Business Name: Bonfire Digital Pty Ltd
ABN: 27 093 354 833
Perth (head office): Level 1, 1 Rokeby Road, Subiaco, WA 6008
Melbourne: Level 2/627 Chapel St, South Yarra, VIC 3141
Website: https://bonfire.com.au
Effective Date: 9 October 2026
Last Updated: 9 October 2026
INTRODUCTION
Bonfire Digital Pty Ltd (we, us, our) is committed to protecting your privacy and complying with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). This Privacy Policy explains how we collect, use, disclose, and protect your personal information.
We are a professional services business operating in Australia, and we take our privacy obligations seriously.
1. OPEN AND TRANSPARENT MANAGEMENT OF PERSONAL INFORMATION (APP 1)
We manage personal information in an open and transparent way. This Privacy Policy sets out:
- The kinds of personal information we collect and hold
- How we collect and hold personal information
- The purposes for which we collect, hold, use and disclose personal information
- How you may access and seek correction of personal information
- How you may complain about a breach of the APPs and how we will deal with such a complaint
- Whether we are likely to disclose personal information to overseas recipients
2. ANONYMITY AND PSEUDONYMITY (APP 2)
Where it is lawful and practicable, you have the option of not identifying yourself, or using a pseudonym when dealing with us. However, in most cases, we will need to collect your personal information to provide you with our services.
3. COLLECTION OF SOLICITED PERSONAL INFORMATION (APP 3)
What Personal Information We Collect
We collect personal information that is reasonably necessary for our business functions and activities. The types of personal information we may collect include:
- Name and contact details (email, phone, address)
- Device and browser information
- Location data
- Website usage data
- Employment and professional information
- Communications and correspondence
- Billing and payment details
- Job application information, such as resumes and cover letters
How We Collect Personal Information
We collect personal information directly from you when you:
- Engage us for services or subscribe to our communications
- Contact us via email, phone, or our website
- Complete forms or surveys
- Use our website or online services
- Interact with us on social media
- Apply for a job with us
We may also collect information automatically through cookies and similar technologies when you use our website or digital services.
Collection from Third Parties
In some circumstances, we may collect personal information from third parties, including:
- Publicly available sources
- Our service providers and business partners
- Social media platforms
- Our clients, where we provide services on their behalf (see "Personal Information We Handle on Behalf of Clients" below)
- Other organisations, where you have consented to such disclosure
Job Applicants
If you apply for a job with us, we store the information you submit in our email systems and use it only to assess your application.
4. DEALING WITH UNSOLICITED PERSONAL INFORMATION (APP 4)
If we receive personal information we did not solicit, we will determine whether we could have collected it under APP 3. If not, we will destroy or de-identify the information as soon as practicable, provided it is lawful and reasonable to do so.
5. NOTIFICATION OF COLLECTION (APP 5)
When we collect personal information, we will take reasonable steps to notify you of certain matters, including:
- Our identity and contact details
- The purposes for which we collect the information
- The consequences if we do not collect the information
- The organisations to which we usually disclose information
- Information about our privacy policy
- Whether we are likely to disclose information to overseas recipients
- How you may access and seek correction of the information
- How you may complain about a breach of privacy
6. USE OR DISCLOSURE OF PERSONAL INFORMATION (APP 6)
Primary Purpose
We will only use or disclose your personal information for the purpose for which it was collected (the primary purpose), or for a related secondary purpose where you would reasonably expect us to do so.
We collect and use personal information for the following purposes:
- To provide our services to you
- To process invoices and payments
- To communicate with you about our services
- To respond to your inquiries and provide support
- To improve our services and website
- To assess job applications
- To comply with legal and regulatory requirements
- To prevent fraud and ensure security
Secondary Purposes
We may use or disclose your personal information for secondary purposes where:
- You have consented to the use or disclosure
- You would reasonably expect us to use or disclose the information for that purpose
- The use or disclosure is required or authorised by law
- We reasonably believe the use or disclosure is necessary to prevent a serious threat to life, health, or safety
Use of AI Tools
In some cases, we use artificial intelligence (AI) tools to analyse data, including client data, for the purpose of providing our services, such as strategy, insights, and data analysis. We use AI tools only for these purposes.
PERSONAL INFORMATION WE HANDLE ON BEHALF OF CLIENTS
When we provide services to our clients, we may handle personal information about our clients' own customers. For example, a client may want to use their customer list to target advertising.
In most cases, we advise our clients on how to upload this data to advertising platforms themselves, so we do not handle it. Where we do handle it, we only handle data that has been hashed (converted into a scrambled code that cannot be reversed), and it is uploaded directly to the advertising platform.
Hashing protects the information, but it does not make it anonymous, so we treat hashed data as personal information and handle it in line with this Privacy Policy.
7. DIRECT MARKETING (APP 7)
We may use your personal information to send you direct marketing communications about our services, including:
- Email marketing
- Social media advertising
- Direct mail
Where we send direct mail using contact details collected from publicly available sources, each mail piece includes a statement explaining how to opt out.
You can opt out of receiving marketing communications at any time by:
- Using the unsubscribe link in our emails
- Emailing [email protected] to be removed from our email or direct mail lists
- Contacting us using the details below
If you opt out of marketing communications, we may still send you non-promotional messages related to our business relationship, such as service updates and administrative notices.
8. CROSS-BORDER DISCLOSURE OF PERSONAL INFORMATION (APP 8)
To deliver our services, we use service providers based overseas, including cloud hosting providers, advertising platforms, and AI tools. As a result, we may disclose personal information to recipients located in the United States, Ireland, Singapore, and other countries where our service providers operate.
Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient handles it consistently with the Australian Privacy Principles. This may include:
- Ensuring the overseas recipient is subject to a law or binding scheme that provides similar protection to the APPs
- Including contractual clauses in our agreements with overseas recipients
9. ADOPTION, USE OR DISCLOSURE OF GOVERNMENT RELATED IDENTIFIERS (APP 9)
We will not adopt a government-related identifier (such as a driver's licence number or Medicare number) as our own identifier of individuals. We will only use or disclose government-related identifiers where required or authorised by law.
10. QUALITY OF PERSONAL INFORMATION (APP 10)
We take reasonable steps to ensure that the personal information we collect, use, or disclose is accurate, up-to-date, complete, and relevant. We encourage you to contact us if any of your personal information is incorrect or has changed.
11. SECURITY OF PERSONAL INFORMATION (APP 11)
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure.
Technical Security Measures
The specific technical measures we implement include:
- Encryption of data in transit and at rest using industry-standard protocols
- Secure backup systems with encryption and access controls
- Storage of client account access details (such as advertising and analytics platform logins) in an encrypted password manager with access controls
Organisational Security Measures
The specific organisational measures we implement include:
- Ongoing privacy and security training and regular security guidance for all staff
- Clear policies and procedures for handling personal information
- Role-based access controls ensuring staff only access information necessary for their role
Data Breach Response
In the event of a suspected or confirmed data breach, we will:
- Immediately investigate and contain the breach
- Assess whether the breach is likely to result in serious harm
- Notify affected individuals and the Office of the Australian Information Commissioner (OAIC) if required under the Notifiable Data Breaches (NDB) scheme
- Take remedial action to prevent similar breaches in the future
- Provide affected individuals with recommendations on steps they can take to protect themselves
Data Destruction and De-identification
When we no longer need personal information for any purpose, and we are not required by law to retain it, we will take reasonable steps to securely destroy or permanently de-identify the information.
Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies to enhance your experience and collect information about how you use our services. You can control cookies through your browser settings, but please note that disabling cookies may affect the functionality of our website.
12. ACCESS TO PERSONAL INFORMATION (APP 12)
You have the right to request access to the personal information we hold about you. To request access, please contact us using the details provided below. We will respond to your request within a reasonable timeframe (generally within 30 days).
In some circumstances, we may need to deny your request, such as where:
- Giving access would pose a serious threat to life, health, or safety
- Giving access would have an unreasonable impact on the privacy of others
- The request is frivolous or vexatious
- Giving access would be unlawful
- Legal proceedings are underway or anticipated
If we deny your request, we will provide you with written reasons for the denial and information about how you may complain about the refusal.
13. CORRECTION OF PERSONAL INFORMATION (APP 13)
You have the right to request correction of personal information we hold about you if you believe it is inaccurate, out-of-date, incomplete, irrelevant, or misleading. To request a correction, please contact us using the details below. We will respond to your request within a reasonable timeframe and take reasonable steps to correct the information.
If we refuse to correct personal information, we will provide you with written reasons and information about how you may complain about the refusal. You may also request that we associate a statement with the information noting that you believe it is inaccurate, out-of-date, incomplete, irrelevant, or misleading.
DISCLOSURE OF PERSONAL INFORMATION TO THIRD PARTIES
We may share your personal information with third parties for the purposes described in this policy. These third parties include:
- Service providers (such as hosting providers and IT support)
- Analytics and data analysis providers
- AI tool providers
- Advertising platforms and marketing partners
- Social media platforms
- Payment processors and financial institutions
- Legal and regulatory authorities (when required by law)
We require third parties to protect your personal information and only use it for the purposes we specify.
DATA RETENTION
We retain personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. When personal information is no longer needed, we take reasonable steps to destroy or de-identify it.
CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on our website (https://bonfire.com.au) and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
YOUR RIGHTS UNDER AUSTRALIAN PRIVACY LAW
Right to Sue for Serious Invasions of Privacy
Since 10 June 2025, Australian law provides individuals with a statutory right to take legal action for serious invasions of privacy under the Privacy Act 1988 (Cth). You may be able to commence legal proceedings if someone:
- Intrudes upon your personal seclusion (for example, through unauthorised surveillance or intrusive behaviour), or
- Misuses your personal information in a way that seriously invades your privacy
To establish a claim, you would need to demonstrate that the invasion of privacy was serious. The court can award damages (including compensation for emotional distress) and grant injunctions to prevent further invasions of privacy.
This statutory right operates independently from your ability to make a complaint to us or to the Office of the Australian Information Commissioner (OAIC).
Please note: If you believe Bonfire Digital Pty Ltd has seriously invaded your privacy, we encourage you to first contact us using the process described below, so we can attempt to resolve your concerns. You may also wish to seek independent legal advice about your rights.
COMPLAINTS AND CONTACT
How to Contact Us
If you have any questions about this Privacy Policy, wish to access or correct your personal information, or wish to make a complaint about how we have handled your personal information, please contact our Privacy Officer:
Privacy Officer: George Gavalas
Email: [email protected]
Phone: 1800 750 204
Address: Level 1, 1 Rokeby Road, Subiaco, WA 6008
Complaint Process
If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us. We will:
- Acknowledge your complaint within 7 days
- Investigate the matter thoroughly
- Respond to your complaint within 30 days (or notify you if we need more time)
- Provide you with our decision and reasons
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
Office of the Australian Information Commissioner
GPO Box 5218, Sydney NSW 2001
Phone: 1300 363 992
Email: [email protected]
Website: www.oaic.gov.au
Previous version