Data Handling and Protection Policy

Data Transfer Security

We prioritise the security and confidentiality of our clients’ data, supporting a range of secure data transfer methods and strongly recommend the following:

• SFTP – Our preferred method for regular or high-volume data transfers. We can provide access to our secure SFTP server upon request
• Encrypted Email – Our Microsoft 365 environment includes built-in encryption capabilities; messages are protected using Microsoft Purview Message Encryption. We’re happy to coordinate encryption settings with your IT team to ensure secure email communication

Data Security

Once client data is received, Direct Mail Solutions stores it securely on our internal servers, protected by multiple safeguards. These include:

• Restricted Access – Only authorised staff can access client data, with role-based permissions and audit logging in place
• Firewalled and Monitored Servers – All data is stored on secure, firewall-protected servers with active monitoring and intrusion detection
• Data Encryption – Sensitive data is encrypted both in transit and at rest where required
• Secure Premises – Our facility is access-controlled and under 24/7 surveillance to ensure physical data security
• Strict Data Handling Policies – We follow documented procedures for data handling, retention, and disposal, aligned with Australian privacy regulations and GDPR, where applicable

Data Breach Notification and Response

In the event of a data breach involving personal information, Direct Mail Solutions follows a clear, immediate response process in line with the Notifiable Data Breaches (NDB) scheme under the Australian Privacy Act (Australian Privacy Principles – APPs) and the General Data Protection Regulation (GDPR) Articles 33 and 34.

Our process includes:

• Immediate containment of the breach to prevent further compromise
• Internal assessment of the type, scope, and impact of the breach
• Notification to the affected client without delay, regardless of the scale or severity
• If required, notification to the Office of the Australian Information Commissioner (OAIC) or relevant supervisory authority under GDPR
• Implementation of corrective actions and preventative safeguards to avoid future incidents

We are committed to full transparency and cooperation throughout the resolution process and will work closely with your team to manage any required communications or remediation efforts.

Retention and Disposal

After mail has been dispatched, client data is retained only for as long as necessary to complete processing, provide reporting, or meet contractual or regulatory requirements.

In line with the Australian Privacy Principles (APP 11.2) and GDPR Article 5(1)(e), if client data is no longer required, it is securely deleted within 30 days, unless otherwise agreed. These frameworks require organisations to take reasonable steps to destroy or de-identify personal information that is no longer needed, in accordance with their obligations.

We follow a secure data disposal process, which includes:

• Permanent deletion from all active systems and backups
• Documented verification of deletion, available upon request

Use and Disclosure

Direct Mail Solutions does not use or retain client data for any purpose other than the agreed mailing services. We do not analyse, share, repurpose, or sell any client data. All data is handled strictly in accordance with the intended scope of work, and in compliance with Australian privacy laws and any applicable contractual obligations.

Third-Party Systems or Subcontractors

No third parties or external systems are involved in the handling or processing of client data beyond Direct Mail Solutions and our direct employees.

All data processing is carried out in-house at our secure facility, and we do not outsource data handling to external vendors or offshore providers. If a project requires third-party involvement (e.g. Australia Post for lodgement), this is always disclosed and managed under strict confidentiality and compliance protocols.

Contractual Arrangements

Yes, Direct Mail Solutions provides a formal service agreement for all client engagements involving data handling.

Given the sensitive nature of the data, our agreements include clearly defined terms covering:

• Privacy and confidentiality obligations
• Data security and handling procedures
• Retention and secure disposal policies
• Compliance with Australian Privacy Principles and General Data Protection Regulation

We’re also happy to review and incorporate any client-specific privacy or data protection requirements into the agreement to ensure alignment with your internal policies.