Daeza Privacy Policy

Last updated 7 November 2026

Daeza Pty Ltd (ACN 703 651 290, ABN 19 703 651 290) runs this website, daeza.com.au, and provides Microsoft 365 security, infrastructure and AI advisory services to businesses. In this policy "Daeza", "we" and "us" mean Daeza Pty Ltd.

This policy explains what personal information we handle, why we handle it, where it is kept and what you can do about it.

This policy does not cover the Strapline app. Strapline has its own privacy policy.

Our commitment

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Some small businesses are exempt from parts of that Act. We do not rely on that exemption: we follow the Australian Privacy Principles whether or not the law requires us to.

The short version

• This website has no accounts, no forms and no sign up. Nothing is sold or paid for on it. You contact us by email.
• We do not use advertising or tracking cookies. The only analytics we use is Cloudflare Web Analytics, which does not build a profile of you.
• When a client engages us, our scanner reads settings and security records from the client's Microsoft 365 tenant. It only reads. It cannot change anything, and it is not given permission to read the content of email, files or chats.
• We use Anthropic's Claude, an AI service, to help analyse scan results. No decision about a person is made by a computer alone.
• We change nothing in a client's tenant unless the client has approved it in writing.
• We do not sell personal information and we do not use client data for marketing.

Who this policy is about

• People who visit daeza.com.au.
• People who email us, and the staff of our clients.
• People who use a client's Microsoft 365 tenant. Their details appear in the records our scanner reads. Our client chooses to use our service, and we handle this information on our client's behalf under our written agreement with them.

What we collect and why

When you visit this website

This website is hosted by Cloudflare. When you visit, Cloudflare processes standard technical details such as your IP address, browser type, the page you asked for and the time. This is needed to deliver the site and protect it from attacks and misuse.

We use Cloudflare Web Analytics to count visits and see which pages are read. Cloudflare designed it to work without cookies and without fingerprinting, and it does not track you across other websites. We see only totals, not individual visitors.

The site loads its fonts from Google Fonts. Your browser fetches the font files directly from Google, so Google receives your IP address and browser details when you visit. Google's handling is covered by Google's privacy policy.

If you choose a colour theme on the site, your browser remembers that choice on your own device (in local storage). It is not sent to us.

We do not use advertising cookies, we do not run advertising trackers, and we do not sell or share visitor data for advertising.

When you email us

We collect what you send us: usually your name, business name, business email address, phone number and anything you choose to tell us. We use it to reply to you and to discuss work you ask us about. We do not add you to a mailing list and we do not use your email for anything else.

If we contact a business first, we use only business contact details that the business has published itself.

When you become a client

We keep the contact details of the people we deal with at the client, the signed agreement, the client's written approvals, invoices, payment records and our records of the work. We need these to deliver the service, to show what was approved, and to meet tax and company record keeping laws. We do not take card payments on this website.

When we provide our Microsoft 365 security service

We use an app called "Daeza Security Scanner", registered in Microsoft Entra ID. A Global Administrator in the client's tenant gives consent to it once and assigns it the Global Reader role. We scan only what the client's signed agreement covers.

How the scanner is limited:

• Every permission it holds is a read permission.
• Global Reader is a read only role. It cannot change anything in Microsoft 365.
• It signs in with a certificate. It has no password and no client secret.
• It is never given the Global Administrator role, any permission to write, send or take full control, any permission to act as a signed in person, or any permission to read the content of mail, files, Teams chats or SharePoint sites.

What the scanner can see:

• Configuration: security, sign in, sharing, device, mail protection and Teams settings, licences, domains and admin roles.
• Directory details: users, groups, apps, devices and who holds which admin role. This includes names, usernames, email addresses and job details as they appear in the tenant.
• Sign in and audit records: dates and times, IP addresses, approximate locations, and the apps and devices used.
• Sign in methods people have registered, such as an authenticator app or a phone number used for multi factor authentication.
• Users and sign ins that Microsoft has flagged as risky, Microsoft Secure Score, and Microsoft Defender alerts and incidents.
• Results of read only security queries. Alerts and query results can include email details such as sender, recipient and subject line.
• Phishing simulation and training records, which can show which users took part and how they responded.

What the scanner does not read: the body of emails, email attachments, the content of files in OneDrive or SharePoint, or the content of Teams chats and meetings.

We use this information only to provide that client's service: to find security risks, write the client's report and recommend fixes. We do not use it for any other purpose.

When a client approves a fix

Daeza's Director first approves a list of recommended fixes. The client then approves it in writing. Only the approved items are changed. Each change is tested in a dry run first, made by Daeza's Director signing in to an account the client has approved for that purpose, and recorded in a change record for the client.

AI processing

We use Claude, an AI service provided by Anthropic, PBC, a company based in the United States, to help analyse scan results and draft reports and lists of fixes. Scan results that we send to Claude can include the personal information described above, such as names, email addresses and IP addresses.

• Our Claude account is set so that Anthropic does not use our content to train its models, except content we report to Anthropic as feedback or that Anthropic flags for safety review.
• Anthropic processes data in the United States and may process it in other countries where it or its service providers operate.
• A person at Daeza reviews every report and fix list before it goes to a client.

Automated decisions

No decision about a person is made by a computer alone. AI helps us analyse and draft, but every finding, report and recommended fix is reviewed by a person, and a fix is applied only after Daeza's Director and the client have both approved it.

Where we keep information

• Client information, scan results and reports are kept in Daeza's Microsoft 365 tenant and on Daeza's work computer. Microsoft stores the core data of an Australian Microsoft 365 tenant, such as mailboxes and SharePoint and OneDrive files, at rest in Australia.
• Clients receive reports and change records through their own private portal, a SharePoint site in Daeza's Microsoft 365 tenant that only the client's nominated people and Daeza can open. We do not publish scan results and we do not send them by email.
• Website technical data is processed by Cloudflare across its global network, usually in a data centre near the visitor.

Who we share it with

• The client, through the client's private portal.
• Service providers that host or process information for us: Microsoft (Microsoft 365, including email and SharePoint), Anthropic (Claude, for analysis), Cloudflare (website hosting and analytics) and Google (website fonts only).
• Our accountant, for billing and tax records only. Our accountant never receives scan results.
• Anyone the law requires or authorises us to share it with.

We do not share personal information with anyone else, and we do not sell it.

Information sent overseas

Anthropic processes the data we send to Claude in the United States, and may process it in other countries where it or its service providers operate. Cloudflare and Google may process website technical data in the United States and other countries. Microsoft stores Daeza's core Microsoft 365 data in Australia.

Before we use a provider outside Australia, we take reasonable steps to make sure it protects personal information in a way that is consistent with the Australian Privacy Principles, including by using providers whose written terms limit how they may use the data.

How we protect it

• The scanner holds read only permissions and signs in with a certificate.
• Scan results are shared only through the client's private portal. We do not publish them and we do not send them by email.
• Every report and fix list is checked by a person before it is sent to a client.

Data breaches

If we suspect a data breach, we act straight away to contain it and assess it. If a breach affects a client's data, we tell the client without undue delay, and no later than 72 hours after we confirm it. We also follow the Notifiable Data Breaches scheme: where a breach is likely to result in serious harm, we notify the people affected and the Office of the Australian Information Commissioner (OAIC).

How long we keep it

• Enquiry emails that do not lead to an engagement: 2 years after our last contact, then deleted.
• Client engagement records, including agreements, approvals, change records and invoices: 7 years after the engagement ends, as Australian record keeping laws require, then deleted.
• Scan data and raw scan results: deleted within 90 days after the engagement ends, or earlier if the client asks.

Ending the scanner's access

A client can stop the scanner at any time. An administrator removes "Daeza Security Scanner" in Microsoft Entra ID under Enterprise applications and removes its Global Reader role. The scanner then cannot get any new access to the tenant. Please also tell us, so we stop any scheduled scans and delete scan data as set out above.

Access, correction and complaints

You can ask for the personal information we hold about you, and ask us to correct it. We will reply within 30 days. If the information came from a client's Microsoft 365 tenant, we may also refer you to that client, because they control the tenant, and we will help them respond.

If you have a complaint about how we handled your personal information, email us first and we will reply within 30 days. If you are not satisfied with our answer, you can complain to the OAIC at oaic.gov.au.

Changes to this policy

If this policy changes, we will post the new version on this page with a new "Last updated" date.

Contact

• Privacy contact: Ealia Azizollahi, Director, Daeza Pty Ltd
• Email: admin@daeza.com.au
• Post: 2A Danielle Street, Cleveland QLD 4163

Daeza is independent and is not endorsed or sponsored by Microsoft, Anthropic, Cloudflare or Google. Microsoft 365, Microsoft Entra, Microsoft Defender, SharePoint, OneDrive and Microsoft Teams are trademarks of the Microsoft group of companies. Claude is a trademark of Anthropic, PBC.