Privacy Policy

1. Who we are & scope

Media Fortress ("we", "us") is a Melbourne-based digital agency providing web hosting, domain registration, email and Microsoft 365, SSL certificates, website design and digital marketing services. This policy describes how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It applies to our websites, our client portal, and the services we provide.

2. What we collect

• Identity and contact details — name, business name, ABN/ACN, email address, phone number and postal address.
• Account and billing information — services ordered, invoices, payment history, and payment method details. We do not store full credit card numbers on our systems; card payments are processed by eWAY, and PayPal payments by PayPal (see Section 5).
• Domain registrant information — details required by domain registries, including eligibility information for .au domains (such as ABN details).
• Service content — content you host with us or supply to us for projects, including website files, databases and email hosted on our servers. We access this content only as needed to provide, support and secure the services.
• Support and communications — emails, support tickets and records of our correspondence with you.
• Technical data — IP addresses, browser and device information, server logs, and usage data collected when you visit our websites or use our services.

3. How we collect it

We collect information directly from you when you place an order, create an account, contact us, or supply project content; automatically through our websites and servers (logs and cookies — see Section 8); and from third parties where necessary to provide a service, such as confirmation of payment from eWAY or PayPal, or domain availability and registrant data from domain registries.

4. Why we use it

• to provide, administer and support the services you have ordered;
• to process payments, issue invoices and manage renewals;
• to register and manage domain names on your behalf;
• to secure our network, prevent fraud and abuse, and investigate breaches of our Terms of Service;
• to communicate with you about your services, including renewal reminders and service notices;
• to send marketing communications where permitted (see Section 9);
• to comply with our legal obligations and enforce our agreements.

5. Payments: eWAY & PayPal

Card payments are processed by eWAY, a PCI-DSS compliant Australian payment gateway. When you pay by card, your card details are transmitted to and stored by eWAY (for example, for recurring billing tokens); we retain only a payment reference, the card type and the last digits needed to identify the payment method in your portal.

PayPal payments are processed on PayPal's platform under PayPal's own privacy policy; we receive confirmation of payment and the account identifier needed to reconcile your invoice.

We recommend reviewing the privacy policies of eWAY and PayPal for details of how they handle your information.

6. Who else we share data with

We do not sell personal information. We disclose it only as needed to provide the services or as required by law, to:

• Payment processors — eWAY and PayPal, as described above.
• Domain registries and registrars — registrant details are provided to the relevant registry (including auDA-accredited registrars and registry operators for .au domains) to register and maintain your domains. Some registrant information may appear in public WHOIS/RDAP records in accordance with registry policy.
• Google — we use Google services including Google Analytics and Google Ads on our website (Section 8), and where we manage Google Ads, Analytics or Business Profile accounts on your behalf as part of a marketing service, relevant information is processed within those Google accounts.
• Microsoft — where you purchase Microsoft 365, the account details needed to provision your licences are provided to Microsoft, and your mailbox content is stored on Microsoft's platform under Microsoft's terms.
• Infrastructure and software suppliers — data-centre and network providers hosting our Australian servers, SSL certificate authorities (for certificate issuance and validation), and the billing and support software we use to run our client portal.
• Professional advisers and debt-recovery agencies — where reasonably necessary, for example in relation to significantly overdue accounts.
• Law enforcement and regulators — where required or authorised by law, or where reasonably necessary in connection with suspected unlawful activity.

7. Overseas disclosure

Our hosting servers are located in Australia. However, some of the service providers above operate globally and may store or process information overseas — including PayPal (United States and Singapore), Google and Microsoft (United States and other locations), and certain certificate authorities and registries. Where information is disclosed overseas, we take reasonable steps to ensure the recipient handles it in a manner consistent with the APPs.

8. Cookies, analytics & advertising

Our websites use cookies and similar technologies for essential functions (such as keeping you logged in to the client portal), and for analytics and advertising:

• Google Analytics helps us understand how visitors use our site, using cookies and IP-based data. You can opt out via the Google Analytics opt-out browser add-on.
• Google Ads conversion tracking and remarketing may be used to measure our advertising and show relevant ads to previous visitors. You can manage ad personalisation at Google Ads Settings.

You can also control or delete cookies through your browser settings; disabling essential cookies may affect the operation of the client portal.

9. Marketing communications

We may send you information about our services where you have an existing customer relationship with us or have otherwise consented. Every marketing email includes an unsubscribe link, and you can opt out at any time by using that link or contacting us — service and billing notices (such as renewal reminders) will still be sent, as they are necessary to administer your account.

10. Security & retention

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access — including access controls, encrypted connections (SSL/TLS), hardened server configurations and staff access limited to what is needed to do the job. No internet service can be guaranteed completely secure, and you are responsible for keeping your portal password confidential.

We retain personal information for as long as needed to provide your services, meet legal obligations (including tax and record-keeping requirements) and resolve disputes. Content associated with cancelled services is not guaranteed to be retrievable more than 30 days after cancellation, as described in our Terms of Service.

11. Access, correction & complaints

You may request access to, or correction of, the personal information we hold about you by emailing info@mediafortress.com.au. We will respond within a reasonable time and will not charge for making a request. Much of your account information can also be viewed and updated directly in the client portal.

If you believe we have breached the APPs, please contact us first and we will investigate and respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

12. Changes & contact

We may update this policy from time to time; the current version will always be published on this page with its last-updated date. Questions about this policy or our handling of your information can be directed to:

Media Fortress · 19/20 Enterprise Drive, Bundoora VIC 3083 · info@mediafortress.com.au