Governance Works respects your privacy and collects as little information as possible. This policy explains what is collected, where it goes, and what you can do about it.
Last Update: September 2026
Almost nothing. This website does not store enquiry forms, booking details or downloaded documents. Forms are hosted by Zoho and submit directly to Zoho systems. Documents are delivered as private links that expire after seven days.
That is a deliberate design decision. A consultancy advising on privacy and AI governance should keep its own data footprint small.
When you submit an enquiry, request a resource or book a meeting, the following may be collected: your name, work email address, organisation, role, and whatever you tell me in the message or booking notes. Where you request a document, a record of which document is kept.This is used to respond to your enquiry, to deliver what you asked for, and to send occasional related material where you have agreed to that. It is not sold, and it is not shared with third parties for their own marketing.
Governance Works is an Australian business, and the systems behind it are run in Australia. That is a deliberate choice, not a default.
Zoho. The Governance Works tenancy is the Australian one. Enquiry records, bookings, documents in WorkDrive, CRM records and the site analytics all sit in Zoho's Australian data centre. Zoho acts as a processor of this information on behalf of Governance Works, which remains accountable for it.
Microsoft Azure. Where Azure is used, the subscription runs in the Australia East region, in Sydney. Any backup or failover copies stay within Australian regions.
Everything else. New tools are assessed for where the data will physically live before they are adopted, and an Australian data region is a condition of use. Where a service cannot offer one, it does not get client data.
The honest limits. Global vendors run global support and security operations, so a vendor's staff outside Australia may in some circumstances access a system in order to support or secure it. Email in transit passes through infrastructure outside anyone's control. Where offshore access is unavoidable, it is kept to the minimum, covered by the vendor's contractual terms, and does not involve data being stored offshore.
Every form carries an unticked consent box that names its purpose, and the form will not submit without it. Where a form offers something additional, such as an option to also receive The Guardrail, that option is a separate unticked box and is never pre-selected.
We record which form you used, what you consented to and when, so that we can show the basis on which we hold and use your information.
You can withdraw any consent at any time. Every issue of The Guardrail carries an unsubscribe link, and for anything else, or to withdraw all consents at once, email hello@governanceworks.com.au. We will act on a withdrawal promptly, and we keep a record of the consent and its withdrawal only as proof that we acted on it.
This website uses a small number of tools to run the site, understand traffic and offer live chat. Those tools, and the website itself, may set cookies in your browser.
Zoho PageSense and Google Analytics record which pages are visited, how far people scroll, and where they click. It is used to improve the site and to allow most people to avoid that pesky "Are you human?" prompt.
Zoho SalesIQ provides the chat window. If you start a conversation, what you type is recorded alongside your enquiry.
GoDaddy hosts this website and adds its own traffic measurement: page views, clicks and timing, recorded against a randomly generated identifier. It comes with the hosting, it is not advertising, and it is not sold on.
Some tools also store information locally in your browser so they keep working. The AI Assessment tool does this, which is why your results are still there if you come back to the same page. That data stays in your browser unless you choose to send it to me.
No third-party advertising networks are used on this site.
You can block cookies in your browser settings. The site works without them, although some tools will not offer their full function.
Enquiry and contact records are kept for seven years after the end of engagement, or longer only where there is a legal requirement. Marketing consent records are kept while consent stands, and afterwards as evidence that it was given.
If you ask to be deleted, marketing contact stops immediately. Records held under the seven year obligation cannot be deleted before that period ends.
A record of removing consent consisting of name, contact methods and the dates for giving/retraction of consent will be maintained while required to show evidence of consent.
Sometimes it will be necessary to share data with partners for the purpose of performing the services requested. Data will only be shared with partners after receiving your consent and will become subject to the privacy policy of the relevant partner. You may decline to have your data passed on to a partner, but this may affect the ability of Governance Works or the Partner to deliver services requested.
You can ask what information is held about you, ask for it to be corrected, or ask for it to be deleted. Email hello@governanceworks.com.au and you will get a response within a reasonable period. Deletion is subject to the retention obligation described above. If you are not satisfied with how a privacy matter has been handled, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
If you have enquired, requested a resource, booked a meeting or worked with us, we may from time to time email you about new services, products, courses or events from Governance Works that relate to what you contacted us about. These are occasional, not a regular mailing, and every one carries an unsubscribe link. They are separate from The Guardrail, which you receive only if you subscribed to it. You can opt out of offers at any time using that link or by emailing hello@governanceworks.com.au, and doing so does not affect any other consent you have given us.
From 10 December 2026, Australian Privacy Principle 1 requires us to say whether we have arranged for a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using personal information about that individual.
We have not. Governance Works does not use any computer program to make or substantially shape decisions about individuals, and no automated process operates on personal information for that purpose. The automation we do use supports internal corporate work: drafting and publishing our own policies, procedures and content, scheduling, monitoring our own systems, and sending emails to people who have asked to receive them. Decisions about people, including who we work with, what we recommend, and how we respond to an enquiry or complaint, are made by a person.
We review this statement whenever we introduce or materially change a system, and at least annually. If that position changes, we will update this policy before the change takes effect and describe the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions the program substantially and directly contributes to.
This policy may be updated. The date at the top shows when it last changed.
Paul Berryman
Governance Works