Effective date: 2 November 2026
11.1 Purpose
This policy establishes our procedures for responding to suspected or confirmed security incidents, cyber threats, unauthorised access events, and eligible data breaches.
11.2 Reporting obligations
Users, contractors, staff and authorised representatives must promptly report: suspected unauthorised access to systems or accounts; phishing attempts or credential compromise; suspected tampering with Quotes, Invoices or bank details on Business Records, or emails impersonating your business or Ezyiah; access to a business's account by a Team Member or Invited Adviser who is no longer authorised; malware, ransomware or suspicious activity; accidental disclosure of confidential information; or any event reasonably suspected to compromise the confidentiality, integrity or availability of data. Reports should be made through the designated support or security channels as soon as practicable, at support@ezyiah.com.au.
11.3 Investigation and response
On becoming aware of a suspected incident, we may investigate and assess its severity and scope; restrict or suspend affected systems, accounts or user access, including Team Member or Invited Adviser access; preserve evidence and system logs; engage external cybersecurity specialists where necessary; undertake containment and remediation; and document the incident and corrective actions taken.
11.4 Breach notification
Where required under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth), we will assess a suspected eligible data breach, taking all reasonable steps to do so within 30 days of becoming aware of grounds to suspect it, and, where there are reasonable grounds to believe an eligible data breach has occurred, notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable. Notifications may include the nature of the breach, the kinds of information affected, recommended protective steps, and the steps we have taken. Where you are responsible for affected Client Data or for personal information of Your Customers, Your Suppliers or Team Members held in your account, we will notify you and assist you to meet any notification obligations you have. Depending on your circumstances, you may have your own obligations under the Notifiable Data Breaches scheme.
11.5 Limitation
While we implement commercially reasonable safeguards, you acknowledge that no system is completely secure, that incidents may occur despite reasonable precautions, and that internet-based services carry inherent risks. To the maximum extent permitted by law and subject to the ACL, we exclude liability for indirect, incidental, consequential or unforeseeable loss arising from cybersecurity incidents, unauthorised access, service interruptions or data breaches, except where liability cannot lawfully be excluded.