Last updated: 20 October 2026
1. Who we are
This policy covers Tim Stevenson Consulting Pty Ltd (ABN 31 125 045 258), trading as Aussie Web & IT Solutions, based in Mudgeeraba, Queensland. In this policy "we", "us" and "our" mean that company.
We provide web development and hosting, Microsoft 365 and Google Workspace administration, endpoint security and backup, NBN and telco services, domain registration, remote IT support and DMARC email-security monitoring to businesses across Australia.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Personal information means information about an identifiable individual. Most of the information we hold is about businesses, but it often includes details of the people who work there.
2. What we collect
The information we hold depends on the services you use. It may include:
- Contact and identity details — your name, business name, role, email address, phone number and postal or service address.
- Billing details — ABN, invoicing contact, purchase order numbers and payment records. We are paid by bank transfer and do not store card numbers.
- Service and account details — the information needed to set up and administer what you buy from us: domain names, user names and email addresses in your Microsoft 365 or Google Workspace tenant, licence assignments, device names, NBN service identifiers and installation addresses, and website administrator accounts.
- Support records — what you tell us when you ask for help, including emails, notes from calls and remote-support sessions, screenshots you send and the steps taken to fix the problem.
- Email-security data — for DMARC monitoring customers, the aggregate and forensic reports that mail providers send about your domain. Aggregate reports contain sending server addresses and pass/fail counts, not message content.
- Technical data — server logs from the websites and applications we host, which record IP addresses, browser type, pages requested and timestamps.
We do not ask for sensitive information such as health, religious or political details, and we ask you not to send it to us. If a support request unavoidably involves such information (for example, a document in a mailbox we are recovering), we handle it only as far as the job requires.
3. How we collect it
- Directly from you — when you phone, email, use the contact form on this website, sign a proposal or ask for support.
- From the systems we administer for you — with your authorisation we read account and licence information from your Microsoft 365 or Google Workspace tenant, your domains at the registrar, your NBN service at the carrier and your hosted website, so that we can manage and bill them correctly.
- From our suppliers — the distributors and carriers we buy through (see section 5) send us subscription and billing records that name your business and, sometimes, your users.
- Automatically — web servers and security tools log activity as described in section 2.
4. How we use it
We use personal information to:
- provide, administer and support the services you have asked for;
- set up and manage licences, domains, hosting, email security and telco services on your behalf;
- invoice you, record payments and send reminders about overdue invoices;
- monitor the security and health of the systems we manage and alert you to problems;
- answer your questions and keep a record of the help we have given;
- meet our legal obligations, including keeping tax and business records; and
- tell you about changes to the services you already use, such as price or licensing changes from a vendor.
We do not sell personal information, rent out contact lists or run marketing campaigns. We only contact you about the services you use or have asked about.
5. Who we share it with
We share personal information only where it is needed to deliver a service, where you have asked us to, or where the law requires it. The main recipients are:
- Vendors and distributors whose products we resell, such as Microsoft, Google, Acronis and SentinelOne, and the distributors we buy them through (currently Pax8). Setting up a licence means telling them which business and which users it is for.
- Infrastructure suppliers — domain registrars and wholesalers, the NBN and telco carrier behind the broadband services we resell, and the data centres that house our servers.
- Our professional advisers, such as our accountant, who may see invoicing records.
- Law enforcement, regulators or courts where we are required to by law.
Our own servers are in Sydney and Melbourne, Australia. Some vendors, in particular Microsoft and Google, run global cloud platforms and may store or process information outside Australia under their own privacy terms. Microsoft 365 tenants we create for Australian customers are set up with Australia as the data location where the product allows it.
6. Access to your systems
Much of our work involves administrative access to systems you own:
- Microsoft 365 and Google Workspace — we administer your tenant through delegated administrative relationships (for Microsoft, GDAP) that you approve and can revoke at any time. We use that access for the tasks you engage us for: creating and managing users, assigning licences, mailbox and security configuration, and reporting.
- Remote support — we connect to your computer only when you invite us to, using tools such as Microsoft Quick Assist or our own remote-support client. You can see what we do and end the session at any time.
- Hosted websites and applications — we hold administrator access to sites and applications we build or host so we can maintain, back up and secure them.
We use this access only for the agreed work, protect it with multi-factor authentication, and do not read your email or files beyond what a specific support task requires.
7. Connected accounts
Some applications we build or operate let you connect a third-party account, such as a Google or Microsoft account, so that the application can act on your behalf (for example, to import photos you choose from Google Photos, or to read a calendar). When you do this:
- the application asks only for the permissions it needs, and the consent screen lists them;
- we store the resulting access credentials encrypted, and use them only to provide the feature you connected the account for;
- we do not use information obtained through a connected account for advertising, and we do not sell it or pass it to data brokers;
- you can disconnect the account from within the application, or revoke our access from your Google or Microsoft account settings, at any time.
Where an application uses Google APIs, our use of information received from Google complies with the Google API Services User Data Policy, including its Limited Use requirements.
8. This website
This website (aussieit.net.au) is a plain static site. It does not use analytics or advertising trackers and does not set cookies of its own.
- Server logs — like any web server, ours records the IP address, browser type and pages requested for each visit. Logs are used for security and troubleshooting and are rotated automatically.
- Fonts — the site loads its typefaces from Google Fonts. Your browser's request for those files is seen by Google and is subject to Google's privacy policy.
- Contact form — anything you enter in the contact form is used only to reply to you.
- Links — we link to other websites, including client sites on our projects page. Their privacy practices are their own.
9. Storage, security and retention
Customer, billing and support records are held in our own management systems on servers in Australia and in our Microsoft 365 tenant. We protect them with encrypted connections, multi-factor authentication on every administrative account, encrypted storage for credentials and tokens, firewalls, endpoint protection and regular backups. Access is limited to the people who need it to do the work, which for a small business means very few.
We keep information for as long as we provide services to you and afterwards for as long as the law or a legitimate business need requires. Financial records are kept for at least five years, as tax law requires. Server logs are kept for a short period and then discarded. When you stop being a customer, delegated access to your systems ends and we delete or de-identify records we no longer need.
If we become aware of a data breach that is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
10. Your rights
You can ask us at any time to:
- tell you what personal information we hold about you;
- correct information that is inaccurate or out of date;
- delete information we no longer need to keep; or
- stop sending you a particular kind of communication.
Contact us using the details in section 12. We will respond within 30 days and will not charge for a reasonable request. If we cannot do what you ask, we will tell you why.
If you are unhappy with how we have handled your personal information, please tell us first so we can put it right. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
11. Changes to this policy
We update this policy when our services or the law change. The date at the top shows the current version. Significant changes will be mentioned to existing customers directly.