1. Who we are and when this policy applies
Ekreon Group operates a public website and a secure portal for asset and facility management enquiries, maintenance requests and associated communications. This policy describes our practices and our approach to the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs), to the extent they apply to our business. It also explains how to contact us about your information.
2. The kinds of information we collect
Depending on your interaction with us, information may include names, business and personal contact details, job role, organisation, department, site or asset references, messages, support enquiries, maintenance records, photos, attachments, ticket comments, service history and account preferences. Photos and documents may incidentally show people, locations, access details or other personal information.
Security and technical records can include IP addresses, sign-in times, attempted account identifiers, successful or failed login outcomes, browser and device information, user-agent data, and approximate location derived from host-provided information. Login and MFA cookies can be used to authenticate a session or recognise a trusted device. We do not display password hashes or authenticator secrets to other users.
3. How and from whom information is collected
We collect information when you contact us, register, submit or respond to a request, upload material, or communicate with us by email and through the portal. We may receive relevant information from your employer, client organisation, property manager, authorised representatives, service providers or contractors where they engage with our work. Technical logs are collected automatically during system use.
4. Purposes and consequences of collection
We use information to identify and authenticate users; respond to enquiries; coordinate asset/facility work; manage maintenance tickets, communications, service history and access permissions; support security, fraud prevention and auditing; meet applicable legal requirements; and improve system reliability. Fields marked as required are needed to process the relevant request or provide an account. If they are not supplied, we may be unable to create an account, contact you or action the request.
5. Who can see information and how it may be disclosed
Authorised Ekreon personnel and users within the relevant organisational access arrangements may see information as required for their work. We may share necessary information with service providers, hosting and communications suppliers, your organisation or its authorised contractors, and regulators or other parties where required or authorised by law. We do not sell personal information. Access within the portal is controlled by account roles and ticket permissions, but you should avoid including unrelated sensitive details in submissions.
6. Overseas handling
Some hosting, communications or technical providers may process or store data outside Australia. The specific providers, locations and overseas countries must be confirmed against our current suppliers before this policy is finalised; where practicable, we will identify those countries here. We will take reasonable steps required by applicable law concerning overseas disclosures.
7. Security and account activity
We use measures such as HTTPS, role-based access, password hashing, MFA, secure session identifiers, private file storage and security logging. No system is completely risk-free. Notify us promptly of suspected account misuse, unintended disclosures or misdirected uploads. You should use a unique password, keep recovery codes private and sign out of shared devices.
8. Cookies and trusted devices
The portal uses essential session cookies for signing in, CSRF protections and selected account preferences. If you choose to remember your MFA device, a secure device token may be stored in a browser cookie for up to 14 days, subject to revocation and security policies. This does not replace your password or extend normal session-expiry limits. We do not describe these necessary cookies as consent to unrelated advertising tracking.
9. Retention and deletion
Information is held for the time reasonably required to provide support, manage records, meet legal requirements and investigate security incidents. Individual categories may have different retention periods; login-attempt retention is configurable by administrators. Records may be deleted, anonymised or archived when no longer needed, subject to legal holds and legitimate recordkeeping duties. We will not promise a fixed deletion period where this has not yet been approved.
10. Access, correction and requests
You can contact privacy.officer@ekreongroup.com to request access to, or correction of, personal information we hold. We may ask you to verify your identity before releasing information. Access or correction may be subject to lawful exceptions, which we will explain where appropriate.
11. Privacy complaints and incidents
Send a written concern to privacy.officer@ekreongroup.com or Melbourne, Victoria, Australia, describing the issue and how to contact you. We will acknowledge, investigate and explain the outcome within a reasonable period. Where the APPs apply, you may be able to complain to the Office of the Australian Information Commissioner (OAIC). Eligible data breaches will be assessed and notified as required by applicable law.
12. Third-party content and children
If you upload photos of identifiable people or records about other individuals, ensure you have an appropriate legal basis to share them for the stated facility-management purpose. The portal is intended for authorised business users, not children. Please tell us if material appears to have been supplied without appropriate authority.
13. Policy updates and contact
We may update this policy when our activities or service providers change. The effective date above identifies the published version. For privacy questions, contact privacy.officer@ekreongroup.com.