Privacy Policy

About this policy

This policy explains how Gisch Consulting Pty Ltd (ABN 22 626 813 910), trading as Gisch Consulting (“we”, “us”, “our”), handles personal information collected through gischconsulting.com.au. We are a Victoria-based Australian consultancy serving clients across Australia and New Zealand, and we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using our website or submitting information to us through it, you agree to the practices set out in this policy.

What information we collect

We collect the following kinds of personal information through this site:

• Booking and contact details — when you book a consultation or send us an enquiry, we collect your name, email address, phone number (optional), and any notes you provide.
• Resource download and mailing-list details — when you download a gated resource (such as the 3×3 Change Mapping Tool), we collect your name, organisation, and email address, and record your consent to join our mailing list. The booking form and the Ask Piper follow-up form offer the same list membership as an optional, unticked-by-default choice.
• Server logs — our web server records standard technical information about each request, including IP address, user-agent string, requested URL, and timestamp. We use this to operate, secure, and debug the site.
• Admin session data — if you are an authorised administrator of this site, we set a session cookie when you log in so we can identify you across pages. We do not set this cookie for general visitors.
• Website analytics — we use Google Analytics to understand which pages people read and how they arrive, so we can write more of what is useful. This sets cookies in your browser and records the pages you visit, your approximate location, and the type of device and browser you use. We have turned on IP anonymisation, so your address is shortened before it is stored, and we have turned off Google's advertising and cross-device features: nothing collected here is used for advertising, sold, or matched to you as an individual. If you would rather not be counted, most browsers offer a do-not-track or cookie-blocking setting, and Google publishes a browser opt-out add-on.
• Google Calendar authorisation — when an administrator connects their own Google Calendar to manage availability, Google issues OAuth tokens that we store, encrypted, in our database. We use these tokens only to read busy times and create calendar events for confirmed bookings. We do not access any other data in the connected Google account.
• Ask Piper conversations — Ask Piper is our AI receptionist on the website. When you chat with Piper, we save the conversation (the messages you send and the responses Piper produces) so we can review the quality of its answers and follow up if you have asked us to. We also store a one-way hashed copy of your IP address and browser user-agent (we do not keep the raw values), the page you started the conversation from, and the number of tokens the conversation cost us. We do not link Ask Piper conversations to any other identity.

We do not knowingly collect personal information from children under 18 through this site.

How we collect it

We collect personal information directly from you when you:

• complete a booking or contact form on this site;
• email us at an address published on this site;
• log in as an administrator; or
• authorise a Google Calendar connection during the admin setup flow.

We do not buy personal information from third parties for marketing.

Why we collect, hold and use it

We use the personal information described above to:

• schedule and confirm consultation bookings;
• respond to enquiries and follow up on prospective engagements;
• deliver resources you request and, with your consent, send our mailing list — every mailing carries an unsubscribe link, and unsubscribing takes effect immediately;
• maintain calendar availability and create calendar entries for confirmed bookings;
• operate, secure, monitor, and improve the website; and
• meet our legal and record-keeping obligations.

We do not sell or rent personal information, and we do not use it for behavioural advertising.

Who we share it with

We share personal information with a small number of third parties that help us operate the service:

• Google — for administrators who connect a Google Calendar, we use Google's Calendar API to read availability and create events. Google's own privacy policy applies to data Google processes on its end. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
• Google Analytics — page-view statistics are processed by Google. We already use Google Workspace to run the business, so this does not put your visit in front of a party that was not already handling our email and calendars. Advertising features and cross-device tracking are switched off, and IP addresses are anonymised before storage.
• Mistral AI — Ask Piper, our AI receptionist, generates its responses using Mistral AI, a European AI provider. The messages you send to Piper, and any contact details you choose to share in the chat, are processed by Mistral AI on servers in the European Union to generate responses, and in periodic automated analysis of transcripts that helps us improve the service. Mistral AI's own privacy policy applies to data it processes on its end. See our AI Policy for more detail.
• Zoom — when you book a video call with us, we send the booking name, email address, any notes you provide, and the email addresses of any additional attendees to Zoom, a US-based video-conferencing provider, to create the meeting. Zoom's own privacy policy applies to data it processes on its end.
• Our hosting and infrastructure provider — the site and its database run on managed infrastructure under our control. The provider has access to encrypted storage to deliver hosting services; it does not use information for its own purposes.
• Professional advisers — we may share information with our accountants, lawyers, or insurers if reasonably necessary, and we require those advisers to keep it confidential.

We may also disclose personal information if we are required to by Australian law, or if disclosure is reasonably necessary to protect our legal interests, prevent fraud, or respond to a serious threat.

Where information is stored

Our primary database and application servers are located in Australia. Some third-party services we rely on may process information outside Australia: Google's APIs for the optional calendar integration, in line with Google's published practices; Mistral AI, which processes Ask Piper chat messages (and any contact details shared in the chat) on servers in the European Union; and Zoom, which processes booking details (name, email address, notes, and any attendee email addresses) in the United States when a video call is booked. Where information is transferred overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

How we store and secure it

We protect personal information using the following measures:

• transport over HTTPS for all traffic to and from the site;
• encrypted storage of OAuth refresh tokens in our database;
• restricted administrative access protected by individual credentials and session cookies;
• standard operating system and platform security on our hosting infrastructure; and
• regular software updates to address known vulnerabilities.

No system is completely secure. If you believe your interaction with us has been compromised, please contact us at the address below.

How long we keep it

We keep personal information only for as long as we need it:

• Bookings and enquiry information — for the duration of the engagement and for a reasonable record-keeping period afterwards (generally up to seven years, consistent with Australian record-keeping obligations).
• Server logs — typically up to 90 days for security and debugging.
• Admin session cookies — until you log out or the session expires.
• Analytics data — retained by Google for the period set on the property, then deleted automatically. Analytics cookies expire in your browser on their own schedule, and clearing your cookies removes them immediately.
• Google Calendar OAuth tokens — until the administrator disconnects the calendar in the admin interface, after which the tokens are deleted.
• Ask Piper conversations — 90 days from the last message in the conversation, then automatically deleted. Conversations flagged for quality review (for example, where a visitor has rated the conversation poorly) are kept for up to 365 days, then deleted on the same automatic schedule.

We will delete or de-identify your personal information on request unless we have a legal obligation to retain it.

Cookies and tracking

We use a single session cookie for administrators who log in to manage the site. No cookies are set for general visitors.

We do not use third-party analytics services, advertising trackers, or social-network pixels. We do not participate in cross-site tracking.

Your rights

Under the Australian Privacy Principles, you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is inaccurate, out of date, or incomplete;
• ask us to delete information, subject to any legal obligations we have to retain it; and
• make a privacy complaint about how we have handled your personal information.

To exercise any of these rights, contact us at the address below. We will respond within 30 days. If we cannot grant a request, we will explain why and tell you how you can take it further.

Complaints

If you believe we have handled your personal information in a way that breaches the Australian Privacy Principles, please contact us first so we can try to resolve the matter directly. We will acknowledge your complaint within 7 days and aim to give you a substantive response within 30 days.

If you are not satisfied with our response, you can escalate the matter to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices or our legal obligations. The “Last updated” date at the top of this page reflects the most recent change. We encourage you to review this page periodically.

Contact us

For privacy enquiries, access requests, corrections, or complaints:

Privacy Officer
Gisch Consulting Pty Ltd
Email: [email protected]