We collect personal information including your name, email address, phone number, company name, and job title when you:

• Contact us via our website, email, or phone

• Book a discovery call or consultation

• Engage us to deliver consulting services

We may also collect operational, financial, and performance data that you provide during a consulting engagement. This data is used solely to deliver the agreed services.

We collect personal information directly from you wherever reasonably practicable. In some cases, we may receive information from third parties (for example, if a colleague refers you or books on your behalf).

We use your information to:

• Respond to enquiries and deliver agreed services

• Send proposals, invoices, and project-related communications

• Fulfil legal and regulatory obligations (including tax and accounting requirements)

• Improve our services and internal processes

• Develop anonymised case studies or testimonials — only with your explicit prior written permission

We do not sell your personal information to third parties.

Our website may use cookies and similar tracking technologies (including analytics tools such as Google Analytics) to understand how visitors use our site. You can control cookie settings through your browser. By continuing to use our website, you consent to our use of cookies as described in this policy. We do not use cookies to collect sensitive personal information.

Your personal information is stored using reputable cloud-based platforms, which may include providers such as Google Workspace, Xero, Calendly, and similar business tools. We take reasonable technical and organisational steps to protect personal information from misuse, loss, unauthorised access, modification, or disclosure.

Where our service providers store or process data, we take reasonable steps to ensure they handle your information in accordance with the APPs.

We retain personal information for as long as necessary to deliver our services and meet our legal obligations (including tax record-keeping requirements, typically 7 years). When personal information is no longer needed, we will take reasonable steps to destroy or de-identify it securely.

We may share your personal information with third-party service providers to the extent necessary to operate our business and deliver our services. These providers may include accounting and invoicing software, scheduling and calendar tools, cloud storage, and email communication platforms. We do not authorise these providers to use your information for their own purposes beyond what is necessary to provide their services to us.

If you receive marketing or general communications from us, you may unsubscribe at any time by:

• Replying with "unsubscribe" to any email

• Contacting us at admin@ridgwayresilience.com

We will action all unsubscribe requests within 5 business days. Transactional communications (such as invoices and project updates) are not affected by unsubscribing.

You have the right to request access to the personal information we hold about you and to request corrections if it is inaccurate, incomplete, or out of date. To make a request, contact us at admin@ridgwayresilience.com. We will respond within a reasonable timeframe (generally within 30 days). We may decline access in limited circumstances permitted by the APPs, and if so, we will explain why.

If you believe we have handled your personal information in a way that does not comply with the Australian Privacy Principles, please contact us at admin@ridgwayresilience.com. We will investigate and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We may update this Privacy Policy from time to time. The current version will always be published on our website with the effective date shown above. We encourage you to review this policy periodically.