BeCyberSmart by hsj.host

Privacy Policy

Last updated: 21 May 2026

ABN: 58 673 728 526

1. Introduction

This Privacy Policy explains how HSJ Host Pty Ltd (“we”, “us”, “our”) collects, holds, uses, and discloses personal information when you use the Cyber Aware online learning service at cyberaware.hsj.host and related pages (the “Platform”).

We are committed to protecting your privacy and handling personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles (APPs), and the Notifiable Data Breaches (NDB) scheme where they apply to us.

By creating an account, subscribing, enrolling in courses, participating in discussion, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy.

2. Who we are

HSJ Host Pty Ltd operates the Cyber Aware service at cyberaware.hsj.host. “Cyber Aware” is a descriptive service name we use for this website only. We do not own or claim any trademark or other proprietary rights in the name “Cyber Aware”.

3. What is personal information?

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether recorded in a material form or not.

Some information we hold (for example, aggregated usage statistics that cannot reasonably identify you) may not be personal information under the Privacy Act.

4. What personal information we collect

The personal information we collect depends on how you use the Platform. It may include:

  • Account and identity details: username, display name, email address, password (stored in hashed form), and mobile phone number.
  • Profile information: profile photo (avatar) you upload, and account preferences you set.
  • Billing and subscription details: billing name and address, Australian Business Number (ABN) if you provide one for business billing, subscription plan, payment status, and Stripe customer or subscription identifiers. Card details are processed by Stripe; we do not store your full card number.
  • Learning and certification data: course enrolments, lesson and quiz progress, scores, completion dates, certificate numbers, and certificate verification outcomes when someone uses our public certificate check.
  • Discussion and community data: topics, replies, quotes, mentions, reports you submit, and in-platform notifications we store for your account.
  • Security information: two-factor authentication (2FA) settings, encrypted authenticator secrets, recovery codes (stored in hashed form), and trusted device records where you enable those features.
  • Technical and usage data: IP address, browser and device type, dates and times of access, pages viewed, referral URLs, and similar log or analytics data generated when you use the Platform.
  • Communications: messages you send us (for example support or privacy requests) and transactional emails we send you (such as password reset or account notices).
  • Anti-abuse data: information processed through Google reCAPTCHA when enabled (for example on registration), which may include interaction signals sent to Google to assess whether a request is automated.

5. How we collect personal information

We collect personal information in several ways, including:

  • Directly from you when you register, update your profile, subscribe, complete courses or quizzes, post in discussion, upload an avatar, contact us, or use account security features.
  • Automatically when you use the Platform, through cookies, server logs, and similar technologies.
  • From third parties where you authorise it or where reasonably necessary to provide the service—for example, payment confirmation from Stripe.

6. Why we collect, use, and disclose personal information

We collect, hold, use, and disclose personal information for purposes including:

  • Creating and managing your account and authenticating you, including optional two-factor authentication.
  • Providing access to courses, resources, certificates, and discussion features you are entitled to use.
  • Processing subscriptions and payments, managing billing records, and fulfilling our contractual obligations to you.
  • Recording learning progress, issuing certificates, and operating our public certificate verification service.
  • Sending service-related communications (for example security alerts, billing receipts, password resets, and administrative notices you cannot reasonably opt out of while you maintain an account).
  • Moderating discussion, investigating reports, protecting users, and enforcing our terms and acceptable use standards.
  • Improving, securing, and troubleshooting the Platform, detecting fraud or abuse, and complying with legal obligations.
  • Responding to access, correction, or complaint requests under the Privacy Act.

If we need to use or disclose your personal information for a new purpose that is not reasonably related to the purposes above, we will take steps required by the Privacy Act (which may include obtaining your consent where appropriate).

7. Our obligations under the Australian Privacy Principles

We aim to comply with the APPs, including by:

  • Managing personal information in an open and transparent way (APP 1), including by publishing this policy.
  • Collecting personal information only where lawful and, where reasonable, from you directly (APPs 3 and 5), and giving you notice about collection at or before, or as soon as practicable after, collection.
  • Using and disclosing personal information only for the primary purposes for which it was collected, or for related secondary purposes you would reasonably expect, or as otherwise permitted by law (APP 6).
  • Taking reasonable steps to ensure personal information is accurate, up to date, and complete (APP 10).
  • Protecting personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure (APP 11).
  • Giving you access to, and correcting, personal information we hold about you on request, subject to exceptions in the Privacy Act (APPs 12 and 13).

8. Anonymity and pseudonymity

Where lawful and practicable, you may interact with us without identifying yourself (for example, browsing public pages or verifying a certificate number without logging in).

To access paid courses, maintain progress, receive certificates, or participate in discussion as a registered member, you must provide certain identifying information. In those cases, use of a pseudonym may be impracticable because we need to verify your identity and link activity to your account.

9. Direct marketing

We do not sell your personal information. We may send you marketing communications about our courses or Platform only where permitted by law—for example, if you have opted in, or if an exception under the Spam Act 2003 (Cth) or Privacy Act applies.

You may opt out of marketing emails at any time using the unsubscribe link in the message or by contacting us. Even if you opt out of marketing, we may still send transactional or service messages necessary for your account or security.

10. Disclosure to other organisations

We may disclose personal information to:

  • Service providers who help us operate the Platform (for example hosting, email delivery, payment processing, security, or support tools), subject to confidentiality and data-handling obligations.
  • Stripe and its related entities, to process payments and manage subscriptions.
  • Google, where reCAPTCHA or other Google services are enabled on the Platform.
  • Professional advisers (such as lawyers or accountants) where reasonably necessary.
  • Regulators, courts, or law enforcement where required or authorised by Australian law.

We require our service providers to handle personal information in line with this policy and applicable law, but we are not responsible for the independent privacy practices of third-party websites you may link to from the Platform.

11. Overseas disclosure

Some of our service providers (including Stripe and Google) may store or process personal information outside Australia, including in the United States and other countries.

Before we disclose personal information overseas, we take reasonable steps to ensure the overseas recipient complies with the APPs, or we otherwise comply with APP 8—for example by relying on contractual protections, your consent after we inform you of the countries involved and the risks, or another permitted exception under the Privacy Act.

By using payment features or services that involve those providers, you understand that your information may be transferred overseas for processing.

12. Government related identifiers

We do not ask for, and do not use as our own identifier, government related identifiers such as tax file numbers, Medicare numbers, or driver licence numbers, except where you voluntarily provide an ABN for business billing and we use it only for that purpose in accordance with APP 9.

13. Security and data breaches

We take reasonable technical and organisational steps to protect personal information, including access controls, encryption where appropriate (for example for 2FA secrets), secure hosting practices, and limiting staff access to what is necessary.

No method of transmission or storage is completely secure. You are responsible for keeping your password and 2FA devices confidential.

If we become aware of a data breach that is likely to result in serious harm, we will assess the incident and, where required under the NDB scheme, notify affected individuals and the Office of the Australian Information Commissioner (OAIC).

14. How long we keep personal information

We retain personal information for as long as needed to fulfil the purposes in this policy, provide the Platform, meet legal and accounting obligations, resolve disputes, and enforce our agreements.

When information is no longer required, we take reasonable steps to destroy or de-identify it, unless we must retain it by law or for legitimate business records (for example completed certificate records).

15. Access and correction

You may request access to the personal information we hold about you, or request correction if you believe it is inaccurate, out of date, incomplete, irrelevant, or misleading.

Many details can be updated directly in your account settings (profile, email, mobile, billing address, and security settings). For other requests, contact us using the details in section 19.

We will respond within a reasonable period and in line with the Privacy Act. We may refuse access or correction in limited circumstances permitted by law; if we do, we will explain our reasons.

We do not charge a fee for making a request, but we may charge a reasonable administrative cost if the Privacy Act allows it for your particular request.

16. Complaints

If you have a concern about how we have handled your personal information, please contact us first using the details below. We will acknowledge your complaint and aim to resolve it promptly.

If you are not satisfied with our response, you may lodge a complaint with the OAIC:

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992

We encourage you to contact us before contacting the OAIC so we can try to resolve your concern directly.

17. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, protect the Platform, and understand how it is used. Essential cookies are necessary for core functionality; you can adjust non-essential cookies through your browser settings, though some features may not work correctly if you disable them.

Third-party services embedded in the Platform (such as reCAPTCHA or payment flows) may set their own cookies subject to their policies.

18. Children

The Platform is intended for users who can enter a binding agreement under applicable law. We do not knowingly collect personal information from children under 16 without appropriate parental or guardian consent. If you believe we have collected information from a child in error, contact us and we will take reasonable steps to delete it.

19. Contact us

For privacy questions, access or correction requests, or complaints, contact us:

  • Organisation: HSJ Host Pty Ltd
  • Service: Cyber Aware at cyberaware.hsj.host
  • ABN: 58 673 728 526
  • Address: Suite 414, Level 2/66 Victor Cres Narre Warren VIC 3805
  • Email: contact@hsj.host

20. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The current version will be published on this page with an updated “Last updated” date.

Material changes will be brought to your attention where required—for example by email or a notice when you next log in.

Continued use of the Platform after the effective date of an updated policy constitutes your acknowledgement of the changes, to the extent permitted by law.

This policy is provided for general information and does not constitute legal advice. You should obtain independent legal advice if you need certainty about your organisation’s privacy obligations.