Privacy and confidentiality policy

1. Introduction & Commitment

Sentinel Compliance Specialists Pty. Ltd. ("Sentinel", "we", "us" or "our") is committed to protecting the privacy and confidentiality of our clients, website visitors, and all individuals whose personal information we handle in the course of providing product compliance consulting services.

This Privacy Policy explains how we collect, use, hold, disclose and protect personal information, and how we safeguard the intellectual property and confidential business information entrusted to us by our clients.

We are based in Australia and work with clients in Australia, New Zealand, Europe and the United States. This policy is arranged in two parts:

• Sections 1 to 11 apply to everyone, wherever you are located.
• Section 12 is a short table of what differs between Australia and New Zealand, Europe, and the United States.

Even where the small business exemption under the Australian Privacy Act 1988 may apply, Sentinel voluntarily adopts the Australian Privacy Principles as its baseline standard for all personal information it handles, as a matter of professional practice and client trust. Where the law of your region gives you greater protection, that greater protection applies.

2. What Personal Information We Collect

We collect only the personal information reasonably necessary to provide our services. This may include:

• Name, job title and contact details (email address, phone number, postal address)
• Company name and company registration or tax numbers (for example ABN/ACN, VAT number or EIN)
• Product information, technical specifications and test documentation provided for compliance purposes
• Correspondence and communications between you and Sentinel
• Financial information required to process invoices and payments
• Information submitted through our website contact form or by email

We do not collect sensitive personal information beyond what is necessary to deliver product compliance services. Should any information of a sensitive nature become relevant to your engagement, we will seek your explicit consent before collecting it.

3. How We Collect Personal Information

We collect personal information directly from you wherever practicable: through our website contact form, by email, during telephone or video consultations, or in writing.

In some circumstances we may receive information from third parties, such as a regulatory authority, testing laboratory, certification body or an agent acting on your behalf. Where this occurs, we will take reasonable steps to notify you as soon as practicable, unless doing so would be impracticable or unreasonable.

4. Why We Collect and Use Personal Information

We collect and use personal information for the following purposes:

• Providing product compliance consultation and certification services
• Communicating with you about your enquiry, project or certification
• Coordinating with accredited testing laboratories, certification bodies and regulators on your behalf
• Preparing and submitting compliance documentation, certificate applications, declarations and registrations in the markets you sell in (for example, EESS registration in Australia)
• Invoicing and managing our business relationship with you
• Responding to your enquiries received through our website or by email
• Complying with our legal and regulatory obligations
• Improving our services and internal processes

We will not use your personal information for any purpose other than those described above without your prior consent, unless otherwise required or permitted by law.

Where the GDPR applies, Sentinel is the data controller and relies on these legal bases: performing our contract with you, our legitimate interests in running our business, our legal obligations, and your consent where we have asked for it.

5. Protection of Client Intellectual Property & Confidential Information

Specifically, we commit to the following in relation to client intellectual property (IP) and confidential information:

• Non-disclosure: We will not disclose, publish, copy or share your confidential information or IP with any third party other than those directly involved in processing your compliance project (for example accredited testing laboratories, certification bodies and the relevant regulators), and only to the extent strictly necessary for that purpose.
• Purpose limitation: Client confidential information and IP will be used solely for the purpose of providing the compliance services you have engaged us for, and for no other purpose whatsoever.
• Secure handling: We maintain appropriate physical, electronic and procedural safeguards to protect client documentation from unauthorised access, loss, misuse or disclosure.
• Third-party obligations: Any third party to whom we disclose client information (such as a testing laboratory) is required to maintain equivalent standards of confidentiality and is only provided with the minimum information necessary to perform their specific task.
• No commercial exploitation: We will not use, adapt, reproduce, commercialise or otherwise exploit any client IP, technical information or data for our own benefit or for the benefit of any other party.
• Retention, return and deletion: We keep project files after an engagement ends so that we can support certificate renewals and modifications, answer questions from regulators or certifiers, and assist you with future projects without asking you to supply the same material again. Everything we keep remains protected by the commitments in this section for as long as we hold it. You may ask us in writing at any time to return or securely delete your confidential information, and we will do so unless a law or regulatory requirement obliges us to keep it.

Non-disclosure agreements. If required, we are happy to sign a specific Non-Disclosure Agreement (NDA) for your project.

These obligations survive the termination of any engagement between you and Sentinel and apply indefinitely to information that is or remains confidential.

6. Disclosure of Personal Information

We may disclose your personal information to the following parties, but only to the extent necessary for the purposes described in Section 4:

• Accredited testing laboratories and certification bodies, for example recognised certifiers in Australia, Notified Bodies in Europe, and Nationally Recognized Testing Laboratories (NRTLs) and Telecommunication Certification Bodies (TCBs) in the United States
• Regulators and registration bodies in the markets your product is sold in
• Industry bodies whose approval your product needs, such as the Bluetooth SIG
• Our professional advisors (legal, accounting) under strict confidentiality obligations
• IT service providers who assist us in operating our systems, under confidentiality obligations

We will not sell, rent or trade your personal information to any third party for marketing or commercial purposes.

Recipients in other countries. Because we work across several markets, some of the laboratories, certification bodies and regulators involved in your project may be located outside your own country. We send them only what the project requires, and we take reasonable steps to ensure that they protect your information to a standard comparable to this policy. For personal data transferred out of the European Economic Area, we rely on safeguards recognised by the GDPR, such as standard contractual clauses, or on the transfer being necessary to perform our contract with you.

7. Storage, Security & Data Retention

Personal information and client data are stored and processed in Australia. We take reasonable steps to protect everything we hold from misuse, interference, loss, and unauthorised access, modification or disclosure. Our security measures include:

• Password-protected and encrypted digital storage systems
• Restricted access to client files on a need-to-know basis
• Secure email communications for sensitive documentation
• Regular review of our data security practices

We retain personal information and project records for as long as necessary to fulfil the purpose for which they were collected, to support your certificates and registrations while they remain current, to comply with applicable laws and regulatory requirements, and to resolve any disputes. In general, project and certification records are retained for a minimum of seven (7) years.

When personal information is no longer required, we take reasonable steps to destroy or de-identify it securely.

8. Your Rights: Access & Correction

Wherever you are located, you may:

• Request access to the personal information we hold about you
• Request correction of any personal information that is inaccurate, out of date, incomplete, irrelevant or misleading
• Ask us to delete personal information we no longer need to keep
• Make a complaint about how we have handled your personal information

Some regions give you further rights. These are listed in Section 12, together with the time within which we must respond.

To exercise any of these rights, please contact us in writing using the details in Section 14. We will not charge a fee for making a request, though where the law allows we may charge a reasonable fee to cover the cost of providing access where a request is extensive.

If we are unable to act on a request (for example for legal reasons), we will notify you in writing and explain the reasons, unless doing so would itself be unlawful.

9. Website & Online Information

When you submit an enquiry via our contact form, we collect the information you provide (name, email address, company and enquiry details) for the purpose of responding to your request. It is transmitted to us by email and handled in accordance with this Privacy Policy. We do not share form submissions with third-party marketing platforms.

Cookies. Our website does not set cookies and does not use analytics, advertising or tracking tools. For that reason it does not show a cookie consent banner. Should this change, we will update this policy and, where required, ask for your consent first.

Technical data. Like most websites, our hosting provider keeps standard server logs (such as IP address, browser type and pages requested) for security and troubleshooting. Our pages also load their fonts from Google Fonts, so your browser connects to Google's servers and Google receives your IP address when a page loads.

10. Privacy Breach Notification

In the event of a data breach that is likely to result in serious harm or a risk to any individual, we will take immediate steps to contain the breach and assess the likely consequences. Where required, we will notify the affected individuals and the privacy regulator for the region concerned as soon as practicable, and within any time limit the law of that region sets.

11. Complaints

If you believe we have breached your privacy or mishandled your personal information, we encourage you to contact us first, using the details in Section 14, so we can attempt to resolve the matter.

We will acknowledge your complaint within 5 business days and aim to provide a substantive response within 30 days. If you are not satisfied with our response, you may take your complaint to the authority for your region listed in Section 12.

12. Requirements Specific to Each Region

The table below shows what differs depending on where you are located. Everything else in this policy applies to all regions.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or regulatory guidance. The current version will always be available on our website. We encourage you to review this policy periodically. Material changes will be notified to active clients by email where practicable.

Continued use of our services after any update to this policy constitutes acceptance of the updated terms.

14. Contact Us

For all privacy-related enquiries, access requests, complaints or questions about this policy, please contact Sentinel Compliance Specialists:

This Privacy Policy was prepared with reference to the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Privacy Act 2020 (NZ), the GDPR and United States federal and state privacy law. It does not constitute legal advice.