Privacy Policy

Effective date: 12 October 2026

Data League Pty Ltd (“DATA LEAGUE”, “we”, “us” or “our”) is a data and AI consultancy based in Perth, Western Australia. We are committed to protecting your privacy and handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy explains how we collect, use, disclose and protect personal information when you visit dataleague.com.au, use our online tools, contact us, apply to work with us, or engage us as a client.


Information we collect

The types of personal information we collect depend on how you interact with us. They may include:

  • Contact details – name, email address, phone number, job title and organisation.
  • Enquiry and engagement information – details you provide about your project, requirements and organisation.
  • Assessment responses – answers you give in our online tools (for example the Data Maturity Assessment) and the results generated from them.
  • Recruitment information – CVs, work history, qualifications, work rights and referee details if you apply for a role through our Careers page. Applications and CVs are stored in our Microsoft Dynamics 365 environment in Australia, and only our hiring team can see them.
  • Partnership enquiries – your name, contact details, organisation and proposal if you contact us through our Become a Partner page. These are kept separately from sales enquiries.
  • Technical and usage information – IP address, browser and device type, pages visited, referring site and interactions with our website, collected through cookies and similar technologies.
  • Questions to our website assistant – the messages you type into Datum, our website assistant. We don’t keep them: see Datum, our website assistant.

We do not intentionally collect sensitive information (such as health information or information about racial or ethnic origin). If you provide it to us, we will only handle it with your consent or where permitted by law.

You can browse our website without identifying yourself. If you choose not to provide information we request, we may be unable to respond to your enquiry or provide our services.


How we collect personal information

We collect personal information directly from you when you complete a form, use an online tool, email or call us, attend our training or workshops, or engage us for services. We may also collect it from your employer when they engage us, from publicly available sources such as professional networking sites, and from our technology partners where you have asked to be connected with us.


How we use your information

We use personal information to:

  • respond to enquiries and provide quotes, proposals and the services you request;
  • deliver online tools such as the Data Maturity Assessment and the reports you request;
  • manage client relationships, projects, invoicing and contractual obligations;
  • deliver training and workshops;
  • assess job applications and consider you for current and future roles;
  • respond to partnership enquiries;
  • operate, secure and improve our website and understand how it is used;
  • send you insights, event invitations and service updates where you have agreed or where permitted by the Spam Act 2003 (Cth); and
  • comply with our legal, regulatory and professional obligations.

We will only use or disclose personal information for a secondary purpose where you would reasonably expect it, where you have consented, or where the law permits it.


Client data in consulting engagements

During consulting engagements we may access or process data owned by our clients, which can include personal information about their customers, staff or other individuals. In these cases we act on our client’s instructions and handle that data in accordance with the confidentiality, security and data handling terms of our engagement agreement and applicable law.

We apply the principle of least privilege, prefer to work within our clients’ own environments, use de-identified or sample data where practical, and return or securely delete client data at the end of an engagement unless otherwise agreed. Questions about how a client handles your information should be directed to that organisation.


Training bookings and payments

When you book a public training course, we collect your name, email, phone number, organisation, job title and purchase order number (if any), the names and email addresses of the people attending, and any notes you add, such as dietary or accessibility needs. We use this to manage the booking, contact attendees about the course, issue tax invoices and certificates, and keep the records the law requires.

Booking records are kept in our booking system on Microsoft Azure and in our Microsoft Dynamics 365 environment, both hosted in Australia. Card payments are processed by Stripe on its own secure checkout page: your card details go directly to Stripe and we never see or store them. We share only the payer’s email address, the booking reference and the amount with Stripe. Stripe handles payment information under its own privacy policy and may process it outside Australia.

After the course. We record who attended, and email each attendee a certificate of completion with a unique certificate ID. Anyone who has that ID (for example, from a certificate you share on LinkedIn or with an employer) can check it on our certificate check page, which shows your name, the course, its dates and when the certificate was issued. We also invite attendees to give feedback. Feedback is optional and is used to improve our courses. We only publish a quote with your permission, in the form of name you choose, and our training statistics show totals only: any group of fewer than 5 people is combined or hidden so no one can be identified.


Datum, our website assistant

Datum is an AI assistant that answers questions about DATA LEAGUE from the content of our website and our public training schedule. It runs on Microsoft Azure OpenAI in Microsoft’s Australia East region, so your questions are processed in Australia.

  • We don’t store conversations. Your questions and Datum’s answers are not saved in our systems or linked to your identity, and we don’t log what you type.
  • Your browser keeps the conversation in its session storage while the tab is open, so it carries over as you move between our pages. Closing the tab, or choosing “New conversation”, clears it.
  • Microsoft’s abuse monitoring. As part of the Azure OpenAI service, Microsoft may keep questions and answers for up to 30 days, within the Azure geography, solely to detect and prevent misuse of the service. Microsoft does not use them to train AI models.
  • Spam and abuse protection. The first time you ask a question, Cloudflare Turnstile checks that you’re a person, and we use your IP address briefly to limit how many questions can be asked.
  • Please don’t share personal information in the chat. Datum can’t take messages or pass on your details; to get in touch, use our contact page.

Datum’s answers are generated automatically and can be wrong. Please confirm anything important with us before relying on it.


Cookies and analytics

Our website uses cookies and similar technologies to keep the site working, understand how visitors use it and measure the effectiveness of our content. We use:

  • Google Tag Manager and Google Analytics to measure website traffic and usage;
  • Session storage for Datum, our website assistant, which keeps your conversation in your browser until you close the tab (it is not a cookie and is never sent to us except as part of your next question);
  • Microsoft Dynamics 365 Sales to receive and manage enquiries and assessment report requests; and
  • Cloudflare Turnstile to protect our forms from spam and abuse. Turnstile checks signals from your browser to confirm a real person is submitting the form.

You can block or delete cookies through your browser settings, and you can opt out of Google Analytics using the Google Analytics opt-out browser add-on. Blocking some cookies may affect how the website works.


Who we share information with

We do not sell personal information. We may disclose it to:

  • service providers who help us run our business, such as cloud hosting (Microsoft Azure), customer relationship management (Microsoft Dynamics 365), payment processing for training bookings (Stripe), form spam protection (Cloudflare), our website assistant (Microsoft Azure OpenAI, hosted in Australia), analytics (Google), email and collaboration tools;
  • technology partners such as Microsoft, Databricks, Snowflake, dbt Labs and OvalEdge, where needed to deliver a solution you have asked for;
  • subcontractors and specialists engaged on your project, who are bound by confidentiality obligations;
  • professional advisers such as lawyers, accountants and insurers; and
  • government agencies, regulators or law enforcement where required or authorised by law.

We require our service providers to protect personal information and use it only for the purpose for which we disclose it.


Overseas disclosure

Some of our service providers store or process information outside Australia. Depending on the service, this may include the United States, the European Union, India, Singapore and other countries where those providers or their infrastructure operate. Where possible we choose Australian data centres; for example, our Microsoft Dynamics 365 environment is hosted in Australia.

Before disclosing personal information overseas we take reasonable steps, as required by APP 8, to ensure the recipient handles it in a way that is consistent with the Australian Privacy Principles.


Online tools and automated processing

Our Data Maturity Assessment and Microsoft Fabric cost calculator calculate results automatically from the answers and values you enter. The results are indicative guidance only. They are not used to make decisions that significantly affect your rights or interests, and we do not make solely automated decisions of that kind about individuals.

If you request an assessment report, we record your contact details and your assessment results in our CRM so a consultant can follow up. Calculator inputs are processed in your browser and are not sent to us unless you choose to contact us.


Marketing communications

We only send marketing emails where you have consented or where we are otherwise permitted to by law. Every marketing email includes a simple way to unsubscribe, and you can opt out at any time by emailing info@dataleague.com.au.


Security and data breaches

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Our measures include encryption in transit, multi-factor authentication, role-based access controls, security-reviewed cloud services and staff confidentiality obligations.

If we experience a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

No method of transmitting or storing information over the internet is completely secure. Please contact us immediately if you believe your information has been compromised.


Retention

We keep personal information only for as long as we need it for the purposes described in this policy, or as required by law (for example tax and corporate record-keeping obligations). Enquiry and assessment records are generally kept for up to three years after our last contact with you, training booking and payment records for five years (as tax law requires), and unsuccessful job applications for up to twelve months. When information is no longer needed we securely destroy or de-identify it.


Access, correction and your choices

You may request access to the personal information we hold about you, ask us to correct it, or ask us to delete it where we are not required to keep it. We will respond within 30 days. We may need to verify your identity, and in limited circumstances permitted by the Privacy Act we may decline a request, in which case we will explain why.

If you are located in the European Union or United Kingdom, you may also have rights under the GDPR or UK GDPR, including the right to object to processing and to data portability. Contact us to exercise these rights.


Complaints

If you have a concern about how we have handled your personal information, please contact us first so we can try to resolve it. We will acknowledge your complaint promptly and aim to respond within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.


Changes to this policy

We may update this policy to reflect changes in our practices, technology or the law. The current version will always be published on this page with its effective date.


Contact us

Privacy Officer, Data League Pty Ltd
Perth, Western Australia
Email: info@dataleague.com.au
Phone: +61 491 697 803