US Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), specifically the Privacy Rule (45 CFR Part 164, Subpart E), Security Rule (45 CFR Part 164, Subpart C), and Breach Notification Rule (45 CFR §§ 164.400–414) — where we handle Protected Health Information on behalf of US healthcare clients

Where there is a conflict between this policy and a specific contractual agreement (such as a Data Processing Agreement or Business Associate Agreement), the terms of that agreement shall prevail for the data processing it covers.

2. Data Controller & Data Protection Officer

For the purposes of the GDPR (Art. 4(7)) and UK GDPR, the data controller responsible for your personal data is:

Data Protection Officer (DPO): EFFOMA has designated a Data Protection Officer in accordance with GDPR Art. 37. For all data protection enquiries, data subject access requests (DSARs), or to exercise any of your rights under applicable data protection law, contact:

Where EFFOMA processes data on behalf of a client (i.e., as a data processor under GDPR Art. 4(8) or a business associate under HIPAA), the client remains the data controller (or covered entity). In such cases, data subjects should direct rights requests to the relevant client, though we will assist in fulfilling them in accordance with our data processing agreements.

3. Key Definitions

4. Categories of Personal Data We Collect

In accordance with GDPR Art. 13(1)(d) and Art. 14(1)(d), we disclose the specific categories of personal data we collect:

4.1 Data You Provide Directly

4.2 Data Collected Automatically

4.3 Data from Third Parties

4.4 Special Category Data

We do not routinely collect special category data (GDPR Art. 9(1)). Where a client engagement requires processing of health data or other special category data, we do so only with explicit consent (Art. 9(2)(a)) or under a specific legal basis, and subject to additional safeguards including encryption, access restrictions, and — where applicable — a BAA under HIPAA.

4.5 Necessity of Providing Data

Where we ask you to provide personal data in connection with a contract or service engagement, failure to provide the required data may mean we are unable to perform the contract or deliver the requested services. We will inform you at the point of collection whether providing specific data is a contractual requirement or voluntary. (GDPR Art. 13(2)(e))

5. Legal Basis for Processing (GDPR Art. 6 & 9)

Under GDPR Art. 6, we process personal data only where we have a valid legal basis. Under UK GDPR, the same bases apply. The table below maps each processing purpose to its specific legal basis:

Legitimate Interest Assessment

Where we rely on legitimate interests (Art. 6(1)(f)), we have conducted a Legitimate Interest Assessment (LIA) that weighs our business interests against the rights and freedoms of the data subject. Our legitimate interests include: operating and improving our website, maintaining security, administering our business relationships, and marketing our services to existing clients and relevant business contacts. We have determined that these interests do not override your fundamental rights, particularly given the safeguards we implement (pseudonymisation, data minimisation, easy opt-out mechanisms). You have the right to object to processing based on legitimate interests at any time (see Section 10).

6. Purposes of Processing

In accordance with the purpose limitation principle (GDPR Art. 5(1)(b)), we process personal data only for the specific, explicit, and legitimate purposes stated below. We will not further process your data in a manner incompatible with these purposes without providing notice and, where required, obtaining your consent.

We will never sell your personal data to third parties. We do not trade, rent, or otherwise commercially exploit personal data.

7. Recipients & Sub-Processors

In accordance with GDPR Art. 13(1)(e) and Art. 28, we disclose the categories of recipients with whom we may share personal data. All third-party processors are engaged under written Data Processing Agreements (DPAs) that include obligations to:

• Process data only on our documented instructions
• Ensure confidentiality of personnel processing the data
• Implement appropriate technical and organisational security measures
• Assist us in responding to data subject rights requests
• Delete or return all personal data at the end of the service relationship
• Submit to audits and inspections

Categories of Recipients

A current list of sub-processors is available upon request by contacting [email protected]. We will notify clients of any intended changes to sub-processors, providing the opportunity to object. (GDPR Art. 28(2))

8. International Data Transfers (GDPR Art. 44–49)

As an Australian company using global cloud platforms, your data may be transferred to and processed in countries outside Australia, the European Economic Area (EEA), or the United Kingdom. We ensure all cross-border transfers comply with GDPR Chapter V (Art. 44–49):

Transfer Mechanisms

We conduct Transfer Impact Assessments (TIAs) for each cross-border data flow, evaluating the legal framework of the recipient country and implementing supplementary measures where the level of protection is not essentially equivalent to that in the EEA/UK. Copies of the relevant SCCs and TIAs are available upon request.

9. Data Retention & Erasure

In accordance with the storage limitation principle (GDPR Art. 5(1)(e)), we retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. We have implemented a data retention schedule that is reviewed annually:

Erasure procedures: When data reaches the end of its retention period, or upon a valid erasure request, we securely delete or irreversibly anonymise the data. Electronic data is overwritten or cryptographically erased. We ensure that sub-processors also delete relevant data in accordance with our DPAs. (GDPR Art. 17)

10. Your Data Subject Rights

10.1 Under the GDPR & UK GDPR

You have the following rights, exercisable free of charge:

10.2 Under the Australian Privacy Act

• APP 12 — Access the personal information we hold about you
• APP 13 — Request correction of inaccurate, out-of-date, or incomplete information
• Complaint — Make a complaint to us or directly to the Office of the Australian Information Commissioner (OAIC)

10.3 Under HIPAA (for US individuals whose PHI we hold)

• Right to access — Inspect and obtain a copy of your PHI (45 CFR § 164.524)
• Right to amend — Request amendment of PHI you believe is inaccurate (45 CFR § 164.526)
• Right to an accounting of disclosures — Receive a list of certain disclosures of your PHI (45 CFR § 164.528)
• Right to request restrictions — Request limitations on certain uses or disclosures (45 CFR § 164.522)
• Right to confidential communications — Request that we communicate with you by alternative means or at alternative locations (45 CFR § 164.522)
• Right to a paper copy — Obtain a paper copy of this policy upon request

10.4 How to Exercise Your Rights

Submit requests to our Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request". We will:

• Acknowledge your request within 3 business days
• Verify your identity before processing (we may ask for government-issued ID or other proof)
• Respond substantively within 30 days (GDPR/UK GDPR — extendable by 2 months for complex requests, with notice)
• For HIPAA requests: respond within 30 days (extendable by 30 days with written notice per 45 CFR § 164.524(b)(2))
• Provide responses free of charge, unless requests are manifestly unfounded or excessive (Art. 12(5))

11. Consent Management

Where we rely on consent as the legal basis for processing (GDPR Art. 6(1)(a) or Art. 9(2)(a)), we ensure that:

• Consent is freely given, specific, informed, and unambiguous (GDPR Art. 4(11))
• Consent is obtained through a clear affirmative action (no pre-ticked boxes)
• Consent for different processing purposes is requested separately (granular consent)
• You are informed of the right to withdraw consent at any time before giving it
• Withdrawal of consent is as easy as giving it (e.g., one-click unsubscribe for marketing emails)
• We maintain timestamped records of when and how consent was given, for accountability (Art. 7(1))

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. (GDPR Art. 7(3))

12. Automated Decision-Making & Profiling

In accordance with GDPR Art. 22, we disclose the following:

• We do not currently engage in automated decision-making that produces legal effects or similarly significantly affects you
• We do not build profiles for the purpose of credit scoring, automated eligibility determinations, or similar automated outcomes
• Where AI tools are used in project delivery (e.g., content generation, data analysis), outputs are subject to human review before any decisions affecting individuals are made

If we introduce automated decision-making in the future, we will update this policy, provide meaningful information about the logic involved, the significance, and the envisaged consequences (Art. 13(2)(f)), and implement the right to obtain human intervention, express your point of view, and contest the decision (Art. 22(3)).

13. Cookies & Tracking Technologies

Our website uses cookies and similar technologies. In compliance with the ePrivacy Directive (2002/58/EC, as amended) and GDPR, we implement the following cookie governance:

Cookie Categories

Your Cookie Choices

• Consent banner: On your first visit, non-essential cookies are blocked until you provide explicit consent via our cookie consent mechanism
• Withdrawal: You can change your cookie preferences at any time through your browser settings or by clearing cookies
• Browser controls: Most browsers allow you to refuse or delete cookies via settings
• Google Analytics opt-out: Install the Google Analytics opt-out browser add-on

Refusing non-essential cookies will not affect the core functionality of our website.

14. HIPAA Compliance Framework

Where EFFOMA provides services to US-based healthcare clients that involve the creation, receipt, maintenance, or transmission of Protected Health Information (PHI), we operate as a Business Associate under HIPAA and implement the following compliance framework:

14.1 Business Associate Agreements (45 CFR § 164.502(e))

• A signed BAA is executed with every covered entity before any PHI is created, received, maintained, or transmitted
• BAAs specify permitted uses and disclosures, safeguard requirements, breach notification obligations, and termination provisions
• We do not use or disclose PHI except as permitted by the BAA and the HIPAA Privacy Rule

14.2 Privacy Rule Compliance (45 CFR Part 164, Subpart E)

• Minimum Necessary Standard — We limit PHI access, use, and disclosure to the minimum necessary to accomplish the intended purpose (45 CFR § 164.502(b))
• Use and disclosure limitations — PHI is used only for the purposes specified in the BAA; any other use requires written authorisation from the individual or covered entity
• Individual rights — We assist covered entities in fulfilling individual rights requests (access, amendment, accounting of disclosures, restrictions, confidential communications)
• De-identification — Where feasible, we use de-identified data per Safe Harbor (45 CFR § 164.514(b)) or Expert Determination (45 CFR § 164.514(a)) methods

14.3 Security Rule Compliance (45 CFR Part 164, Subpart C)

We implement safeguards across all three HIPAA Security Rule categories:

14.4 Breach Notification (45 CFR §§ 164.400–414)

In the event of a breach of unsecured PHI, we will:

• Notify the affected covered entity without unreasonable delay and no later than 60 days after discovery of the breach
• Provide the covered entity with the identity of each individual affected, a description of the types of PHI involved, steps individuals should take to protect themselves, what we are doing to investigate and mitigate, and contact procedures
• Cooperate with the covered entity's obligations to notify affected individuals, the HHS Secretary, and (for breaches affecting 500+ individuals) prominent media outlets
• Maintain a log of all breaches for 6 years, regardless of size

14.5 Record Retention

HIPAA-related documentation — including policies, procedures, BAAs, risk assessments, training records, and breach logs — is retained for a minimum of 6 years from the date of creation or the date when it was last in effect, whichever is later (45 CFR § 164.530(j)).

If your engagement with EFFOMA involves health data, contact us at [email protected] to ensure a BAA is executed before project commencement.

15. Technical & Organisational Security Measures

In accordance with GDPR Art. 32 and the HIPAA Security Rule, we implement technical and organisational measures appropriate to the risk, including:

Encryption

• In transit: All data transmitted to/from our systems uses TLS 1.2 or TLS 1.3. HTTP Strict Transport Security (HSTS) is enforced across all domains
• At rest: AES-256 encryption for stored data, including databases and backups. Encryption keys are managed via cloud provider KMS (AWS KMS / Google Cloud KMS)

Access Control

• Role-Based Access Control (RBAC) with principle of least privilege
• Multi-factor authentication (MFA) mandatory for all administrative and production system access
• Automatic session timeout after periods of inactivity
• Unique user accounts — no shared credentials

Infrastructure Security

• Enterprise-grade cloud hosting (AWS, Google Cloud) with SOC 2 Type II and ISO 27001 certifications
• Network segmentation and firewall rules to isolate production environments
• DDoS mitigation via Cloudflare
• Container-based deployment with immutable infrastructure

Monitoring & Response

• Centralised logging and monitoring of security events
• Documented incident response plan with defined roles, escalation procedures, and communication protocols
• Regular vulnerability assessments and security reviews
• Dependency scanning for known vulnerabilities in third-party libraries

Personnel

• Confidentiality agreements for all personnel and subcontractors
• Security awareness training at onboarding and recurring annually
• Access revocation procedures upon role change or termination

No system is 100% secure. In the event of a security incident, we follow the breach notification procedures described in Section 16.

16. Data Breach Notification

We maintain a documented data breach response plan. In the event of a personal data breach:

GDPR / UK GDPR (Art. 33 & 34)

• Supervisory authority notification: Where a breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (Art. 33(1))
• Data subject notification: Where a breach is likely to result in a high risk to your rights and freedoms, we will notify affected individuals without undue delay (Art. 34(1)), describing the nature of the breach, likely consequences, and measures taken or proposed
• Processor obligation: Where we are acting as a data processor, we will notify the data controller without undue delay after becoming aware of the breach (Art. 33(2))

Australian Privacy Act (Notifiable Data Breaches scheme)

• We will notify the OAIC and affected individuals as soon as practicable where a breach is likely to result in serious harm, in accordance with Part IIIC of the Privacy Act

HIPAA (45 CFR §§ 164.400–414)

• See Section 14.4 for HIPAA-specific breach notification procedures and timelines

All breaches (including near-misses) are logged in our breach register, investigated to determine root cause, and followed by remediation measures to prevent recurrence.

17. Data Protection Impact Assessments

In accordance with GDPR Art. 35, we conduct Data Protection Impact Assessments (DPIAs) before commencing any processing that is likely to result in a high risk to the rights and freedoms of individuals. This includes:

• Large-scale processing of special category data (Art. 9) or criminal offence data (Art. 10)
• Systematic and extensive profiling with significant effects
• Large-scale systematic monitoring of publicly accessible areas
• Use of new technologies where the risk to data subjects is not yet well understood
• Any processing involving PHI under HIPAA that presents elevated risk

DPIAs include: a systematic description of the processing operations and purposes; an assessment of necessity and proportionality; an assessment of risks to data subjects; and the measures envisaged to address those risks. Where a DPIA indicates high residual risk, we consult with the relevant supervisory authority before processing (Art. 36).

18. Privacy by Design & by Default

In accordance with GDPR Art. 25, we implement data protection by design and by default across all systems and services:

• By design: Data protection considerations are integrated into the design phase of every project, system, and process — not as an afterthought
• By default: We ensure that, by default, only personal data necessary for each specific purpose is processed. This applies to the amount of data collected, the extent of processing, the period of storage, and accessibility
• Data minimisation: We collect only the data that is adequate, relevant, and limited to what is necessary (Art. 5(1)(c))
• Pseudonymisation: Where possible, we pseudonymise personal data to reduce risk while still enabling processing (Art. 25(1))
• Records of Processing Activities: We maintain a register of all processing activities as required by Art. 30, available to the supervisory authority upon request

19. Children's Privacy

Our services are directed at businesses and professionals, not children. We do not knowingly collect personal data from anyone under the age of 16 (or under 13 in jurisdictions where that is the applicable age threshold). In accordance with GDPR Art. 8, where we offer information society services directly to a child, we will obtain consent from the holder of parental responsibility.

If you believe we have inadvertently collected data about a child, please contact us immediately at [email protected]. We will verify and delete the data within 72 hours of confirmation.

20. Changes to This Policy

We review this Privacy Policy at least annually and update it when required to reflect changes in our practices, applicable law, or regulatory guidance. Each version is identified by the "Effective date" and "Version" number at the top of this page.

For material changes (changes to data categories collected, new processing purposes, changes to third-party recipients, or changes to your rights), we will:

• Publish the updated policy on this page with a new effective date
• Provide prominent notice on our website (e.g., a banner notification)
• Directly notify affected individuals via email where we hold their contact details and the change materially affects them
• Where a change requires consent under GDPR, we will seek fresh consent before implementing the change

Previous versions of this policy are available upon request.

21. Complaints & Supervisory Authorities

If you are dissatisfied with how we handle your personal data or respond to your rights request, you have the right to lodge a complaint with a supervisory authority:

Australia

Office of the Australian Information Commissioner (OAIC)
Website: oaic.gov.au
Phone: 1300 363 992

European Union

You have the right to lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement (GDPR Art. 77). A list of EU data protection authorities is available at edpb.europa.eu.

United Kingdom

Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113

United States (HIPAA)

US Department of Health and Human Services (HHS), Office for Civil Rights
Website: hhs.gov/hipaa/filing-a-complaint

We encourage you to contact us first at [email protected] so we can attempt to resolve your concern directly. We take all complaints seriously and aim to resolve them within 30 days.

22. Contact Us

For any questions, concerns, data subject access requests, or complaints relating to this Privacy Policy or our data practices:

We aim to acknowledge all enquiries within 3 business days and provide a substantive response within 30 days.