Privacy Policy

1. Overview

Mandantis Group is committed to protecting your privacy in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains how we collect, use, disclose, and store your personal information.

2. Who We Are

Mandantis Group Pty Ltd
ACN 698 302 117
ABN 29 698 302 117
Wollongong, New South Wales, Australia
Contact: hello@mandantis.com
Website: mandantis.com

3. What We Collect

We may collect the following personal information:

• Architecture Index: Name, email, organisation, role, and assessment responses
• Website: Contact form submissions (name, email, organisation, message)
• Newsletter: Email address
• Direct engagement: Information provided during consultations

4. How We Use It

• Delivering your Architecture Index results and recommendations
• Responding to enquiries and service delivery
• Sending newsletter content (where you have subscribed)
• Improving our services through aggregated, anonymised analysis
• Legal compliance and dispute resolution

5. How We Store It

Personal information is stored in Microsoft Dynamics 365 (our system of record) and Cloudflare D1 (operational cache). Data is retained for 7 years after last interaction, unless you request earlier deletion.

6. Disclosure

We do not sell personal information. We may share information with service providers (Microsoft, Cloudflare) who process data on our behalf under contractual safeguards. We will not disclose information to implementation partners without your explicit consent.

7. International Data Transfers

Our infrastructure providers (Cloudflare, Microsoft) may process data outside Australia. These transfers are governed by the providers' data processing agreements and comply with applicable privacy legislation.

8. Cookies & Tracking

We do not use advertising cookies. We use analytics in two layers — one anonymous and one consent-based — plus the strictly-necessary technical cookies Cloudflare may set for security (these do not require consent).

• Anonymous audience measurement (no cookie, no consent required). For every visitor we record aggregate counts of which pages and articles are viewed and which in-page links are clicked, so we can understand engagement and improve our content. This uses no cookie and no persistent identifier: a short-lived value scoped to a single page view, never stored on your device and never used to identify you or to track you across pages, sessions or sites. The result is aggregate statistics only. You can object at any time — choosing Decline all in the cookie banner turns this off as well.
• First-party analytics (opt-in). Only if you consent, our own analytics keeps a first-party visit identifier (the mgp_vid cookie) so we can connect your visits over time across our sites (mandantis.com and index.mandantis.com). If you later identify yourself — for example by completing the Architecture Index or a contact form — this visit history may be linked to your contact record in our customer data platform so we understand how you engaged with us. This data lives in our own systems (Supabase, Australia); we do not sell it.
• Google Analytics (GA4), via Google Tag Manager (opt-in). Aggregated website analytics provided by Google. A separate consent choice that loads only if you allow it.

You can change or withdraw your choices at any time using the Cookie settings link in the footer; Decline all switches off the anonymous measurement too. Declining leaves the site fully functional. To request access to, or deletion of, the personal data linked to you, contact us at hello@mandantis.com.

9. Your Rights

Under the Privacy Act 1988, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Lodge a complaint about our handling of your information

Contact us at hello@mandantis.com to exercise these rights.

10. Assessment Data & Anonymisation

Assessment responses may be aggregated and anonymised for research and insight publications. Anonymised data cannot be used to identify you or your organisation.

11. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect information from children.

12. Changes to This Policy

We may update this policy from time to time. Changes will be published on this page with an updated effective date.