⚠ Do now
This Privacy Policy explains how Wildfire Data Recovery collects, uses, stores and protects your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Viktor Burcevski trading as Wildfire Data Recovery (ABN 79 664 657 376) is committed to protecting your personal information in accordance with Australian privacy law. As a data recovery and digital forensics laboratory, we understand the sensitive nature of the information entrusted to us and take our privacy obligations seriously. This policy should be read alongside our Cookie Policy, our Terms of Service and our No Data No Fee Policy.
Wildfire Data Recovery is a Brisbane-based data recovery and digital forensics laboratory servicing clients throughout Australia. We specialise in recovering data from damaged, failed or corrupted storage devices including hard drives, solid-state drives (SSDs), RAID arrays, USB flash drives, memory cards and mobile devices.
We also provide forensic data recovery services for legal proceedings, insurance claims and corporate investigations. Our services are used by individuals, businesses, government agencies, legal firms and law enforcement organisations. Learn more about our team and our recovery process.
This Privacy Policy is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act. These laws regulate how organisations collect, use, store and disclose personal information.
The 13 Australian Privacy Principles cover:
Open and transparent management of personal information, and anonymity
Collection of solicited and unsolicited personal information, and notification
Use, disclosure and direct marketing
Cross-border disclosure of personal information
Adoption, use or disclosure of government related identifiers
Quality and security of personal information
Access to personal information
Correction of personal information
Under APP 3, we only collect personal information that is reasonably necessary for our data recovery services and business functions. The types of information we collect depend on the nature of your interaction with us.
Information that identifies who you are
| Data Type | Examples | Why We Collect It |
|---|---|---|
Full name | First name, surname, title | To identify you and address correspondence correctly |
Contact details | Email, phone number, postal address | To communicate about your job and return your device |
Business details | Company name, ABN, position or role | For business clients, invoicing and legal compliance |
Information about the storage device you submit for recovery
| Data Type | Examples | Why We Collect It |
|---|---|---|
Device details | Make, model, serial number, capacity | To identify and track your device throughout the recovery process |
Fault description | Symptoms, history of the failure, physical damage | To diagnose the issue and determine the recovery approach |
Access credentials | Passwords, PINs, encryption keys (if provided) | To access encrypted devices for data recovery (stored securely, deleted after job completion) |
The actual data we recover from your device
| Data Type | Examples | Our Approach |
|---|---|---|
Recovered files | Documents, photos, videos, databases, emails | We do not access, view or analyse your personal files beyond what is necessary to verify a successful recovery |
File metadata | File names, sizes, dates, folder structure | Used only to generate the file listing you review to confirm recovery success |
Information required for payment processing
| Data Type | Examples | Security Measures |
|---|---|---|
Payment details | Card payments (via secure gateway), bank transfer details | We do not store full card numbers. Card payments are processed by PCI DSS compliant payment gateways (Square, PayPal) |
Billing information | Invoices, payment history, ABN | Retained for 7 years as required by Australian tax law (ATO requirements) |
Information collected automatically when you visit our website (see our Cookie Policy)
| Data Type | Examples | Purpose |
|---|---|---|
IP address | Your internet protocol address | Security, fraud prevention and approximate location for analytics |
Browser data | Browser type, version, operating system | To optimise our website for your device and browser |
Usage data | Pages visited, time on site, referral source | To improve our website and understand how visitors find us |
Under APP 3.3, "sensitive information" includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record and biometric data. We do not set out to collect sensitive information. It may be present inside your recovered data (which we do not access or view beyond recovery verification), or it may be necessary for forensic services carried out under a court order, warrant or other lawful authority.
In accordance with APP 3.5, we collect personal information only by lawful and fair means. We primarily collect information directly from you, but may also receive information from third parties in certain circumstances.
When you complete our enquiry forms or client portal, call us, email us or visit us in person
Automatically through cookies and analytics when you browse our site (see our Cookie Policy)
Referrals from IT companies, legal firms, insurers or other service providers (with your consent)
Shipping details when you send your device to us via Australia Post, StarTrack or another carrier
Under APP 6, we only use your personal information for the primary purpose for which it was collected, for secondary purposes that are directly related and reasonably expected, or with your consent.
The main reasons we collect and use your information
| Purpose | Description | Legal Basis (APP) |
|---|---|---|
Service delivery | To provide the data recovery and forensic services you have requested | APP 6.1: primary purpose |
Communication | To contact you about your job status, provide estimates and answer enquiries, including SMS job updates | APP 6.1: primary purpose |
Billing and payments | To process payments, issue invoices and manage accounts | APP 6.1: primary purpose |
Device tracking | To track your device through our recovery process and maintain chain of custody | APP 6.1: primary purpose |
Legal compliance | To comply with Australian laws, regulations and court orders | APP 6.2(b): required or authorised by law |
Related purposes you would reasonably expect
| Purpose | Description | Legal Basis (APP) |
|---|---|---|
Service improvement | To improve our services, processes and website | APP 6.2(a): related secondary purpose |
Analytics | To analyse website usage and marketing effectiveness (anonymised where possible) | APP 6.2(a): related secondary purpose |
Feedback requests | To request reviews or testimonials after service completion | APP 6.2(a): related secondary purpose |
Under APP 7, we may use your personal information for direct marketing only if you have consented, or if you would reasonably expect us to use your information for this purpose and we provide an easy opt-out mechanism.
We comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth) for all marketing communications.
Service updates, relevant data protection tips and information about our data recovery services (only with your consent or to existing clients)
We do not send unsolicited marketing to people who have not engaged with us, and we never share your details with third parties for their marketing
You can opt out of marketing communications at any time by:
We will action your request within 5 business days as required by the Spam Act.
Under APP 6, we may disclose your personal information to third parties only for the purposes described in this policy, with your consent, or as required or authorised by law.
Australia Post and StarTrack for device shipping and prepaid return labels
Australia Post PrivacyClickSend for job status text messages sent from our client portal
ClickSend Privacy PolicySecure Australian-based cloud storage for business records
Australian data centres onlyCircumstances where we may be required to disclose information
| Circumstance | Authority | Legal Basis |
|---|---|---|
Court orders | Australian courts and tribunals | APP 6.2(b): required or authorised by law |
Law enforcement | Queensland Police, AFP and other agencies acting with lawful authority | APP 6.2(e): enforcement related activity |
Regulatory bodies | OAIC, ACCC, ATO, ASIC | APP 6.2(b): required or authorised by law |
Serious threats | Emergency services and relevant authorities | APP 6.2(c): lessen or prevent a serious threat to life, health or safety |
Under APP 8, before disclosing personal information to an overseas recipient, we must take reasonable steps to ensure the recipient handles it in line with the Australian Privacy Principles, or obtain your informed consent.
Recovery work is performed in our own Australian laboratory, and we use Australian-based servers for any digital storage of recovered data. In the rare case where a device needs a specialist partner laboratory overseas, we tell you first, obtain your written consent before the device or any image of it leaves our custody, and document the chain of custody for the whole journey. Without that consent, your recovered files do not leave Australia.
Some of our service providers (such as Google Analytics and payment gateways) may store limited data overseas. Where this occurs:
Third-party services that may process data overseas
| Service | Data Type | Countries |
|---|---|---|
Google Analytics | Website usage (anonymised) | USA and EU (IP anonymisation enabled) |
Payment gateways | Payment card data (tokenised) | USA (PCI DSS Level 1 compliant) |
Email services | Email addresses, communications | Australia preferred; USA backup |
If we disclose your personal information to an overseas recipient who breaches the APPs, we remain accountable for that breach under Australian law. You can contact us if you have concerns about overseas disclosure, and we will provide details of the specific countries and safeguards involved.
Under APP 11, we must take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Given the sensitive nature of data recovery work, our controls go further than a typical small business.
Secure premises with restricted access, CCTV monitoring, alarm systems and locked storage for client devices
Firewalls, intrusion detection, encrypted connections (TLS 1.3) and an isolated recovery network separate from office systems
AES-256 encryption for stored data, encrypted backups and secure transfer protocols
Role-based access, strong password policies, multi-factor authentication and audit logging
Regular privacy and security training, confidentiality agreements and background checks for all staff
NIST SP 800-88 compliant sanitisation, physical destruction of media when required, certificates of destruction available
Under APP 11.2, we must destroy or de-identify personal information when it is no longer needed for any purpose permitted under the APPs. We have set clear retention periods for different types of information.
How long we keep different types of information
| Data Type | Retention Period | Reason |
|---|---|---|
Your recovered data | 14 days after collection or delivery | Short grace period in case of issues, then securely wiped |
Job records | 7 years | Australian tax and business record requirements |
Invoices and financial records | 7 years | ATO requirements under tax law |
Forensic case files | As directed by the client or court | Legal proceedings may require extended retention |
Marketing preferences | Until you opt out, plus 2 years | To maintain your preferences and suppression lists |
Website analytics | 26 months | Google Analytics default retention period |
When data is no longer required, we use the following destruction methods:
Under the Notifiable Data Breaches (NDB) scheme (Part IIIC of the Privacy Act 1988), we must notify the Office of the Australian Information Commissioner (OAIC) and affected individuals if a data breach is likely to result in serious harm.
In the unlikely event of a data breach that is likely to result in serious harm, we will:
An "eligible data breach" occurs when:
The Australian Privacy Principles give you specific rights regarding your personal information. We are committed to respecting and facilitating these rights.
You can request access to the personal information we hold about you. We will respond within 30 days.
You can request correction of any inaccurate, incomplete or outdated information we hold about you.
You can opt out of direct marketing at any time by contacting us or using the unsubscribe links.
You can ask what information we hold, why we hold it and to whom we have disclosed it.
Where practicable, you can deal with us anonymously or using a pseudonym (for example, general enquiries).
You can lodge a complaint if you believe we have breached the APPs. See section 14 for details.
To exercise any of these rights, contact us:
We may need to verify your identity before processing your request. There is generally no fee for access requests, but we may charge a reasonable fee for administrative costs if your request is complex or voluminous.
If you are visiting our website from the European Union (EU), the European Economic Area (EEA) or the United Kingdom (UK), you may have additional rights under the General Data Protection Regulation (GDPR) or the UK GDPR.
While we are an Australian business primarily serving Australian clients, we respect the privacy rights of all visitors. If you are an EU or UK resident and wish to exercise GDPR rights, please contact our Privacy Officer at admin@wildfiredata.com.au.
If you believe we have breached the Australian Privacy Principles or mishandled your personal information, you have the right to lodge a complaint.
We encourage you to contact us first so we can investigate and resolve your concerns. Email admin@wildfiredata.com.au or call 1300 806 557. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, or if we do not respond within 30 days, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
The independent regulator for privacy in Australia
GPO Box 5218, Sydney NSW 2001
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements, or for other operational reasons. When we make changes:
Your continued use of our services after any change indicates your acceptance of the updated policy. If you do not agree with a change, you should stop using our services and contact us to discuss your concerns.
If you have any questions about this Privacy Policy or our privacy practices, or wish to exercise your rights, please contact our Privacy Officer:
We are here to help with any privacy-related enquiry
51 Aquila Circuit, Banksia Beach QLD 4507
Australia
Mon to Fri: 9am to 5:30pm
Sat: 10am to 4:30pm AEST
If you need help recovering data from a failed or damaged device, we are here to help. Get started today:
Keep a copy of this Privacy Policy for your records