Privacy Policy

Who we are

Digital Connex (“we”, “us”, “our”) is a Sydney digital marketing agency operated by HMH Group Pty Ltd, trading as Digital Connex. We manage marketing, content and social media for the businesses we work with. This policy explains what personal information we collect, how we use it, who we share it with and the choices you have.

We comply with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and with the GDPR for anybody in the European Economic Area.

What we collect

• Contact and business details. Name, email, phone, business name and address, from enquiries, proposals and onboarding.
• Billing details. What is needed to invoice and be paid. Card details are handled by our payment processor and never stored by us.
• Work for clients. Brand material, content, briefs, approvals and messages exchanged while we work together.
• Connected account data. Where a client connects a social or advertising account so we can manage it, the access token the platform issues, the identifiers of the accounts chosen, and the content and performance figures for them. See Connected accounts below.
• Technical data. IP address, browser and device details and session data when you use our sites and portals.

How we use it

To deliver the work a client has engaged us for, communicate about it, invoice for it, keep our systems secure and meet our legal obligations. We do not sell personal information, and we do not use it for advertising to anybody.

Connected accounts

We manage clients’ social accounts with suiteOS, a social media management tool provided to us by bycaptur.io (Lion Tech Group Pty Ltd). A client connects each account themselves, through that platform’s own sign-in, and can disconnect it at any time. We only act on accounts a client has connected, and only publish content the client has approved.

The platforms that can be connected, and what we do with each:

• Facebook Pages (Meta). Publish posts the business has approved, read comments, messages and Page insights, and reply to comments and messages on the business's behalf.
• Instagram professional accounts (Meta). Publish approved posts, reels and carousels, read comments, direct messages and account insights, and reply on the business's behalf.
• Threads (Meta). Read the connected profile and publish approved posts.
• Meta ad accounts. Read ad spend and results for the business's reports.
• LinkedIn company pages. Publish posts the business has approved to its company page, and read the engagement on the page's own posts. We do not post to anybody's personal profile, message members or collect member data beyond what LinkedIn returns for the page's posts.
• TikTok. Read the connected account's display name and avatar, and post videos the business has approved, with the privacy settings chosen at posting.
• Google Business Profile. Read the connected Google account's name and email to identify the connection, publish posts to the Business Profile, read its reviews and performance.

For each connection we keep:

• Access tokens. Stored on the server so the work can be carried out. Never shown in a browser, never shared, never used for anything else.
• Account identifiers. The names and identifiers of the accounts, Pages and profiles the client chose.
• Content and performance. The posts we publish, the comments and messages on the account shown in our inbox, and daily figures such as reach, followers and engagement, so reports keep working after a platform stops serving history.
• A record of what we did. Every post published on a client’s behalf, with a timestamp.

Data from a connected account is used only to provide our services to the business that connected it. It is never shared with another client, never sold, never used for advertising or sales, and never used to train AI models.

Google user data. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deletion. A client can remove our access in the platform’s own settings, or ask us to disconnect. To have a connected account’s data deleted, email us. We delete the connection, its token, identifiers, cached content and figures within 30 days and confirm when it is done. Posts already published stay on the client’s account, because they are theirs.

Who we share it with

• Service providers who host and run our tools for us, under contract and only for that purpose: bycaptur.io (suiteOS), Supabase (database), Vercel (hosting), email delivery and payment processing.
• The platforms themselves, when we publish or reply on a client’s behalf.
• Authorities, only where Australian law requires it or to prevent a serious threat to life or safety.

Some providers store data outside Australia. Where they do, we take reasonable steps under APP 8 and use standard contractual clauses for transfers from the EEA.

Security and retention

Data is encrypted in transit and at rest, and access is limited to the staff working on each client’s account. We keep information while we work together and for as long as the law requires after, then delete it, within 90 days of the end of an engagement unless a longer period is legally required.

Your rights

You can ask to access, correct or delete your personal information, object to or restrict how it is used, or withdraw consent. Email us and we will respond within 5 business days. If you are not happy with our response you can complain to the Office of the Australian Information Commissioner, or your EU data protection authority.

Our services are for businesses and people aged 18 and over. We do not knowingly collect information from children.

Changes

We will post any change here with a new effective date, and tell clients directly about material changes.

Contact

Privacy enquiries go to the director responsible for privacy compliance.

• Email hello@digitalconnex.com.au
• Entity HMH Group Pty Ltd, trading as Digital Connex
• Address Unit 30, 1017 Canley Vale Road, Wetherill Park NSW 2164, Australia