Privacy & Data Protection Policy

Studio Orris™ Australia | Version 2.0

Last revised: 17 October 2026

1. Who we are and why this policy matters

Studio Orris Australia is operated by JENCEN GROUP PTY LTD (ABN 37 702 081 132; ACN 702 081 132), trading as Studio Orris Australia (Studio Orris, we, us or our). Our Australian head office is at 1/555 Brunswick Street, New Farm, Brisbane QLD 4000, Australia. We also have an Asia-Pacific presence in Taipei, Taiwan.

We work across brand and creative services, digital platforms and technology, business strategy, marketing and communications, People & Culture, recruitment and workforce intelligence. This policy explains, in accessible terms, what information we handle, why we need it, who may receive it and the choices available to individuals.

We seek to handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) to the extent that they apply to the relevant entity, activity and information. Additional laws, contractual duties, confidentiality obligations and professional standards may apply in particular circumstances. This policy also explains our approach to personal information even where a particular statutory requirement does not apply.

The policy is a privacy statement, not a contract for professional services. Commercial terms, intellectual property arrangements and service limitations belong in our separate Terms & Conditions and applicable client agreements. If a project involves additional privacy, confidentiality, security or processing requirements, the relevant agreement and specific collection notice should be read alongside this policy.

2. What this policy covers

This policy applies to information handled when individuals interact with studioorris.com.au and associated websites; submit enquiries or receive proposals; use Orris Smart Concierge™, if enabled; subscribe to Club De Orris™; communicate with our team; apply for employment; participate in recruitment or People & Culture services; use the Orris Portal or another Studio Orris-managed workspace; or are involved in a client engagement, supplier relationship, project or event.

Different services do not necessarily collect the same information or use the same suppliers. A reference to a possible feature or kind of information in this policy does not mean that the feature is active, or that the information is collected in every interaction. Where a particular client system is separately controlled by a client, that client's privacy notice may also apply.

Where we process information on the instructions of a client, the client may be the party responsible for telling individuals about the collection and determining the authorised purposes. We remain responsible for the privacy and security obligations that apply to our own conduct.

3. Key things to know

• Using our public website does not, by itself, subscribe you to marketing. Club De Orris™ subscriptions and other promotional communications are managed separately.

• Orris Smart Concierge is AI, not a person. If public AI chat is enabled, ordinary chat messages may be transmitted to OpenAI. Dedicated contact-form submissions follow a distinct data flow, described below.

• Do not enter sensitive or confidential material into public AI chat. Automated filtering reduces risk but cannot guarantee removal of personal details.

• A client portal is a shared professional workspace. Other authorised people at your organisation may be able to see material posted in client-visible areas; internal staff notes are intended for authorised Studio Orris personnel.

• Recruitment information may be especially sensitive. Recruitment and any workforce-intelligence processing must be limited to appropriate purposes, with extra safeguards and role-specific notices where necessary.

• Some information may be processed overseas. Our overseas business presence and use of international technology providers mean that some information may be accessible or disclosed beyond Australia.

• You can raise privacy questions, seek access or correction, and complain using the details at the end of this policy.

4. Meaning of personal and sensitive information

Personal information means information or an opinion about an identified individual or an individual who is reasonably identifiable, whether true or not and whether recorded in material form or not. Depending on context, a business email address, a professional profile, an IP address associated with an identifiable person, a support message or AI-generated commentary about a person may be personal information.

Sensitive information has a particular meaning under Australian privacy law and can include health information, racial or ethnic origin, religious or philosophical beliefs, sexual orientation or practices, political opinions, trade union membership, certain professional or trade association memberships, criminal records and certain biometric information. We seek to collect sensitive information only when reasonably necessary, lawful and subject to any required consent or other applicable exception.

De-identified information is information no longer about an identified or reasonably identifiable individual. Removing a name alone may not make information anonymous when other details can still identify someone. We distinguish genuine de-identification from simply masking or filtering selected fields.

5. Categories of personal information we may handle

The categories below describe possible information flows, not a statement that all systems or features are active.

5.1 Identity, contact and professional information

Names, preferred names, pronouns voluntarily provided, email addresses, telephone numbers, postal and workplace addresses, employer, role, position, organisation, business identifiers, professional biography and publicly shared professional profiles. Where needed, we may record contact preferences, authorised representative status and business relationship details.

5.2 Enquiries, proposals and client relationship information

Enquiry text, service interests, intended project scope, business objectives, budgets, commercial requirements, consultation notes, stakeholder and decision-maker details, meeting arrangements, quotations, proposals, approvals, contracts, statements of work, service history, feedback and correspondence. This may include information about employees or clients of an organisation where they are involved in delivery.

5.3 Project, service and portal information

Project names, team assignments, role permissions, milestones, tasks, client instructions, uploaded or linked documents, drafts, deliverables, comments, files, meeting notes, approvals, support requests, issue histories, internal communications and activity or audit records. Project materials can incidentally contain personal information belonging to people other than the account holder.

5.4 Website, device and technical information

IP addresses, device/browser characteristics, network requests, approximate location inferred from network information, referring pages, pages or resources requested, technical error logs, session identifiers, device or account security events, authentication timestamps, and cookie or preference settings where relevant. Some information is automatically created when a website or security service operates.

5.5 AI interaction information

Questions, chat messages, associated conversation history, AI responses, operational safety signals, feedback, errors and a summary or enquiry record where follow-up is requested or generated. This may include personal or confidential material if a person elects to type it into an ordinary chat message, despite our warnings not to do so.

5.6 Financial and billing information

Billing and delivery contacts, invoices, payment status, payment references, subscription or service arrangements, financial correspondence, tax information where required and records necessary for ordinary accounting and debt administration. Payment-card details may be handled by payment providers rather than being retained in our general business systems.

5.7 Marketing, events and community information

Subscriber name and email, consent status, campaign preferences, unsubscribe or suppression records, event registration or attendance details, feedback and communications engagement where that information is collected using lawful and enabled technology. Photos or video from events may be handled where appropriate notice or permissions apply.

5.8 Recruitment, employment and People & Culture information

Applications, CVs, work history, references, qualifications, experience, skills, interview and screening answers, professional memberships, right-to-work documents or results, availability, salary expectations, job preferences, assessment results, assessment observations, capability and suitability opinions, recruiter notes, candidate recommendations, background verification information and employment-related administration records where relevant to a defined service.

5.9 Sensitive information and government identifiers

In appropriate circumstances and where permitted by law, information about accessibility requirements, disability or health needs, criminal-history checks or other sensitive matters may be relevant to recruitment or People & Culture work. Government-related identifiers, such as passport or work-entitlement details, will be sought only where justified by a legitimate requirement and handled subject to applicable restrictions. We do not adopt government identifiers as our own routine customer account numbers.

6. How and from whom we collect information

We usually collect information directly when you complete a form, send an email, call, book a meeting, join a mailing list, participate in a consultation, upload a file, use a portal, complete an application or speak to our team or AI assistant. Some information is created during the relationship, for example staff responses, project logs, service recommendations, invoicing or access records.

We may also receive information from a client or employer; an authorised representative; a referee; a recruitment or assessment provider; a business partner or service provider; a publicly accessible professional source; or another person lawfully supplying information for an engagement. We assess whether indirect collection is appropriate and what notification steps are reasonable in the circumstances. We do not treat the mere public availability of personal information as permission to use it for any new purpose.

We may receive unsolicited information. Where information is not reasonably needed or cannot lawfully be retained, we will assess whether it should be deleted, de-identified or otherwise handled in accordance with applicable requirements. This is particularly important for unexpected health, identity or third-party information supplied in enquiries and AI chats.

7. Why we collect and use personal information

Subject to applicable law and the specific context, we use personal information to respond to enquiries; arrange meetings; prepare proposals; enter into and administer engagements; undertake research and advisory activities; provide branding, strategy, design, technology, marketing and business services; run client portals and support; perform recruitment and workforce engagements; assess our own job applicants; administer suppliers, payments and accounts; send communications requested by recipients; maintain relevant consent or unsubscribe preferences; protect our systems and personnel; prevent abuse and fraud; manage disputes; and comply with law.

We may also use appropriate operational information to evaluate performance, improve website navigation, improve service quality, troubleshoot errors, prepare internal reports and understand demand. Any use of identifiable information for analytics, AI-related evaluation, product development or secondary research must have an appropriate purpose and legal basis. References to service improvement do not authorise unrestricted use of confidential project files or candidate records to train external AI models.

If you choose not to provide information needed to identify an enquiry or administer a service, we may not be able to reply fully, provide a quote, arrange access, assess an application or perform the requested engagement. Where information is optional, it should be identified as such at collection where practicable.

8. Website enquiries, consultations and contact forms

When you use a dedicated enquiry form, we typically need contact details and enough information to respond to your request. We may create an enquiry record, assign the enquiry to an appropriate team member, arrange a call, send requested materials or prepare a proposal. Staff may use the information to avoid asking you to repeat details and to maintain an appropriate record of the interaction.

A dedicated contact-form submission is separate from ordinary public AI conversation content. Under the intended Orris Smart Concierge integration, submitting the designated contact form does not itself send the submitted form fields to OpenAI as part of AI response generation. If you separately type the same personal information in a general chat message, that message may be transmitted to OpenAI. We will validate the production configuration of the contact-form pathway before activating public AI.

Contacting us, requesting a quote or accepting a consultation invitation does not automatically enrol you in Club De Orris™. Service and transactional communications necessary to respond to your enquiry are different from optional promotional messages.

9. What Orris Smart Concierge™ is

Orris Smart Concierge™ is an AI-powered digital assistant, designed to assist with general navigation, information about Studio Orris and preliminary discussion of a visitor's business or project needs. Where enabled, some answers are generated using an external AI model. The assistant is not a human consultant and may produce information that is mistaken, incomplete, outdated or poorly suited to a visitor's individual circumstances.

Using the assistant does not establish an advisory engagement, create a binding quote, guarantee the availability of a service or replace independent professional advice. The assistant should not be used for emergencies, employment complaints requiring immediate action, sensitive medical or legal matters, or disclosure of third-party personal information without authority. Visitors can choose to use our ordinary enquiry channels instead.

10. Exactly what the public AI service may transmit

For the public general-chat integration currently contemplated, the information transmitted to OpenAI's API to prepare a response may include the current visitor message and up to six preceding messages in that conversation, along with contextual instructions reasonably required to produce the response. Relevant message context may include both earlier visitor messages and assistant responses.

If a visitor writes a name, email address, phone number, business description, project details, employee information or other identifiable information inside an ordinary message, that information may be included in the API request. The fact that a visitor has not completed a dedicated form does not make chat content anonymous. We do not present the ordinary chat as an encrypted, confidential intake service suitable for sensitive records.

The intended configuration is to keep this context window limited; however, the actual production code, input transformations, tools and logging settings must be verified. If the integration changes its provider, scope of messages, tools or handling of attachments, we will reassess the notice and policy before or when the change is introduced, as required.

11. Personal-information filtering and the limits of redaction

We may use automated rules to detect and remove some commonly identifiable information before an AI request is sent. Such measures are imperfect: a name can appear in unanticipated forms, contextual details can identify a person without a name, and a person may include confidential or sensitive content not detected by a filter.

We cannot guarantee that automated redaction will remove every personal detail. It is therefore important that visitors do not include passwords, security codes, payment-card numbers, identity documents, candidate dossiers, employee records, customer databases, health information, undisclosed client information or legally privileged documents in the public chat.

We may restrict, discard or escalate an interaction where doing so is appropriate to address abuse, prevent harm or protect a user, but the existence of safety processing does not guarantee that every problematic message will be identified before it reaches a service provider.

12. OpenAI processing, model training and provider retention

Where Orris Smart Concierge uses the OpenAI API, input and output data is subject to OpenAI's applicable business API arrangements and data-handling controls. OpenAI states that API data is not used to train its models by default unless the customer affirmatively opts into sharing data for that purpose. This is distinct from retention for abuse monitoring or maintaining application state.

The intended request configuration uses store: false, which means we do not request ordinary stored-response application state for that API interaction. This is not a zero-retention guarantee. Under OpenAI's standard API rules, abuse-monitoring logs may contain prompts, responses and related metadata and may be kept for up to 30 days, or longer where law requires it or where reasonably necessary to protect services or third parties from harm. Some API features can have additional or different storage behaviour; this policy does not suggest those features are used by the public concierge.

We have not represented Orris Smart Concierge as operating under a specially approved OpenAI Zero Data Retention arrangement. We also distinguish information retained by OpenAI from information retained separately by Studio Orris, its hosting providers, security services and enquiry systems. A visitor closing the chat window does not necessarily delete copies in those other systems.

13. Chat sessions, follow-up requests and internal CRM records

A visitor may use the AI without requesting a personal follow-up. Where a visitor asks to be contacted, submits the designated contact form or otherwise creates an enquiry, Studio Orris may create a separate internal CRM or enquiry record containing the contact details supplied, service interest, conversation context relevant to follow-up, a summary of the request, staff assignment and subsequent communications.

Such a record is not the same thing as the OpenAI API request. Retention, access and deletion of CRM records are governed by the needs of the business relationship, applicable retention duties and the systems involved, rather than OpenAI's standard abuse-monitoring timetable. Authorised personnel may review the enquiry or related records to respond, quality-check an issue, investigate a complaint or manage a business relationship.

We do not imply that every chat is converted into an enquiry, that every complete transcript is kept, or that no application or security logs exist. These points depend on the active implementation and relevant settings and must be verified against the deployed system.

14. AI limitations, review and complaints about responses

AI-generated text can contain errors, unjustified inferences or fabricated facts. Responses should not be treated as a final professional recommendation or as verified descriptions of individual people. We may review selected interactions where necessary for support, security, abuse investigation or a reported problem, subject to appropriate access controls and applicable law.

If a response refers to you incorrectly, appears to reveal another person's information or causes a privacy concern, please contact legal@studioorris.com.au, describing the issue without repeating sensitive information unnecessarily. We will assess whether a record can be corrected, restricted, deleted or referred to an appropriate provider, subject to what is technically and legally possible.

15. Orris Portal — accounts and authorised access

Orris Portal is intended to provide secure, role-based access to relevant projects, teams, documents and client workflows. Information held or displayed may include an account holder's identity and contact information, role, organisation, assigned projects, team associations, task status, client communications, documents, comment history, approvals, support requests and relevant account or activity records.

A user may have access to a client workspace because their organisation nominated or authorised them. Access can differ according to their role, project assignment and account permissions. Material placed in client-visible areas may be visible to other authorised users associated with the same organisation or project. Content marked or configured as an internal staff note is intended to be restricted to authorised Studio Orris personnel, subject to the actual access configuration.

Client administrators and account owners should only nominate users who are authorised to access the relevant information. Individuals should avoid placing sensitive records or personal information about others in broad comment threads or general upload areas when a restricted channel is more suitable.

16. Orris Portal — files, activities, security and end of access

Portal records may include file names and contents, creation or modification details, comments, time stamps, workflow status, access or audit events, and records of support or approvals. To provide services and investigate technical issues, relevant Studio Orris personnel and infrastructure providers may have access according to their responsibilities.

Access to the portal may be changed or disabled when a user leaves a client organisation, a project ends, credentials are compromised or an account is no longer authorised. Disabling a login is not necessarily the same as deleting project records, because agreed deliverables, audit records, financial documents, legal records and backups may still need to be retained. Requests concerning client-owned workspace records may need to be considered together with the client organisation that controls the engagement.

We may use reasonable security measures suited to the system, such as access restrictions, account authentication, secure connections, privilege reviews and logs. The particular configuration and available features should not be assumed to be identical across all client environments. Users should notify us promptly of suspected unauthorised access and keep account credentials confidential.

17. Client-supplied personal information and our respective roles

Clients may supply personal information about their staff, candidates, customers, contractors or other people so that we can complete a project. Examples include stakeholder lists for a website, approved staff biographies, customer experience research, recruitment materials, workflow data or information required to build a digital system. The client should have authority to provide the information and must give any collection notices, permissions or consents required for that disclosure.

We use client-supplied material only for an authorised engagement purpose, another purpose agreed with the client or a purpose otherwise permitted or required by law. A client may have its own privacy obligations as the organisation deciding why and how data is processed; Studio Orris also has duties arising under applicable law, contract and the way it actually handles the information.

Where a client requires a specific security, retention, deletion, overseas processing, confidentiality or data-processing arrangement, it should be recorded in the agreement rather than assumed from this general website policy. We will not knowingly make client confidential information available to an unrelated third party for that party's independent commercial use.

18. Our own recruitment and career applications

When an individual applies for a role with Studio Orris, we may collect their contact information, résumé, portfolio, cover letter, answers, work history, qualifications, references, work eligibility, desired terms and communications about the role. Additional documents or checks should only be requested where proportionate and relevant to the stage and requirements of recruitment.

We use this information to assess suitability, arrange interviews, communicate with applicants, verify relevant claims when authorised, make recruitment decisions, document outcomes and administer offers or onboarding. Access should be limited to authorised recruitment and hiring personnel and providers with a legitimate role. Applying for a role does not create a client account or, by itself, subscribe the applicant to marketing.

Candidate records may be retained to manage recruitment, legal obligations, disputes or future opportunities where appropriate notice and a lawful basis apply. We do not state a universal retention period for unsuccessful applications until our approved retention schedule has been confirmed. Applicants can make requests about their personal information using our privacy contact details.

19. Recruitment, People & Culture and workforce services for clients

In client engagements, we may handle CVs, contact details, employment history, role requirements, interview observations, references, experience and capability information, pay expectations, professional preferences, assessment results and other information necessary for an agreed hiring or workforce purpose. We may receive information directly from candidates or from a client, employer, referee, screening provider or relevant professional source.

For references, background verification, right-to-work checks and other screening, the basis for collecting the information, notice to the individual and authorisation requirements should be considered for the particular activity. Sensitive information and criminal record details merit special care. We seek to limit distribution of candidate materials to people involved in the relevant recruitment or workforce process.

Clients generally remain responsible for their own employment and hiring decisions unless a different role is expressly agreed. We encourage clients to review important inputs, consider fairness and suitability, and avoid decisions based on unsupported or inaccurate inferences. Different services, including Nexus Intelligence™, may involve supplementary collection notices or arrangements.

20. Nexus Intelligence™ and computer-assisted talent assessment

Nexus Intelligence™ is a Studio Orris workforce-intelligence and people-solutions offering. Depending on the commissioned service and live configuration, computer-assisted tools may help organise job and candidate information, structure assessment evidence, compare information to role criteria, identify information gaps or produce recommendations for authorised decision-makers.

Information potentially involved can include qualifications, experience, professional skills, work history, position requirements, structured application or assessment responses, interview observations, capability measures and related professional information. We do not assume that an AI-produced score or ranking is accurate or that a computer-generated inference is a verified fact about an individual.

Any material use of personal information for AI-supported profiling, matching, ranking or assessment requires a clear, lawful purpose and information-handling controls appropriate to its risks. We do not represent that every described form of scoring, ranking or automation has been deployed. Service-specific notices should identify which capabilities are in operation, the information used, intended recipients, appropriate human oversight and a route for individuals to raise concerns.

21. Automated decisions that may significantly affect individuals

An automated tool may only help organise information, or it may play a substantial and direct role in a consequential decision. These situations have different privacy implications. Orris Smart Concierge's general website guidance is not itself a hiring, dismissal, credit or legal-entitlement decision. However, a computer program used to rank candidates or materially guide a hiring outcome can raise more serious questions.

From 10 December 2026, new transparency obligations under APP 1.7–1.9 apply where the legal conditions are met, including where a computer program makes or does something substantially and directly related to making a decision reasonably expected to significantly affect an individual's rights or interests, using that individual's personal information. If a relevant deployed system falls within those provisions, our privacy policy must set out the kinds of personal information used, the kinds of qualifying decisions made solely by a computer program, and the kinds of qualifying decisions substantially and directly informed by a program.

This policy describes possible business activities; it must not be interpreted as a declaration that Studio Orris currently operates any particular qualifying automated decision system. Before introducing or materially changing such a system, we should document its actual role, decision categories, information inputs, recipients, oversight, ability to investigate concerns, and the applicable notice and disclosure obligations, then update the public policy as needed. Mere reference to “human oversight” is not a substitute for analysing whether the statutory test applies.

22. AI tools used in other professional services

Studio Orris may use appropriate AI-assisted tools for research, information organisation, drafting, analytics, design exploration, software development, quality review, translation or workflow support. The information entered and the supplier used may differ from the public Orris Smart Concierge integration. The public concierge's six-message context limit, store: false setting and OpenAI-specific retention statement do not automatically describe every other AI tool.

For client materials, staff and contractors should follow approved instructions, confidentiality commitments, access controls and agreed supplier restrictions. Sensitive client records, employment data and confidential information should not be uploaded to an unrelated consumer AI service merely because it is convenient. When an engagement calls for AI-supported processing, any material third-party use or international transfer should be addressed through the relevant contract, collection notice or other appropriate communication.

23. Billing, payments and administrative records

We handle the personal information needed to issue invoices, reconcile payments, contact an authorised billing person, administer subscriptions and handle legitimate accounting, taxation and contractual matters. Payment transactions may involve banks, accounting platforms, payment gateways or other service providers. Those providers may collect information directly under their own terms and privacy notices.

Where possible we avoid collecting full payment-card information in ordinary email, chat or project correspondence. We may retain invoices, remittance information, tax records and transaction histories for periods necessary under accounting laws, business record obligations and legitimate dispute management. Billing information is not automatically treated as marketing consent.

24. Club De Orris™, direct marketing and event communications

When someone voluntarily joins Club De Orris™ or requests another marketing publication, we may hold their first name, email address, subscription preference, consent date or record, unsubscribe status and engagement information where collected using active, lawful services. We use this to send the communications requested or otherwise permitted by applicable law.

Commercial electronic messages are subject to applicable rules, including the Spam Act 2003 (Cth). Where the unsubscribe requirement applies, our communications will provide a way to unsubscribe, and we will honour requests within the applicable deadline. Unsubscribing from marketing does not necessarily stop service, contract, security or other necessary non-promotional notices. A person using a contact form, portal or chatbot is not subscribed merely by doing so.

We may invite clients or contacts to professional events, collaborations or research opportunities. Event registrations, photographs, recordings or testimonials require attention to the specific notice, permissions and purposes involved. We will not treat a general newsletter subscription as unconditional permission to publish an identifiable person's image or testimonial.

25. Cookies, analytics and comparable technologies

Our websites may use essential cookies and comparable storage or session technologies to maintain basic functions, protect against misuse, remember user choices or support account authentication. Other technologies may be optional and subject to appropriate controls or notice. Our separate Cookie Policy and Cookie Settings describe the technologies actually enabled on the public site and available choices.

Some third-party integrations, embeds, videos or links may collect information under their own policies when activated or followed. We do not claim an analytics or advertising platform is active simply because it is mentioned as an example of software we might use. A cookie preference is separate from an agreement to receive promotional emails; continued browsing alone is not treated as blanket consent for optional tools.

26. Service providers, contractors and other disclosures

Where appropriate for the purpose and permitted by law, personal information may be made available to authorised Studio Orris employees and contractors; the relevant client and its authorised representatives; accountants, lawyers, insurers and advisers; technology and hosting suppliers; IT and security providers; email, communications, CRM, project management and collaboration suppliers; banking, billing and payment providers; recruitment, screening or assessment partners; and AI providers in the limited circumstances described in this policy.

Information may also need to be disclosed where required or authorised by law, to respond to a lawful regulatory or judicial process, to investigate fraud or security incidents, to protect legitimate rights or safety, or in connection with a legitimate corporate transaction subject to applicable restrictions.

We seek to limit access and disclosures according to the purpose, the sensitivity of the data and the recipient's role. Independent providers may have separate contractual and privacy obligations. The fact that a supplier supports an operational system does not necessarily mean it has unrestricted access to the contents of every record in that system.

27. Overseas processing and cross-border disclosures

Studio Orris operates in Australia and has an Asia-Pacific presence in Taiwan. We also use technology providers with international operations, including OpenAI, which is based in the United States. Depending on the actual service, personnel, supplier, data residency arrangement or support pathway, information may be accessed, processed or disclosed outside Australia. Taiwan and the United States are presently the identifiable relevant jurisdictions, but specific providers or client engagements may involve additional locations that must be checked and stated where practicable.

There is a legal distinction between an Australian organisation's own overseas use of information and disclosure to a separate overseas recipient. Where APP 8 applies to a disclosure, we will take the reasonable steps required to address the recipient's handling of personal information unless an applicable exception applies. Other laws or contractual safeguards may also apply. We do not promise that every service is hosted exclusively in Australia or that information cannot be accessed from abroad.

Individuals may contact legal@studioorris.com.au for information about international handling relevant to their interaction. Where service-specific offshore recipients or countries are material and practicable to identify, supplementary notices and this policy should identify them.

28. Information security and access governance

We seek to apply safeguards appropriate to the sensitivity of information and operational risk. Depending on the system, these may include restricted user permissions, authentication, secure transmission, access logging, appropriate supplier arrangements, confidentiality obligations, system maintenance, account administration, backup arrangements, security monitoring and incident response procedures.

These measures are intended to reduce misuse, interference, loss, and unauthorised access, modification or disclosure. No website, cloud environment, AI integration or transmission can be guaranteed completely secure. We therefore recommend not sending passwords, government identity documents, payment-card details or sensitive third-party information through unsecured or inappropriate channels, including general AI chat.

We aim to restrict internal access to legitimate business purposes, and to review whether continuing access remains necessary. Where a client has a separately agreed security schedule, its specific obligations operate alongside the general approach in this policy. A supplier's security certification does not, by itself, establish that every Studio Orris process or application is certified.

29. Suspected data incidents and notification

If we become aware of a possible security incident or unauthorised disclosure, we will assess what information may be affected, take proportionate containment or mitigation steps, consider relevant contractual and legal duties and determine what communications are required. Depending on the facts, we may work with a client, infrastructure provider, insurer, adviser or relevant authority.

Where the Notifiable Data Breaches (NDB) scheme applies, eligible breaches involving a likelihood of serious harm require the relevant notifications. A suspected eligible breach also triggers an assessment process under the scheme. We do not claim that every technical alert is a reportable breach, or that a fixed notification period applies regardless of the nature of the incident and the governing law.

You should contact us promptly if you believe your account or information has been exposed or if you receive an unexpected request claiming to be from Studio Orris.

30. How long information is kept

Different information has different retention requirements. We retain identifiable personal information only for as long as needed for the purposes for which it was collected or lawfully used, including current services, reasonable follow-up, security, dispute handling, legal or accounting requirements, and authorised archiving. Where retention is no longer justified, we seek to securely delete or de-identify the information subject to applicable obligations.

In particular:

• OpenAI API abuse-monitoring content: OpenAI's standard policy permits retention for up to 30 days, subject to legally or safety-necessary exceptions. This is a provider setting, not our complete retention schedule.

• Public chat and technical records within Studio Orris-controlled systems: treatment depends on the production session, log and hosting configuration; records may remain after a browser tab closes. Their retention schedule should be governed by an approved documented rule.

• CRM enquiries and consultations: kept while relevant to handling the enquiry or relationship and, where justified, for necessary business records, disputes or legal requirements.

• Active client projects and Orris Portal workspaces: retained for delivery, project history, service support and agreed handover, with additional retention where needed for contracts, legal duties or defensible records.

• Invoices and accounting documents: retained as required by applicable taxation and record-keeping laws.

• Recruitment and assessment information: subject to defined recruitment purposes, appropriate notice, applicable law and an approved candidate-record schedule; no single period applies automatically to every process.

• Newsletter consent and suppression records: kept as necessary to administer subscriptions, evidence relevant consent and respect unsubscribe requests.

• Backups, incident records and security logs: may follow separate controlled cycles and may not be immediately erased when a primary record is deleted.

We do not promise instant erasure or a general Australian statutory right to deletion in all circumstances. We will assess requests fairly and provide an explanation when retention is necessary or deletion is not possible. More precise category-by-category periods should be published only after they are verified against our approved internal retention schedule.

31. Accessing and correcting your personal information

You may request access to personal information we hold about you and seek correction if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading. Please contact our privacy contact with sufficient details to identify the relevant information and the reason for your request. We may request reasonable identity verification to protect you and others from unauthorised disclosure.

We will review and respond in accordance with applicable law. Where access or correction cannot be provided in the form requested, including where an applicable exception protects another person's information or confidential legal material, we will explain the relevant basis and available next steps as required. If we disagree with a correction request, there may be circumstances in which we can associate a statement from you with the relevant record.

An access request relating to a client-controlled recruitment process or portal workspace may involve consultation with the client organisation, but we will still consider obligations that apply to the information we ourselves hold.

32. Your other choices and privacy enquiries

You may choose not to use Orris Smart Concierge and instead contact us through the regular form or by email. You may modify available cookie preferences through Cookie Settings, unsubscribe from marketing, ask about permitted handling of your information and request that information be considered for deletion or de-identification where appropriate.

Subject to legal and practical requirements, you may sometimes interact with us anonymously or using a pseudonym, particularly for general website browsing or an initial question. To respond to a specific enquiry, provide a contracted service, verify a candidate, grant portal access or fulfil a legal obligation, we may need to know who you are.

If we receive an instruction to stop contacting you for marketing, we may keep minimal suppression information so that the request continues to be respected. Withdrawing marketing consent does not necessarily affect lawful processing required to perform an existing agreement or maintain accounting or security records.

33. Children, vulnerable people and unexpected sensitive disclosures

Our professional services and public AI assistant are designed primarily for business users and adult professionals, not as services targeted at children. We do not seek to solicit children's sensitive information through public AI chat. A parent, guardian or individual with a relevant concern can contact us if they believe information about a child has been collected inappropriately.

Please avoid supplying medical records, identity credentials, sensitive personal narratives, employee complaints containing identifiable details or confidential third-party records in general website forms and chat unless a specific secure channel and appropriate purpose have been arranged. If such information is supplied unexpectedly, we will assess its appropriate handling and whether it needs to be restricted, returned, deleted or retained for an authorised purpose.

34. Data quality, fairness and individual impact

We seek to take steps appropriate to the circumstances to maintain information that is accurate, relevant and sufficiently current for its intended use. This is particularly important for references, candidate assessments, professional biographies and decisions that may have significant consequences for individuals. Errors may come from original submissions, human judgement, incomplete sources or automated tools.

People who believe that incorrect information about them has materially affected an interaction with Studio Orris may raise the matter using the access, correction or complaint procedures below. We will consider the information actually held by us, the role of our client or provider, appropriate verification, contractual constraints and applicable law. We do not promise that every third-party record or independently controlled AI system can be altered directly by Studio Orris.

35. Privacy complaints and how we handle them

If you are concerned about our handling of personal information, you may make a privacy complaint to legal@studioorris.com.au, ideally describing the issue, the relevant interaction or service and how you would like the concern addressed. Avoid emailing copies of unnecessarily sensitive documents when an initial description will suffice; we can discuss an appropriate secure method if more information is needed.

We will acknowledge and assess the complaint, identify the relevant records or systems, consult appropriate personnel or suppliers where necessary, investigate reasonably, consider corrective action and respond with an outcome or explanation. We aim to respond substantively within 30 days where reasonably practicable, or let you know when a longer investigation is needed. This is a service target rather than a guarantee that every complex matter can be resolved within that period.

If the matter is not resolved and the applicable law allows it, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. Generally, the OAIC expects individuals to complain to the organisation first and allow time for a response. Other avenues may apply to particular employment or contractual disputes.

36. Other websites, providers and future service changes

Our website or communications may contain links to third-party resources, external platforms or embedded services. These third parties may apply their own privacy notices, permissions and data practices when you interact directly with them. We encourage individuals to consider the applicable notices before sharing personal information.

Studio Orris may introduce, improve, remove or reconfigure services. Material changes to an AI integration, category of information collected, recipient, cross-border practice, automated decision capability or retention arrangement may require updated notices, supplier diligence, a privacy impact assessment or other steps before deployment. We will update this policy as reasonably necessary and display the latest review date on the website. A policy change does not override agreed client confidentiality obligations or remove statutory rights.

37. How to contact us

Privacy Contact — Studio Orris™ Australia

Legal operator: JENCEN GROUP PTY LTD, trading as Studio Orris Australia

ABN: 37 702 081 132 | ACN: 702 081 132

Privacy and legal enquiries: legal@studioorris.com.au

General enquiries: hello@studioorris.com.au

Telephone: (07) 3608 5333

Postal address: 1/555 Brunswick Street, New Farm, Brisbane QLD 4000, Australia

Website: https://studioorris.com.au

Cookie information: https://studioorris.com.au/cookie-policy

Terms & Conditions: https://studioorris.com.au/terms-and-conditions