Privacy Policy

1.1 West Protect is the trading name of Jayke Juras, ABN 18 223 116 959. References to West Protect, we, us and our mean Jayke Juras trading as West Protect. The trading name is not a separate incorporated company.

1.2 Our privacy contact is Jayke Juras: jayke@westprotect.com.au; 0422 226 436; PO Box 1921, Osborne Park DC WA 6916. Our website is westprotect.com.au. You can read this policy in full on this page without downloading a file. You may also request a free copy or an accessible way to receive it.

1.3 This policy covers information we handle through enquiries, our website and social-media contact, quotations, equipment supply, installation, commissioning, maintenance, warranty assistance and support. It applies to Jayke and authorised personnel acting for West Protect. It can concern prospective and current customers, representatives, residents, workers, visitors and other identifiable people.

1.4 Privacy responsibilities can arise before a quote is accepted or a payment is made. This policy does not govern unrelated personal activities or replace another organisation's own policy. We remain responsible for our own handling, choices and conduct where the law requires.

2.1 Personal information includes information or an opinion about an identified or reasonably identifiable individual. Whether a device identifier, address, image or log identifies someone depends on its context and the information with which it can be linked.

2.2 This policy explains information handling. Reading it, acknowledging receipt or making an enquiry does not provide blanket consent to every activity mentioned. A service contract, collection notice, remote-access authorisation, marketing permission and sensitive-information consent serve different purposes.

2.3 We provide required notices and obtain the authority and consent required for the particular activity. A person instructing us must have appropriate authority, but their instruction does not by itself settle other people's rights. We assess our own obligations and do not rely on an instruction to justify conduct for which an adequate lawful basis has not been established.

2.4 Australian privacy and surveillance requirements apply according to the business, information and circumstances. Nothing here excludes a mandatory right or obligation, and acknowledging this policy is not a condition of any legal privacy protection. The Privacy Act 1988 and Australian Privacy Principles apply where the law requires them to apply; publication of this policy does not itself constitute a formal voluntary opt-in to that Act.

2.5 Where a government or other regulated contract imposes additional privacy, security, recordkeeping or incident obligations, we identify and apply the requirements relevant to that work. This policy does not replace those obligations or assume that every private-sector job is governed by the same statutory regime.

3.1 The information needed depends on the enquiry, installation, equipment and functions used. Relevant categories include:

• Identity, contact and site information: names, contact methods, billing and installation addresses, relationship to a property, authorised contacts and relevant keyholders.
• Business records: enquiries, quotations, agreements, approvals, invoices, payment references and status, correspondence, service history, complaints and warranty records.
• Installation information: relevant plans and photographs, camera positions, cable routes, alarm zones, access points, equipment and commissioning records.
• Technical information: models, serial numbers, device and network identifiers, firmware, settings, diagnostic results, errors and device-health information.
• Access information: account identifiers, roles, permissions, support approvals, access times and, only where necessary and authorised, protected credentials or references to them.
• Security-system information: relevant footage, still images, audio, intercom events, alarm events, access logs and number-plate information that we actually handle.
• Website information: submitted fields, enquiry references, preferences and relevant technical or measurement information described in section 14.

3.2 We do not need every category for every customer. Biometric information, health information and other legally sensitive information require additional assessment. Property layouts, occupancy patterns, credentials and vulnerabilities also deserve strong protection because misuse can cause harm, even where they fall outside the legal definition of sensitive information.

3.3 Payment administration can involve amounts, dates, invoice references, payment status and refund records. Ordinary enquiries are not a facility for collecting bank-login details or card security codes. Where a payment service is used, the relevant payment instructions and provider information explain its separate collection process.

3.4 We limit collection to information reasonably needed for an identified, lawful purpose. Government identifiers and identity-document copies are not routine requirements for every request. Where they are necessary, we assess applicable collection, use, disclosure and retention restrictions.

4.1 We generally collect information from you, an appropriately authorised representative, relevant communications, site assessments and equipment we are authorised to work on. We may also receive relevant information from suppliers, technicians, app operators or another lawful source for an identified purpose.

4.2 We use appropriate information to answer enquiries, assess requirements, quote, arrange work, design and install systems, configure authorised accounts, test, maintain and support equipment, administer payments, assist with warranties, investigate complaints and comply with relevant obligations. Where lawful and reasonably necessary, we may use limited information to establish, exercise or defend legal rights.

4.3 These purposes do not authorise unrelated uses. Optional remote services, marketing, publicity and specialised biometric functions require the separate arrangements described below. A materially different use will be assessed and any additional notice, authority or consent obtained before it begins.

4.4 General enquiries may be made anonymously or under a pseudonym where lawful and practical. A reply needs a usable contact method. Site work, billing and security-sensitive requests can require identity, address or authority information. We will explain when missing information prevents a particular service.

4.5 Provide another person's information only where you have a proper basis and it is relevant. Where practical, allow that person to provide it directly. If we receive unsolicited or excessive information, we assess whether it can lawfully be collected and retained and take appropriate steps, including secure destruction or de-identification where required.

4.6 We take reasonable steps appropriate to the purpose to keep information accurate, current, complete and relevant. Please tell us about changes to contacts, authorised users or other details affecting your service. We will check authority again where a sensitive request warrants it.

5.1 Enquiry handling can create records in website systems, our customer relationship management system, email and relevant business records. Information may be linked to an existing customer or site where appropriate. An enquiry can remain a relevant record even if no installation proceeds.

5.2 Permission to answer an enquiry is not acceptance of an installation contract, approval for unrelated marketing or permission to access equipment. Where a form records an acknowledgement or permission version, that record concerns the wording and purpose actually presented.

5.3 Job records can include scope, variations, approvals, commissioning results, relevant work photographs, handover information and outstanding issues. A missing customer signature does not remove an existing privacy or recordkeeping duty.

5.4 Our website records submitted enquiries in a restricted business inbox. Our customer-management system also receives relevant submitted enquiries and acknowledgement records through its connection with the website. These systems keep separate records; changing or deleting one copy does not automatically update every other copy, email or business record. We use the information for the enquiry and relevant service purposes described in this policy. This connection is not a promise of continuous or hourly synchronisation.

6.1 Many systems record to storage controlled by the customer, such as an NVR, DVR, hard drive or SD card. Optional cloud recording, app accounts, connection services and exported copies are separate information flows. Local recording does not establish that no account, connection or diagnostic information leaves the property.

6.2 Installing or maintaining equipment is different from continuously operating or monitoring it. We may need limited live access, test images, playback or a customer-supplied clip for an authorised installation, commissioning task or fault investigation. The access must be relevant, lawful and within the agreed scope.

6.3 Before separately copying or transferring footage for support, we identify the purpose, relevant material, authorised recipient, transfer method and retention or deletion arrangement, subject to any applicable legal requirement. We do not treat routine health services as permission to build a general footage archive.

6.4 Information can be held through possession or control. Whether we hold particular information is not determined only by whether we download it: our rights and practical control over a record or account can also matter. Where a provider stores information for us, we assess our responsibilities rather than automatically redirecting all requests to that provider.

6.5 The customer or another system operator is responsible for its own lawful recording, access, disclosures and later changes. We remain responsible for our own handling and work. Ownership of equipment or property does not give one person every privacy right in the images or information it contains.

6.6 Storage and maintenance records can include the drive model and serial number, known age or installation date, condition and test results, written replacement recommendations and the customer's recorded decision. We distinguish approval, deferral, refusal and a decision still pending. Recording a recommendation or decision does not itself authorise access to footage, formatting, disposal or a waiver of rights that cannot lawfully be excluded. The storage and replacement provisions in our Terms and Conditions explain the service responsibilities.

7.1 Audio recording, live communication, private conversations, private activities and later disclosure can be governed differently. A microphone, two-way intercom or recording feature does not establish that every proposed use is lawful.

7.2 The intended location and use must be assessed, including effects on neighbouring properties, shared areas, tenants, workers, visitors and private residential spaces. A sign or property-owner approval does not automatically authorise every recording or disclosure.

7.3 CCTV audio recording is off by default for our installation and configuration work. We enable it only after a documented lawful basis and separate written instruction identify the devices, purpose and permitted use. We record the agreed settings and may pause or decline a function where authority or lawful use has not been adequately established. This does not certify the current settings of equipment we have not checked or that has subsequently been changed.

7.4 Customers should tell us the intended use and relevant permissions or restrictions. An installation is not certification of every future use. Changes to placement, microphones, analytics, sharing or recording require renewed consideration of the people affected and applicable law.

8.1 Intercom and access-control information can include visitor calls, images, messages, door events, credentials, authorised-user lists and entry or exit records. The information handled depends on the functions enabled and the work requested.

8.2 Human or vehicle detection, face detection, biometric identification or verification, number-plate recognition and ordinary access logs are different functions. Product advertising does not establish which functions are enabled or what information West Protect holds.

8.3 Before we enable a biometric identification or verification function or handle biometric templates for a job, the arrangement must identify the purpose, affected people, necessity, lawful basis, any required consent, enrolment responsibility, storage, access, retention, deletion and an appropriate alternative where needed. A separate notice must address the actual system. A customer's approval is not automatically consent from employees, tenants or visitors. Biometric templates and biometric information used for automated identification or verification receive sensitive-information treatment where applicable. Temporary or local processing can still constitute collection; immediate deletion does not alone resolve the collection requirements.

8.4 Incorrect matches or alerts can occur. Where a system materially affects someone's entry or other interests, appropriate review and an alternative response must be considered. We assess any applicable automated-decision transparency requirements against the actual arrangement.

8.5 Specialised functions and sensitive information are not routinely assumed necessary. The separate notice and permission must be completed before the activity, not used to retrospectively justify it.

9.1 An optional device-health service is separately scoped. For supported customer-owned Dahua devices after handover, relevant DMSS entrustment is obtained for the agreed DoLynk Care service. Commissioning, pre-delivery, loan equipment and other approved platforms require their own documented authority.

9.2 Authorised health work may include status checks, offline or fault information, IP conflicts, storage warnings and reports. It is not automatically continuous human monitoring, emergency attendance or a promise that every problem will be detected.

9.3 A platform category labelled Health Management may technically include repair or control capabilities. The permission displayed by the platform must be considered together with our agreed work. We will use the initial health authority only for the agreed checks and reporting; repair, configuration, system operation and footage access require the additional authority applicable to that task. We do not enable or use automatic repair under an authority limited to checks and reports.

9.4 The entrustment record identifies its period, scope and renewal or withdrawal process. Available choices depend on the actual device, app and account. The duration of permission is not the retention period for reports, logs or other records. We obtain fresh affirmative authority before renewing or extending the agreed health authority.

10.1 Before requesting temporary DoLynk configuration access, we send both an email and a text message identifying the proposed date, time, purpose and duration. The proposal identifies the equipment and task, requested permissions and material effects on recording, alarms, entry or image access. You first approve by replying by email or text; silence is not approval. We do not send the platform request before receiving that reply. We then request your separate approval in DMSS and do not begin until you approve it there. Required DMSS entrustment must already be in place. Any charge must also have been disclosed and accepted; access approval does not accept an undisclosed fee.

10.2 Configuration authority does not automatically include live viewing, listening, playback, exports, account administration or transfer, storage formatting, deletion, factory resets, unlocking doors, arming or disarming alarms, or operating relays. The approval record identifies each required activity and its material effects. Where a sensitive operation is necessary, we obtain specific informed authority and agree suitable safeguards before proceeding.

10.3 Each DoLynk configuration session is limited to the approved task and duration, with a maximum of eight hours per approval and a shorter period where appropriate. Our use of access ends when the task finishes, the approved period expires or authority is withdrawn, whichever occurs first. We stop using the affected access, close the session and remove permissions we control that are no longer needed. The eight-hour maximum is West Protect's service rule, not a claim that every app or device automatically removes access at that time. Longer technical permissions do not enlarge the work you authorised. We record any remaining technical step or customer action needed to remove access.

10.4 You may withdraw authority through the applicable account controls or contact us using section 1. The steps and technical effect depend on the service and device; we will assist with relevant permissions we control. Withdrawal ends future reliance on that authority, but does not automatically delete records already lawfully held or cancel a separate billing arrangement. During an active session, we agree how to reach the technician. You may also use any available platform revocation controls. Their technical effect and timing depend on the service and device, and email or SMS delivery does not guarantee instant removal of a platform permission. These contact channels are not continuously monitored emergency services. Once we become aware of withdrawal, we stop using the affected access and act on the remaining removal steps.

10.5 A change to the approved date, time, task, permissions or duration requires a new email and text notice, fresh reply approval and separate DMSS approval. An unsuccessful attempt or unfinished task does not extend permission automatically. We do not bypass a refusal by using a stored password or asking for a personal account password or one-time verification code. Another remote-support method needs a separately agreed purpose, suitable identity verification, access controls and ending arrangements; it cannot be used to bypass the agreed approvals. Any broader notice requirement, shorter access period or stricter approval requirement in an existing accepted agreement continues to apply.

10.6 We keep a proportionate record of the approver, authority, purpose, permission, period, work, relevant copies and closure. Permission to obtain a health report is distinct from permission to change the system or retain footage.

11.1 Customer-controlled accounts and suitable individual roles should be used where supported. Installer or service access is limited to the approved purpose. Any necessary handling of credentials uses the approved protected process, not ordinary public enquiry forms.

11.2 We verify the authority appropriate to account recovery, credential disclosure, ownership transfer, adding users and removing access. Paying an invoice, possessing a device or being a former contact is not by itself proof of entitlement to all information or control.

11.3 Property sales, tenancy changes, business transfers, staff departures, lost devices and disputed instructions may require additional checks. We consider safety risks, including family violence and coercive control. We do not automatically notify an existing contact where doing so could expose a protected person or defeat a lawful safety restriction.

11.4 We retain credentials only where an identified service and lawful purpose justify it, restrict access and review continuing need. Ending a service triggers a review of installer permissions, retained credentials and handover arrangements. We do not use unrelated equipment or private information as a debt-collection lever.

11.5 Where proportionate identity or authority checks cannot be completed, instructions conflict, or we reasonably identify a material risk of unauthorised access or harm, we may pause the affected disclosure or system action while the issue is assessed. We may decline an action that we cannot lawfully or safely perform. We seek only evidence reasonably needed for the check and may use an independently verified contact route. We explain an appropriate next step where safe and lawful. This does not suspend an unrelated agreed service, remove an obligation the law requires us to perform or extend an applicable legal deadline for responding to an information request.

12.1 Business and equipment services can involve hosting, databases, email, document storage, payment services, manufacturer platforms, app notifications, diagnostics and optional integrations. The provider, information and purpose must be identified for the arrangement actually used.

12.2 Local recording, app registration, connection or relay services, live streams, diagnostics, exported clips and enabled cloud recording are separate flows. A provider's privacy policy does not remove our responsibility for our own disclosures, configuration or handling.

12.3 Information may be stored, accessed or otherwise handled outside Australia. We assess the actual arrangement, whether handling is a use or disclosure under applicable law, and the steps required. We do not promise Australian-only storage or treat acceptance of this policy as a general waiver of overseas protections.

12.4 The provider and overseas-information schedule below describes the principal website, business and supported-device services relevant to this policy. It distinguishes known functions and provider-published country information from a verified location for an individual account or record. A provider's headquarters or the location of your recorder does not establish where every related service processes information.

12.5 Some exact account, support, backup and subcontractor locations are not confirmed for each information category. We describe that uncertainty rather than promise an Australian-only service. You can ask us about a particular provider or proposed transfer before using an optional feature. We will provide the relevant information available to us, assess any applicable overseas-disclosure requirements and identify material restrictions that affect the proposed arrangement. Accepting this policy is not a general waiver of overseas privacy protections.

12.6 Optional smart-home, voice, mobile/SIM and other integrations require their own relevant assessment. If you decline or disable an optional service, we will explain the functions affected. We cannot undertake to delete information held independently by another provider, but will address information we possess or control and assist where appropriate.

13.1 Where relevant and lawful, limited information may be disclosed to authorised personnel, subcontractors performing agreed work, suppliers or manufacturers handling a fault, IT or payment providers, professional advisers, insurers, regulators or another permitted recipient.

13.2 We consider what the recipient needs, any authority or restriction, an appropriate transfer method and relevant confidentiality or security arrangements. Naming a recipient category does not authorise disclosure of an entire customer file.

13.3 Police, court, regulator, insurer and emergency requests are assessed against their actual authority and applicable law. An informal request is not automatically a legal obligation. We consider proportionality, other people's information, lawful redaction and any restriction on notifying an affected person.

13.4 A genuine business transfer may involve limited information where lawful, with appropriate safeguards and notice where required. It is not unrestricted permission to sell a customer list for unrelated purposes. No unrelated marketing disclosure is authorised merely because information was supplied for a job.

14.1 Website enquiries collect the fields you submit and the relevant reference, context or acknowledgement needed to handle the request. These can include a name or alias, suburb, email or telephone number, preferred response method, requested service and relevant project, organisation, referral or callback details. The ordinary enquiry form does not require a full street address or offer a file-upload field. Do not put passwords, access codes, payment security codes or unnecessary sensitive information in the message.

14.2 Hosting and security services can process technical request information, including network or browser details and request times. Our enquiry service uses network and submission identifiers to prevent abuse and duplicate requests, including an identifier derived from the connecting IP address. Necessary security processing is distinct from optional browsing measurement or advertising. A hashed identifier is not necessarily anonymous.

14.3 Our optional address and rebate checker sends partial address text as you type and a selected address through our website to Esri/ArcGIS lookup services. Coordinates are used with a boundary service to identify the relevant council. This can happen before an enquiry is submitted and is separate from optional website measurement. The Esri geocoding service used for this lookup is described in its documentation as hosted in the United States. The lookup itself does not create a submitted West Protect enquiry. If you submit a checker callback request, the selected or supplied address, council, relevant rebate answers and indicative result or context become part of that enquiry, together with the contact fields you submit. To avoid the automatic address lookup, use our ordinary enquiry form, email or telephone before entering an address in the checker. Switching to manual help after typing does not recall information already transmitted. Provider request handling and retention are separate from the application's enquiry records.

14.4 Where an optional feature collects information, its notice and choice must be available at the appropriate time. Refusing optional marketing or measurement should not be treated as refusal of an unrelated necessary service. Browser controls may affect functions, but do not erase an enquiry already submitted or records lawfully retained.

14.5 Social platforms and external services may handle interactions under their own policies. We remain responsible for information we receive or use. We will assess new integrations and any additional notice or consent needed before enabling a materially different use.

14.6 Optional first-party website measurement starts off and requires your choice to allow it. It records selected page and interaction events, approved campaign context and aggregate activity; its event payload excludes enquiry-message contents, email addresses and telephone numbers. Necessary enquiry handling and security processing continue independently. The website's measurement controls honour browser Do Not Track and Global Privacy Control signals. Declining measurement does not prevent you from making an enquiry or disable an address lookup you choose to use.

14.7 A cookie and browser local storage retain the measurement preference. The cookie has a one-year lifetime; local storage remains until changed or cleared. Approved campaign context can be held in session storage while measurement is allowed. You can change the website's available measurement preference control or clear browser storage. These actions do not erase separately submitted enquiries. Measurement uses a one-hour cleanup threshold for individual event receipts and thirteen months for daily totals. Cleanup runs through event or report processing, so deletion is not guaranteed at an exact elapsed moment. These measurement periods do not describe all enquiry records, provider security logs or backups.

15.1 Messages needed to answer an enquiry, administer a job or address a relevant service issue are distinct from promotional marketing. A message's actual content determines its treatment; calling a promotion a service message does not remove applicable requirements.

15.2 We send electronic marketing with your consent, including validly inferred consent only where applicable law permits it and the circumstances support it. We identify the sender and provide a practical unsubscribe method. An enquiry or installation does not provide universal permission for unrelated promotions.

15.3 We will action marketing unsubscribe requests within five working days. The facility will remain functional for at least 30 days after the message, without requiring login or unnecessary information or charging a fee beyond the ordinary cost of sending the request. Limited suppression records may be kept to honour your preference. Phone marketing is subject to its own applicable requirements.

15.4 Photographs needed for quoting, commissioning, support or a dispute are not automatically advertising assets. Identifiable testimonials, images, footage and case studies require a separate, specific publication arrangement and consideration of other people's rights and security risks.

15.5 Publication permission identifies the material and channels. Withdrawal applies to future uses within our control and prompts reasonable removal steps, subject to the agreed scope and law. We cannot promise retrieval of every lawfully distributed printed copy or independent third-party copy. Withdrawal does not justify continuing new promotional use.

16.1 We take reasonable technical and organisational steps appropriate to the information and risk, including necessary access restrictions and appropriate handling, transfer, device and physical-record arrangements. This does not mean every system or copy has identical controls or that any system is completely secure.

16.2 Business records can exist across operational systems, communications, attachments, technician devices, exports and backups. Authorised people must use information for the relevant purpose and keep security details confidential. Supplier processing does not mean that only one individual can technically access every infrastructure component.

16.3 We review access when a service ends or responsibility changes. Before collecting customer information requiring special handling, such as recordings, credentials or detailed security plans, we agree a suitable transfer and storage method for the authorised purpose. Contact us before supplying that material through a new channel. If your job requires a particular storage region, access restriction or retention period, tell us so that we can assess the requirement before accepting the arrangement.

17.1 Retention depends on the information, purpose, applicable law, service needs, justified warranty or dispute requirements and commitments already made. We do not apply one period to invoices, credentials, temporary recordings, biometric templates and technical logs.

17.2 Prescribed WA security-business records must be preserved for at least three years after the last entry in the record. These prescribed records must be available for lawful inspection and produced in a readable form when lawfully required. Statutory requirements also apply to the premises where those records are preserved, notification of those premises and written licensing-officer approval for premises outside Western Australia. Tax and financial records follow their own rules, commonly at least five years for applicable tax records, with exceptions. These requirements do not justify keeping all footage, biometric templates or passwords for those periods, and using a cloud service does not remove the applicable record-location requirements.

17.3 We limit temporary material and review continuing need. When information is no longer needed for a permitted purpose and no applicable retention requirement or lawful hold applies, we take reasonable steps to securely destroy or de-identify it.

17.4 An actual dispute or claim, a reasonably anticipated legal proceeding supported by an identifiable basis, or a legal obligation may justify a limited preservation hold where retaining the particular information is lawful and reasonably necessary. We identify its scope and reason, restrict access and review continuing need. This is not authority to keep unrelated information, retain information indefinitely against a merely speculative claim, or retrospectively override a binding narrower promise.

17.5 Deletion from one record does not remove every email, export, attachment, history or backup. We assess relevant copies and provider capabilities. Backup information may remain through a necessary recovery cycle under restrictions. A restoration must take account of implemented corrections, deletions and access restrictions before information is reused. Archiving or hiding a record is not necessarily deletion. We distinguish removal from ordinary view, withdrawal of access and secure disposal when assessing a request or the end of a service.

17.6 Customer recorder overwrite settings and manufacturer log retention are separate from our business-record retention. An entrustment duration is not a deletion deadline.

18.1 Equipment can retain footage, account bindings, credentials, user lists, biometric templates and configuration information. Before a return, repair, replacement or disposal, we assess the relevant storage and account information.

18.2 We explain material known risks and agree the appropriate handling: necessary export or backup, preservation, removal of storage, reset, verified sanitisation where feasible, restricted diagnostic access or secure disposal. Before deliberately erasing or overwriting information, we obtain appropriate authority and consider any preservation obligation. We explain material known risks of unintended loss during repair or replacement. Approval of a repair does not waive rights or obligations that cannot lawfully be excluded.

18.3 A factory reset does not necessarily sanitise every storage medium. Failed media may not be erasable. Where a supplier needs data-bearing equipment, we identify the recipient, purpose, information and available alternatives rather than treating a warranty request as unlimited permission to disclose.

18.4 Transfer and disposal records should identify the equipment, relevant storage, approvals, recipient, custody and outcome without unnecessarily copying the underlying private information.

19.1 Contact us to request access to, correction of or deletion of personal information we hold. We may ask for proportionate information to verify identity, authority and scope. We do not require excessive identification simply because a request is inconvenient.

19.2 We respond within a reasonable period and meet applicable legal requirements. Where more information or time is needed, we explain the reason and next step. Information held through a service provider or under our control is considered as part of our response.

19.3 A request involving footage may require narrowing the time or location, protecting other people, redaction or another suitable form of access. We do not automatically release a complete recording. Where we do not possess or control the requested information and another independent system operator holds it, we explain our role and an appropriate contact route where available.

19.4 We do not charge to make an access or correction request. Any permitted charge for providing access must not be excessive and will be explained beforehand. Corrections and required associated statements are not charged. We explain lawful refusals or restrictions and available complaint options.

19.5 We assess corrections to ensure information is accurate, current, complete, relevant and not misleading for its purpose. Where required, we notify relevant recipients or associate a statement if a correction is disputed. Necessary original evidence may be annotated rather than silently rewritten.

19.6 Withdrawal of consent and deletion are separate matters. We will assess deletion requests and explain any justified retention, legal hold or practical backup limitation. There is no automatic entitlement to erase every record despite another applicable obligation, and that limitation is not a reason for indefinite unnecessary retention.

19.7 A request for personal information does not itself give access to our business systems or unrelated records. We provide access in the requested manner where reasonable and practicable, and may use an extract, redacted copy or another lawful and suitable method where appropriate. Information about other people, legally privileged material and other protected information may be withheld only to the extent an applicable lawful ground permits it. A confidentiality label alone does not justify withholding personal information that must be provided. Where access is restricted, we consider reasonable alternatives and explain the applicable reason and complaint route as required.

20.1 Raise a privacy concern with Jayke using section 1, identifying the issue and a safe way to contact you. We record and assess the concern, obtain necessary information, take appropriate action and provide an outcome or progress update within a reasonable time.

20.2 Where the Office of the Australian Information Commissioner has jurisdiction, you may complain through oaic.gov.au. Its usual guidance is to first raise the matter with the organisation and generally allow 30 days for a response. The WA Office of the Information Commissioner, another regulator or a court may have a role where its jurisdiction applies, including to particular government work. Exercising a legal right is not conditional on accepting this policy.

20.3 We assess suspected loss, unauthorised access or disclosure, misuse, compromised credentials and relevant supplier incidents; take appropriate containment and mitigation steps; and preserve necessary evidence securely.

20.4 Where the federal Notifiable Data Breaches scheme applies, we conduct a reasonable and expeditious assessment of a suspected eligible breach and take all reasonable steps to complete it within 30 calendar days after we become aware of reasonable grounds to suspect that an eligible data breach may have occurred. We notify the OAIC and affected individuals as soon as practicable when required. The assessment period does not permit delay after notification is required. Other contractual or statutory incident obligations may apply to particular work.

20.5 WA government work may carry contractual privacy and incident-reporting obligations and, where the relevant statutory conditions are met, obligations under the Privacy and Responsible Information Sharing Act 2024. The Act's mandatory data-breach notification provisions commence on 1 January 2027. For covered contracted-service-provider work under that regime, we report to and assist the responsible outsourcing entity, which carries the statutory duties to notify the WA Information Commissioner and affected individuals when required. Applicable contractual reporting obligations may already apply before that date.

21.1 We consider children, capacity, accessibility, health information and safety concerns in the relevant circumstances. A request for accessible equipment does not ordinarily require a diagnosis or full medical history. We seek only relevant information and the appropriate authority or consent.

21.2 Incidental recording of a child does not itself authorise publicity or biometric enrolment. Parent, guardian, employer or property-owner involvement must be assessed against the actual rights, authority and purpose.

21.3 Relevant applicant, worker and contractor records are handled for their identified employment, engagement, licensing or safety purpose. We do not assume that every workforce record is exempt from privacy requirements. Any separate personnel notice addresses the actual arrangement.

21.4 Copies of identity documents, private residential/contact details and non-public personnel records are not included in public materials. This does not prevent lawful publication or disclosure of business and licence particulars or compliance with a legal requirement. Protecting Jayke's or another worker's private information does not restrict a lawful complaint, access request or disclosure to an authorised regulator.

22.1 Updated versions identify their date and apply prospectively. A change does not backdate consent, validate earlier unlawful handling or silently remove an existing contractual promise.

22.2 If a new purpose, technology, provider or materially different activity requires fresh notice, authority or consent, we address it before proceeding. Replacing the website policy alone is not permission for an unrelated use.

22.3 The current policy is available in full on this page. Contact us for a free copy, an accessible format or clarification about an arrangement. Read the provider and overseas-information schedule and any relevant collection notice with this policy. Our Terms and Conditions explain the agreed services, customer responsibilities and applicable remedies; neither document grants unlimited access to your equipment or information.

This schedule forms part of the policy published on 8 November 2026. It describes principal services used for the functions below. A service may handle different information depending on the feature you use. Provider-published country information is distinguished from the confirmed route of a particular account, device or record. We do not promise that every service, support process or backup remains in Australia.

Website and customer management

Service and information: OpenAI Sites and relevant Cloudflare infrastructure host the West Protect website and restricted customer-management application. The services handle submitted enquiries, relevant customer and job records, business files where used, technical request information and relevant preferences. The website and customer-management system maintain separate copies of transferred enquiry information.

Overseas information: OpenAI's published subprocessor information identifies Cloudflare web hosting in the United States. Its Sites guidance also describes supported US or European Union regional arrangements for some workspaces and new Sites. The precise location of these existing projects and all associated support, processing and backups has not been confirmed for each information category; the availability of a regional option does not establish that it applies here. Overseas handling, including in the United States, may therefore occur. We do not offer Australian-only hosting through this policy.

Your choice: You may contact us by telephone or email instead of completing a website form. Necessary enquiry and job records can still enter our business systems. Tell us about a specific location or handling requirement before supplying information that depends on it.

Provider information: OpenAI Sites data protection guidance and OpenAI subprocessor list.

Address and council lookup

Service and information: Esri/ArcGIS receives partial and selected address information for geocoding. A boundary service receives relevant coordinates to identify the council area. Processing can start while you type in the optional rebate checker, before an enquiry is submitted. A separately submitted callback includes the supplied address and relevant result or context in West Protect's enquiry record.

Overseas information: Esri's documentation describes the geocoding endpoint used for this lookup as hosted in the United States. The provider may also handle technical request information under its service terms and privacy information. This policy does not promise a particular deletion time for provider logs or identify every support or boundary-service processing location.

Your choice: Use our ordinary enquiry form, telephone or email before typing into the checker to avoid the automatic lookup. Declining website measurement does not turn off a lookup that you choose to use, and switching to manual help later does not recall previous requests.

Provider information: ArcGIS geocoding service endpoints and Esri privacy information.

Business email and documents

Service and information: Google services are used for relevant business correspondence, documents and attachments. The information depends on the communication or document involved. A customer's device recordings are not automatically transferred to Google merely because West Protect installs or services the device.

Overseas information: Google describes processing on servers in countries around the world, which can include the United States and countries outside Australia. Exact storage, support and backup locations depend on the account, service and applicable arrangement and have not been confirmed for every business record. We do not claim that all Google-held information is stored in Australia or within one selected region.

Your choice: Ask for an appropriate communication or transfer method before sending sensitive material. We will assess the available options and any agreed handling requirements. Avoid sending credentials or unnecessary footage in ordinary email.

Provider information: Google Privacy Policy.

DMSS and DoLynk Care

Service and information: Supported Dahua apps and services handle relevant account, device, connection, notification, entrusted health and authorised support information. Live video, playback, exported recordings, cloud storage and specialised controls depend on the actual enabled functions and permissions. This entry does not mean that every recording is uploaded or that health reporting authorises footage access.

Overseas information: The provider policies identify Dahua Technology (HK) Limited as the operator outside the EU and UK. They describe possible servers in the United States, Germany, Singapore and Malaysia. These are provider-level locations, not a verified route for each Australian account, device or information category. The terms and settings presented for the actual account and service must also be considered.

Additional provider services: The DMSS policy identifies Beijing Volcano Engine analytics, Alibaba Cloud voice services, Apple Pay and Google Pay. The DoLynk Care policy identifies Oceanpayment for payments and describes Beijing Volcano Engine analytics for countries and regions where that function is enabled. These are provider-disclosed services; their use for a particular account or feature has not been confirmed by West Protect. The countries listed above are not an exhaustive statement of the processing locations for these additional services. The applicable provider notices and account settings should be considered when choosing and using those functions.

Retention: The manufacturer policies describe retention according to the relevant purposes and applicable law; they do not give a universal deletion deadline when entrustment expires or is withdrawn. Relevant service terms and settings may specify additional periods. Ending installer access is separate from deleting provider records, customer recordings and copies already made. Section 17 explains how we assess the retention and deletion of information we hold.

Your choice: Agree optional app, cloud and health-service arrangements separately. If you decline or withdraw an optional permission, the functions that depend on it may be unavailable. We explain the supported arrangement and relevant effect before proceeding. Temporary configuration access follows section 10 even if the platform technically offers broader permission.

Provider information: DMSS Privacy Policy and DoLynk Care Privacy Policy.

Other services relevant to a particular job

Payments, accounting, SMS delivery, social messaging, mobile or alarm SIM services, monitoring, smart-home integrations, optional cloud recording and specialist support can involve additional providers when those services are actually used. The relevant instructions, quote, collection notice or service arrangement should identify the provider, purpose, information and material overseas handling applicable to that service. This category does not mean that all listed services are enabled or that you have agreed to them by reading this policy. We assess a materially different service or disclosure before enabling it and provide any additional notice or choice required.

Provider notices can change. Contact Jayke if you need the information available to West Protect about a particular recipient, location or proposed transfer. A provider's separate policy does not remove West Protect's responsibility for its own handling, disclosures or agreed limits.