Capital Shield Australia Pty Ltd

Version 3.2 Effective Date: 21 September 2026 Last Reviewed: 21 September 2026 Next Review Due: 30 November 2026

1. OVERVIEW

Capital Shield Australia Pty Ltd (we, us, our) is committed to protecting your privacy and handles personal information in accordance with the laws that apply to our services.

This policy explains how we collect, use, store and disclose personal information. It describes our approach to the Australian Privacy Principles under the Privacy Act 1988 (Cth), the European Union General Data Protection Regulation (GDPR), and other data protection laws that apply to the services we provide.

We provide crisis simulation services through our proprietary Foresight platform and related consulting services. This policy covers personal information handled through our website, platform, client projects and professional interactions.

Information about the Australian Privacy Principles is available from the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. Information about the GDPR is available from the European Data Protection Board at www.edpb.europa.eu.

2. OUR ROLE

Our role depends on why and how personal information is used.

We act as controller when we use account details, authentication and session data, audit logs, security records and correspondence for our own platform administration, security and business purposes.

We act as processor for exercise content handled on your organisation’s instructions. This includes messages, emails, decisions, uploaded files, call audio and transcripts, and performance assessments. Your organisation decides who participates, how the exercise results are used, and how long its exercise records are kept. We handle the content under our agreement with your organisation. Your organisation’s privacy notice should explain these decisions and the basis for processing. Please direct requests about this content to your organisation. If you contact us, we will help identify the appropriate contact and assist your organisation with the request.

You may contact us about any personal information we hold, and we will assess the request and coordinate with your organisation where appropriate. Contact our Privacy Officer at privacy@capitalshield.com.au.

3. WHAT PERSONAL INFORMATION WE COLLECT

Personal Information is information or an opinion that identifies an individual. Examples of personal information we collect include:

Account Information: Name, email address, and authentication credentials. Accounts are created by your organisation’s administrator. There is no self-registration. We also collect professional titles, roles, and organisational affiliations provided by your administrator.
Session and Security Data: IP addresses, user agent strings, session tokens, login timestamps, and device information. This data is collected for security monitoring, access control, and fraud prevention.
Audit Logs: Records of actions taken within the platform, including actor identity, IP address, timestamps, and the nature of the action. These logs are used for security, compliance, accountability, and incident investigation.
Uploaded Content: Files and media uploaded as part of crisis simulation scenarios, including documents, images, and other materials required for training exercises. Uploaded content is stored in cloud storage and encrypted at rest. Section 10 describes our security measures.
Exercise Content and Assessments: Messages, emails, written decisions and other material you create during a simulation, your assigned character role, and assessments, scores or other inferences about your performance. These form part of the exercise record.
Voice Recordings and Call Transcripts: Some exercises include voice calls. Your speech is streamed to our voice service provider, which records the call audio and produces a written transcript. Audio and transcripts are used to deliver the exercise and prepare after-action reports for your organisation. The provider also retains copies on its systems and may process them outside your platform’s hosting country. Sections 7 and 8 explain overseas processing and retention.
Communication Records: When you contact us, we may collect your name, contact details, and the content of your communications to respond to enquiries and provide support.

4. HOW WE COLLECT INFORMATION

We collect personal information in the following ways:

Directly from you when you use the platform, take part in exercises, upload material or contact us;
Automatically when you use our website or platform, including session information, IP addresses, security logs and, where enabled, diagnostic and session-recording data; and
From your organisation’s administrators when they create accounts and assign roles.

5. WHY WE COLLECT AND USE YOUR INFORMATION

We use personal information for the following purposes:

Service Delivery: To provide access to the Foresight crisis simulation platform, manage user accounts, deliver training scenarios, and fulfil our contractual obligations to your organisation. We carry out this processing to perform our agreement with your organisation and, where we act as controller for account administration, on the basis of our legitimate interests in operating and administering the platform.
Security and Fraud Prevention: To protect the platform and users from unauthorised access, detect and prevent security incidents, maintain platform integrity, and comply with cybersecurity standards. We log session data, IP addresses, and user actions based on our legitimate interest in maintaining a secure platform.
Platform Improvement: To analyse usage patterns, improve platform functionality, fix technical issues, and enhance user experience. We use aggregated and de-identified data where possible, and rely on legitimate interests or consent where personal data is involved.
Legal Obligations and Claims: To comply with legal obligations, respond to lawful requests from authorities, retain records as required by law, and protect our legal rights. This processing is necessary to meet legal obligations and protect legitimate interests.
AI-Assisted Simulation and Assessment: To operate AI characters and prepare after-action assessments on your organisation’s instructions. Our AI providers process exercise content, call audio and transcripts for these purposes. A human facilitator reviews the assessments before they are provided to your organisation. We do not use these assessments to make decisions about you based solely on automated processing. Your organisation decides how assessment results are used.
Analytics and Error Monitoring: Error monitoring and session recording, used to detect faults and maintain service reliability. Session recordings capture the interface as it appeared on screen, including page text. Recordings are configured so that text you type into forms is masked, images and video are blocked, and the parts of the platform that display or capture content you author during an exercise are masked as well. Recordings are taken from a limited sample of sessions and from sessions in which an error occurs.

6. WHO WE SHARE YOUR INFORMATION WITH

We share personal information with service providers who are contractually obliged to protect it and to use it only for the purposes we specify. Providers acting as processors must protect the information and use it only under our instructions. The providers and processing countries that apply to your organisation depend on its hosting arrangement.

Service-provider categories include:

Cloud infrastructure providers: for secure hosting, database services, and file storage. Hosting and storage take place in your organisation’s agreed region; the hosting platform’s administrative systems, logs and metrics are operated from the United States.
Communication services (European Union, with transit through the United States): for sending authentication emails, password resets, and platform notifications.
Monitoring and analytics services (European Union): for diagnostics, performance monitoring and optional session recording, subject to section 11. Mapping providers in the European Union and United States receive browser requests.
AI service providers: for generating scenario content, operating AI characters within exercises, and preparing after-action assessments. Content you author during an exercise, and the audio and transcript of any spoken call you take part in, are sent to these providers for those purposes.

We may also disclose personal information where required by law, to protect our rights, or in connection with a business transaction such as a merger or acquisition. We engage each third-party processor under contractual terms requiring it to protect your information and to comply with applicable privacy laws.

Our provider register is available at www.capitalshield.com.au/subprocessors. It identifies each provider, its service, the information it handles, its processing countries, the hosting arrangements it supports and the basis for relevant overseas transfers. Versions are dated and changes are recorded. We notify client organisations in advance of adding a new provider. The notice period and the applicable authorisation and objection process are set out in our client agreements.

7. WHERE WE STORE YOUR INFORMATION AND OVERSEAS DISCLOSURE

Platform records, including accounts, exercise content, uploaded files and audit logs, are stored in the region agreed with your organisation, subject to the processing described below. Your administrator can confirm the arrangement that applies to you.

Storage location does not describe every place where information is handled. Providers may process information or provide administrative access from other countries. The provider register identifies the relevant countries and transfer arrangements. Processing outside the main hosting country includes:

AI service providers: content you author during an exercise, and the audio and transcript of any spoken call, are processed to operate AI characters and prepare after-action assessments. These providers retain a copy for a limited period, as described in section 8.
Email delivery (European Union, with transit through the United States): our email provider stores message data in Germany and passes messages to a delivery service that routes them through the United States in transit. Message content is not stored in the United States.
Error monitoring and mapping (European Union and United States): diagnostic data is handled by our error monitoring provider in the European Union. Map and imagery tiles are requested by your browser directly from mapping providers in the European Union and the United States, which receive your IP address and the part of the map you are viewing.
Hosting (Australia and the European Union, with United States administration): our compute runs in the region named above, but the hosting platform’s administrative systems, logs, and metrics are operated from the United States.

For disclosures covered by Australian Privacy Principle 8, we take reasonable steps to ensure overseas recipients handle information consistently with the Australian Privacy Principles, unless an applicable exception permits another approach. Where GDPR transfer rules apply, we use an available transfer mechanism, such as an adequacy decision or Standard Contractual Clauses. Transfers relying on the EU-US Data Privacy Framework are limited to recipients with a current certification covering the relevant data. Where required, we assess the receiving country’s laws and practices and apply additional safeguards. You may request information about the applicable arrangements, including a copy of relevant safeguards, from our Privacy Officer.

8. HOW LONG WE KEEP YOUR INFORMATION

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, and resolve disputes. Specific retention periods include:

Account data: Retained while the account is active and deleted within 30 days of closure or an approved deletion request, unless retention is required by law.
Session data: Maintained during your login session; expired sessions are deleted automatically within 24 hours.
Audit logs: Retained for 12 months, or 24 months where the entry records a security-critical event, for security, compliance, accountability and incident investigation, then deleted automatically.
Uploaded files and exercise content: Retained for the period set by your organisation under our agreement. Your organisation can provide its retention period or criteria. At the end of the service, records are returned or deleted as agreed, subject to applicable legal requirements. Files no longer associated with a scenario are deleted automatically.
Communication records: Retained while needed to resolve an enquiry and related follow-up, or to meet a legal requirement or establish, exercise or defend a legal claim. We review these records and delete them when they are no longer needed.

For information we hold as controller, we complete approved deletion requests without undue delay and within the period required by the law that applies. We may retain information where applicable law permits or requires it, including for legal claims. We explain any exception when responding. Audit logs retained for security purposes are anonymised where practicable; records that remain identifiable continue to be treated as personal information and follow the retention periods above.

Data held by our AI service providers: Where exercise content, voice, or transcripts are sent to an AI service provider, that provider retains a copy on its own infrastructure for a limited period. Our text and image providers retain inputs for a limited period fixed by their own terms. The current periods are identified in our provider register. Our voice provider retains call audio and transcripts, which we rely on to retrieve the transcript after a call ends. We have opted out of the use of your content to train these providers’ models.

9. YOUR RIGHTS AND ACCESS

Your rights depend on the law that applies and our role in handling the information. Australian privacy law provides access and correction rights, subject to applicable exceptions. Where the GDPR applies, additional rights described below may be available. We also provide account-management and export features where supported. Contact our Privacy Officer or use your profile settings to make a request.

Access: You can request a copy of the personal data we hold as controller — your account details, authentication and session data, audit and security records, and any correspondence with us. For exercise content, which we handle on your organisation’s instructions, you may contact your organisation or us. We will assess the request, coordinate with your organisation and respond as the law that applies requires. We will provide this information in a structured, commonly used format within one month. Access requests can be made via your profile settings or by contacting privacy@capitalshield.com.au.
Correction: You may ask us to correct inaccurate or incomplete information. You can update your name and password through your profile. For other changes, including concerns about an assessment, contact your organisation’s administrator or our Privacy Officer. We will assess our responsibilities and coordinate with your organisation where needed.
Deletion: You can request deletion of your account and the personal data we hold as controller. Exercise content is deleted on your organisation’s instructions under our agreement with it, so requests concerning that content should be made to your organisation. This can be done through your profile settings or by written request to our Privacy Officer. We will action your request without undue delay and within the period required by the law that applies, unless we have a legal obligation or permission to retain the information. We will explain any exception when we respond.
Data Portability: You can download a machine-readable export of the personal data we hold as controller via your profile settings. This allows you to transfer that data to another service provider if you choose. Exports of exercise content are provided to your organisation rather than to individual participants.
Restriction of Processing: In certain circumstances, you can request that we temporarily restrict how we process your personal data, such as when you contest the accuracy of the data or object to processing.
Objection: You can object to processing we carry out on the basis of our legitimate interests, such as audit logging and error monitoring. We do not use your personal information for direct marketing. Where we are the controller, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests. Where you wish to object to how exercise content is processed — including the assessment of your performance — your organisation is the controller and the objection should be made to it.
Withdrawing Consent: Where we process your data based on consent (such as for analytics or error monitoring), you can withdraw that consent at any time in your privacy settings in the application. Withdrawal does not affect the lawfulness of processing before withdrawal.

We normally respond to rights requests within one month. Where the GDPR permits an extension because of the complexity or number of requests, we will explain the reason within the first month and may take up to two additional months. We may request proportionate identity information where needed. Requests are generally free; any fee or refusal must be permitted by the law that applies. We will explain a refusal, any applicable charge, and your complaint options in writing.

10. DATA SECURITY

We implement technical and organisational security measures informed by the ISO 27001 information security framework and the Australian Signals Directorate Essential Eight maturity model.

Our security measures are reviewed and updated from time to time, and currently include:

Access controls, including strong user authentication and role-based permissions
Encryption of data both in transit and at rest
Regular security testing, monitoring, and incident response procedures
Patch management and vulnerability remediation processes
Comprehensive audit logging and activity monitoring
Regular backups and disaster recovery procedures

11. COOKIES

We use essential cookies for authentication session management (required for the service to function). Error monitoring and session recording are optional. Where the law that applies to you requires your consent before we enable them, we ask for it and do not enable them until you agree. Where consent is not required, they are enabled by default on the basis of our legitimate interest in service reliability, and you can turn them off at any time. In either case you can change your choice at any time in your privacy settings in the application, and we apply your updated choice from that point.

12. NOTIFIABLE DATA BREACHES

We take data security seriously and have procedures in place to detect, investigate, and respond to potential data breaches. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms or cause serious harm, we will:

Promptly contain and investigate the incident to determine the scope and impact;
Assess the potential risk to affected individuals and the nature of the breach;
Notify affected individuals without undue delay, providing clear information about the nature of the breach, likely consequences, and measures we are taking;
Where applicable, notify the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act;
Where GDPR applies, notify the relevant supervisory authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to individual rights.

Where a breach affects exercise content or other data we process on your organisation’s instructions, your organisation is the controller. In those cases we notify your organisation without undue delay and support its assessment and its notifications, rather than notifying individuals or regulators ourselves.

13. CHANGES TO THIS POLICY

We review this policy when our practices or applicable requirements change. When a significant update affects how we handle personal information, we notify active users by email and through the platform. We provide further notice and obtain any consent required before introducing a new use of information.

We encourage you to review this policy periodically to stay informed about how we protect your personal information.

14. COMPLAINTS AND DISPUTE RESOLUTION

If you have concerns about how we handle personal information, please contact us so we can investigate and respond.

You can make a complaint to our Privacy Officer at privacy@capitalshield.com.au. We will acknowledge your complaint promptly and aim to resolve it within 30 days. If we need more time, we will explain why and provide an update.

You may also complain to the relevant regulator. The OAIC generally expects you to raise your complaint with us first. Under the GDPR, you do not have to complete our complaints process before contacting a supervisory authority. Relevant regulators include:

The Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992
A competent EU or EEA supervisory authority, including in the country of your habitual residence, place of work or the alleged infringement, where the GDPR applies; or the relevant privacy regulator in another jurisdiction.

Making a complaint will not affect your ability to use our services or exercise your privacy rights.

15. CONTACT

For questions about this policy or requests concerning personal information, contact our Privacy Officer:

Email: privacy@capitalshield.com.au

We aim to acknowledge general enquiries within 5 business days.

Privacy Policy