1Who I am and what this policy covers
1.1 This Privacy Policy is issued by Maxwell Vidler (ABN 91 401 839 052), a sole trader trading in my own name (‘I’, ‘me’ or ‘my’). I provide specialised solutions architecting and fractional leadership in governance, strategy, and change from Brisbane, Queensland.
1.2 This policy explains how I collect, hold, use and disclose personal information through vidler.io (the ‘Website’), through your interactions with me, and through enquiries from prospective clients, in accordance with the Privacy Act 1988 (Cth) (the ‘Privacy Act’) and the Australian Privacy Principles (the ‘APPs’).
1.3 This policy does not govern information handled in the course of a client engagement. That information is handled under the relevant engagement terms and, where applicable, a data processing agreement.
2The personal information I collect
2.1 Enquiries and correspondence. Your name, email address, telephone number, organisation, role and the content of your message — including the answers you give in the Website’s enquiry form — together with any further information you choose to provide during enquiries or engagement discussions.
2.2 Insights subscriptions. Your email address, if you subscribe to Insights through the Website.
2.3 Technical data. Your IP address, device and browser type, the pages you request and the time of each request, as recorded in my hosting provider’s standard server logs.
2.4 I do not intentionally collect sensitive information, as defined in the Privacy Act — including health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation or criminal record — through the Website. Please do not send sensitive information to me unless I have requested it.
3How I collect personal information
3.1 Directly, when you complete the enquiry form or subscribe to Insights on the Website, email or telephone me, correspond with me or meet with me.
3.2 Automatically, through the server logs maintained by my hosting infrastructure. The Website does not use analytics tools or tracking cookies.
3.3 From third parties, such as referrers or service providers, where that collection is lawful or you have consented to it. Where I collect personal information about you from a third party, I take reasonable steps to make you aware of that collection.
4Why I collect it and how I use it
4.1 I collect and use personal information to: (a) respond to your enquiries; (b) prepare proposals and administer engagements; (c) operate, maintain and secure the Website; (d) improve the Website’s content and performance; (e) protect against fraud and misuse; (f) send you marketing communications, where you have consented; and (g) comply with my legal obligations.
4.2 I use personal information only for the purpose for which it was collected, for a related purpose you would reasonably expect, or otherwise with your consent or where permitted or required by law.
5Cookies and analytics
5.1 The Website does not use analytics trackers, advertising trackers or non-essential cookies.
5.2 The Website is hosted by Vercel Inc., which records standard server logs. Typefaces are delivered by Google Fonts, which receives standard request data, such as your IP address and browser type, when your browser loads them.
5.3 Before introducing analytics or non-essential cookies, I will update this policy and, where required, seek your consent. My Cookie & Tracking Policy contains further detail.
6Direct marketing and your choices
6.1 I send marketing communications — such as updates, Insights and information about my services — only with your consent or where otherwise permitted by law, and in accordance with the Spam Act 2003 (Cth).
6.2 Every marketing email includes a means to unsubscribe. You may also opt out at any time using the contact details in clause 17.
6.3 Opting out of marketing does not prevent me from contacting you about an enquiry or engagement in progress.
7When I disclose personal information
7.1 I do not sell personal information.
7.2 I may disclose personal information to: (a) service providers who support my operations, including my website host, Vercel Inc., the provider that delivers messages sent through the Website’s forms, and my email and productivity providers, who are required to handle it consistently with this policy; (b) my professional advisers, including legal, accounting and insurance advisers, where reasonably necessary; (c) any person where disclosure is required or authorised by law; and (d) a successor to my business in connection with its sale, transfer or restructure.
8Overseas disclosure
8.1 My website host, Vercel Inc., my form delivery provider and my email and typeface providers may store or process personal information in the United States and other jurisdictions.
8.2 Before disclosing personal information overseas, I take reasonable steps, consistent with APP 8, to ensure that the recipient does not breach the APPs, except where an exception under the Privacy Act applies.
9How I keep personal information secure
9.1 I take reasonable technical and organisational steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include access controls, encryption in transit, access restricted on a need-to-know basis and the selection of reputable service providers. My Security Policy describes these controls.
9.2 No method of transmission or storage is completely secure. I apply measures proportionate to the risk.
10How long I keep it
10.1 I keep personal information only for as long as it is required for the purposes described in this policy or by law. When it is no longer required, I take reasonable steps to destroy or de-identify it.
11Accessing and correcting your information
11.1 You may request access to the personal information I hold about you (APP 12) and ask me to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13).
11.2 Make a request using the contact details in clause 17. I may need to verify your identity, and I will respond within a reasonable period.
11.3 I do not charge for making a request. I may recover a reasonable cost of providing access.
11.4 If I decline a request, I will give you my reasons in writing and explain how to make a complaint.
12Data breaches
12.1 I maintain procedures to identify and respond to data breaches. Where an eligible data breach is likely to result in serious harm, I will notify the affected individuals and the Office of the Australian Information Commissioner (the ‘OAIC’) in accordance with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, and I will recommend steps that you can take in response.
13Making a privacy complaint
13.1 If you consider that I have mishandled your personal information, contact me using the details in clause 17. I will acknowledge your complaint, investigate it and respond within a reasonable period.
13.2 If you are not satisfied with my response, you may refer your complaint to the OAIC at oaic.gov.au.
14Children
14.1 The Website is intended for professional use and is not directed to persons under 18 years of age. I do not knowingly collect personal information from children. If you believe that I have done so, contact me and I will take reasonable steps to delete it.
15Links to other websites
15.1 The Website links to other websites, including Insights published at unimatter.com.au. Each linked website is governed by its own terms and policies, and I encourage you to read them.
16Changes to this policy
16.1 I may update this policy from time to time. The current version will be published on the Website with its effective date, and I will take reasonable steps to bring significant changes to your attention.
17How to contact me
17.1 Maxwell Vidler (ABN 91 401 839 052) · max@vidler.io · +61 493 522 896 · Level 1, 16 McDougall Street, Milton QLD 4064 · PO Box 1279, MILTON QLD 4064.
17.2 This policy is governed by the laws of Queensland and of the Commonwealth of Australia. Visitors outside Australia may have additional rights under the law of their own jurisdiction.
1About these Terms and your acceptance
1.1 These Terms and Conditions (the ‘Terms’) govern your access to and use of vidler.io and its related content (the ‘Website’). By accessing, browsing or otherwise using the Website, you acknowledge that you have read and understood these Terms and agree to be bound by them. If you do not agree, you must not use the Website.
1.2 If you use the Website on behalf of an organisation, you represent that you are authorised to accept these Terms on its behalf.
2Definitions
2.1 In these Terms: ‘ACL’ means the Australian Consumer Law in Schedule 2 to the Competition and Consumer Act 2010 (Cth); ‘Content’ means all material on the Website, including text, graphics, images, design, code and Insights; ‘Insights’ means articles, research and commentary published on or linked from the Website; ‘Intellectual Property Rights’ means all present and future intellectual property rights, whether registered or unregistered; ‘I’, ‘me’ and ‘my’ mean Maxwell Vidler (ABN 91 401 839 052), a sole trader trading in his own name; and ‘you’ and ‘your’ mean the person using the Website.
3Who I am
3.1 I am Maxwell Vidler, a sole trader based in Brisbane, Queensland, trading in my own name. I provide specialised consulting and fractional leadership in governance, strategy, and change across six practices: Systems Architecture and Digital Capability; Change Consulting and Business Transformation; Quality Assurance and Compliance; Campaigns and Communications; Intelligence and Research; and Foundry.
3.2 Services are delivered through consulting engagements, retained and fractional advisory arrangements and integrated projects, each under separate written terms.
4Use of the Website
4.1 I grant you a limited, non-exclusive, non-transferable and revocable licence to use the Website for lawful purposes. No other right, and no ownership, passes to you. I may suspend or withdraw this licence at any time.
4.2 You are responsible for your own devices, software and systems, and for their security.
5Acceptable use and prohibited conduct
5.1 You must use the Website lawfully and must not: (a) use it for any unlawful or fraudulent purpose; (b) interfere with or disrupt the Website or its servers; (c) attempt to gain unauthorised access to any system or data; (d) introduce malicious code; (e) scrape or harvest Content by automated means, other than standard search-engine indexing; (f) infringe any person’s Intellectual Property Rights; or (g) transmit defamatory, offensive or unlawful material.
5.2 I may investigate any breach of this clause and report it to law enforcement authorities.
6Engagements and fees
6.1 I supply services only under a written engagement agreement. Nothing on the Website is an offer capable of acceptance.
6.2 Fees published on the Website are stated in Australian dollars, before GST where applicable, and are indicative of my standard rates at the date of publication. The fees and scope of any engagement are those set out in its engagement agreement.
6.3 If these Terms are inconsistent with an engagement agreement, the engagement agreement prevails for that engagement.
7Intellectual property
7.1 The Content, and the Vidler.IO name, logos and branding, are owned by or licensed to me and are protected by the Copyright Act 1968 (Cth) and other applicable law.
7.2 You may view the Content for your own non-commercial use. You must not otherwise reproduce, distribute, adapt or publish any Content without my prior written permission, or use my trade marks without my prior written consent.
8Information is general only
8.1 The Content is general information only. It is not legal, financial, clinical or other professional advice and does not take your circumstances into account. Accessing or relying on the Content does not create a professional relationship. You should obtain advice appropriate to your circumstances before acting.
9Enquiries and submissions
9.1 Do not send confidential or privileged information in an initial enquiry. Enquiries are treated as non-confidential and do not create a professional relationship. Information you submit must be accurate, lawful and not misleading, and must not infringe the rights of any person. I do not guarantee a response. I handle personal information in enquiries in accordance with my Privacy Policy.
10Links to other websites
10.1 The Website links to other websites, including Insights published at unimatter.com.au. Links are provided for convenience only. Each linked website is governed by its own terms and policies, and I accept no responsibility for third-party websites or their content.
11Availability
11.1 The Website is provided on an ‘as is’ and ‘as available’ basis. I do not warrant that it will be uninterrupted, error-free, secure or free of viruses. Subject to clause 12, I may suspend or discontinue the Website without notice or liability.
12Australian Consumer Law
12.1 Nothing in these Terms excludes, restricts or modifies any consumer guarantee, right or remedy under the ACL that cannot lawfully be excluded, restricted or modified. Where I supply services to you as a consumer and fail to comply with a consumer guarantee, my liability is limited, to the extent the law permits, to supplying the services again or paying the cost of having them supplied again, at my option.
13Limitation of liability
13.1 Subject to clause 12, and to the maximum extent permitted by law: (a) all warranties not expressly stated in these Terms are excluded; (b) I am not liable for any indirect, special or consequential loss, or for any loss of profit, revenue, data, goodwill or business opportunity, whether arising in contract, in tort (including negligence), under statute or otherwise; and (c) my aggregate liability in connection with the Website is limited to the fees you paid to me for the relevant services in the three months preceding the event giving rise to the claim.
13.2 Nothing in this clause limits any consumer guarantee under the ACL.
14Indemnity
14.1 You indemnify me against any loss, damage, liability, cost and expense (including legal costs) arising from your use of the Website in breach of these Terms or from your infringement of any third party’s rights, reduced to the extent that my own acts or omissions contributed to it.
15Privacy
15.1 I handle personal information in accordance with my Privacy Policy, which forms part of these Terms.
16Changes to the Website and these Terms
16.1 I may change, suspend or discontinue any part of the Website without notice. I may amend these Terms by publishing an updated version with a new effective date. Your continued use of the Website after publication constitutes acceptance of the amended Terms.
17Suspension or termination of access
17.1 I may suspend, restrict or terminate your access to the Website, with or without notice, if I reasonably suspect a breach of these Terms or if it is necessary to protect the Website or others. On suspension or termination, the licence in clause 4 ends. Clauses 7, 8 and 12 to 19 survive.
18Governing law and jurisdiction
18.1 These Terms are governed by the laws of Queensland and, where applicable, of the Commonwealth of Australia. You submit to the non-exclusive jurisdiction of the courts of Queensland and the courts entitled to hear appeals from them.
19General
19.1 Severability. Any provision that is invalid or unenforceable is to be read down to the minimum extent necessary or, if that is not possible, severed, without affecting the remaining provisions.
19.2 Waiver. A failure or delay in exercising a right is not a waiver of it. A waiver must be in writing.
19.3 Assignment. You may not assign your rights under these Terms without my consent. I may assign my rights.
19.4 Entire agreement. These Terms, together with the Privacy Policy, constitute the entire agreement between you and me about the Website and supersede any prior representation.
20How to contact me
20.1 Maxwell Vidler (ABN 91 401 839 052) · max@vidler.io · +61 493 522 896 · Level 1, 16 McDougall Street, Milton QLD 4064 · PO Box 1279, MILTON QLD 4064.
1Purpose and commitment
1.1 I welcome reports from security researchers who help me identify weaknesses before they can be exploited. I treat security as an ongoing obligation and commit to identifying, assessing and remediating vulnerabilities promptly, and to working constructively with those who report them.
2Scope
2.1 In scope: vidler.io and www.vidler.io.
2.2 Out of scope: (a) testing third-party services or infrastructure that I do not own, including my hosting provider (Vercel) and my email provider; (b) social engineering, phishing or other deception; (c) physical attacks against premises, hardware or people; (d) denial-of-service or volumetric testing; (e) automated scanning that degrades performance; and (f) accessing accounts or data without authorisation.
2.3 If you are unsure whether an activity is in scope, contact me before proceeding.
3My commitments
3.1 I will: (a) acknowledge your report within 5 business days; (b) keep you reasonably informed through triage, validation and remediation; (c) not take legal action against good-faith research conducted in accordance with this policy; and (d) with your consent, credit you once the issue is resolved.
4What I ask of researchers
4.1 You must: (a) act in good faith and use any access solely to identify and report vulnerabilities; (b) avoid privacy violations, the destruction of data and the disruption of services; (c) access only accounts and data that you own or are authorised to access; (d) collect only the minimum information necessary to demonstrate the vulnerability; (e) delete any data obtained once your report is submitted; (f) allow me a reasonable time to remediate before any public disclosure; and (g) not demand payment or make disclosure conditional on payment.
4.2 Conduct that does not comply with this clause forfeits the protections in clauses 3 and 8.
5How to report
5.1 Email max@vidler.io, in English, and include: a description of the vulnerability; the steps to reproduce it; any proof-of-concept material; your assessment of its impact; your contact details; and whether you wish to be credited.
6My process
6.1 Triage. I acknowledge the report within the stated timeframe, assess its completeness and assign a severity.
6.2 Validation. I reproduce the vulnerability and request clarification where needed.
6.3 Remediation. I develop, test and deploy a fix, prioritised by severity and risk.
6.4 Coordinated disclosure. I aim to resolve valid reports within 90 days of acknowledgement and will tell you of any delay and the revised timeframe.
6.5 These timeframes are good-faith targets, not contractual guarantees.
7Recognition
7.1 With your consent, I credit reporters of valid, in-scope vulnerabilities. I do not operate a paid bounty programme and do not pay for vulnerability reports.
8Legal note
8.1 This policy does not authorise any conduct that is unlawful under the law of the Commonwealth of Australia or of Queensland, and it does not extend to third-party systems or data. I treat good-faith research that complies with this policy as authorised by me. Conduct that does not comply with this policy is not protected.
9Changes to this policy
9.1 I may revise this policy. Please consult the current version before submitting a report.
10Contact
10.1 Security reports and general enquiries: max@vidler.io · +61 493 522 896 · Level 1, 16 McDougall Street, Milton QLD 4064.
1Purpose and scope
1.1 This policy describes the safeguards I apply to my systems, applications and information assets, including personal, confidential and client information. It governs my own controls and imposes no obligations on third parties. Where a written client agreement imposes more stringent security requirements, that agreement prevails.
2Governance and responsibility
2.1 I am directly accountable for the design, implementation, operation and review of my security controls. Security matters are directed to max@vidler.io.
3Risk-management approach
3.1 I identify assets and threats, assess likelihood and consequence, and apply proportionate controls. Client, personal and health information receive heightened protection. Controls are adjusted as systems, engagements and threats change.
4Data protection
4.1 In transit. Information is encrypted using TLS or an equivalent contemporary protocol.
4.2 At rest. Information is encrypted using industry-standard algorithms where platform capabilities permit.
4.3 Minimisation. I collect and retain only the information necessary for stated purposes and dispose of information securely when it is no longer required.
5Access control
5.1 Access is granted on the principle of least privilege and on a need-to-know basis. Strong authentication and multi-factor authentication are enabled wherever available. Credentials are held in a dedicated credential manager, never in plain text, and are rotated and revoked as warranted.
6Infrastructure and hosting
6.1 The Website is hosted by Vercel Inc. on its global edge network, and email and productivity services are provided by a third-party provider. These providers may process data in the United States and other jurisdictions.
6.2 Network controls are applied through provider features and my own configuration, including firewalling and access restriction, and environments and datasets are segregated.
7Application security
7.1 Secure coding and configuration practices are integrated into development. Dependencies are managed, patches and updates are applied promptly with security updates prioritised, and changes are tested and reviewed before release to production.
8Logging and monitoring
8.1 Security events are logged across my systems to detect anomalous or unauthorised activity, and I monitor for indicators of compromise within the capabilities of my tooling and providers. Logs are retained appropriately and protected as sensitive information.
9Third parties and sub-processors
9.1 I conduct due diligence on service providers proportionate to the sensitivity of the information involved and the criticality of the service, and I seek contractual safeguards addressing confidentiality, security and the handling of personal information. I do not engage providers whose security posture is inadequate.
10Incident response and breach notification
10.1 Suspected and actual incidents are contained, assessed for nature and scope, remediated at their cause and recorded, together with the steps taken in response.
10.2 I comply with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth): I assess suspected breaches against its thresholds and notify affected individuals and the Office of the Australian Information Commissioner where required. I coordinate with affected clients in accordance with engagement terms.
10.3 Vulnerability reports are received and triaged under my Responsible Disclosure policy and escalated as incidents where warranted.
11Business continuity and backups
11.1 Critical data is backed up so that it can be restored after loss, corruption or failure, and backups are protected consistently with the information they contain. Continuity and recovery measures are proportionate to my operational scale and are reviewed periodically.
12Personnel and confidentiality
12.1 I am bound by professional, contractual and legal obligations of confidentiality. Contractors and collaborators must be bound by confidentiality obligations, and must agree to handle information in accordance with this policy, before any access is granted.
13Frameworks
13.1 My controls are aligned with, and use as reference, the Australian Cyber Security Centre’s Essential Eight, ISO/IEC 27001 and the NIST Cybersecurity Framework. I do not claim certification, accreditation or independent attestation against any of them.
14Privacy
14.1 This policy addresses information security only. The collection, use and disclosure of personal information are governed by my Privacy Policy and the Privacy Act 1988 (Cth).
15Review
15.1 This policy and my controls are reviewed at least annually, and after any material change to my systems or services, any material change in the threat environment or any significant security incident.
16Reporting a security concern
16.1 Report vulnerabilities in accordance with my Responsible Disclosure policy to max@vidler.io, and do not disclose them publicly until I have had a reasonable opportunity to investigate and respond.
17Contact
17.1 Maxwell Vidler (ABN 91 401 839 052) · max@vidler.io · Level 1, 16 McDougall Street, Milton QLD 4064. This policy is governed by the laws of Queensland.
1Purpose and scope
1.1 This policy explains how vidler.io (the ‘Website’) uses cookies and similar technologies. Any personal information collected through them is handled in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and my Privacy Policy.
2What cookies and tracking technologies are
2.1 Cookies are small text files placed on your device by a website. Comparable technologies include pixels, tags, local storage and software development kits. First-party technologies are set by the website you visit; third-party technologies are set by external services.
3What the Website uses
3.1 Strictly necessary only. The Website sets no cookies of its own and does not use local storage. Strictly necessary processing is limited to standard server logs and the requests your browser makes to Google Fonts to load typefaces.
3.2 Not in use. The Website uses no preference, analytics, advertising or cross-site tracking technologies and builds no advertising profiles.
4Personal information and analytics
4.1 Server log data, such as IP addresses, may be personal information under applicable privacy law and is handled accordingly. No analytics service operates on the Website. I will update this policy before introducing one.
5Consent and managing your preferences
5.1 The Website displays no consent notice because it uses no non-essential cookies. You may block or delete cookies, and block third-party requests, through your browser settings. Blocking typeface requests will change the Website’s appearance but not its content.
6Third-party services
6.1 The third-party services involved in operating the Website — my hosting provider, Vercel Inc., and Google Fonts — are assessed before use in accordance with my Security Policy. I do not sell information collected through the Website or disclose it to third parties, except as required to operate the Website or by law.
7Retention
7.1 Because the Website sets no cookies, no cookie retention periods apply. Server log data is retained only for as long as necessary for the operation and security of the Website, in accordance with my Privacy Policy.
8Changes and contact
8.1 I will update this policy to reflect changes to the Website, technology or law, and will notify visitors of material changes. Questions may be directed to max@vidler.io.
1About this statement
1.1 This statement is made by Maxwell Vidler (ABN 91 401 839 052), a sole trader trading in my own name (‘I’, ‘me’ or ‘my’).
1.2 I am not a reporting entity under the Modern Slavery Act 2018 (Cth) (the ‘Act’). Section 5 of the Act applies the reporting requirement to entities with consolidated revenue of at least $100 million. I publish this statement voluntarily, for transparency, and structure it around the mandatory criteria in section 16(1) of the Act.
1.3 ‘Modern slavery’ has the meaning given in section 4 of the Act. It includes conduct that would constitute an offence under Division 270 or 271 of the Criminal Code (Cth) — such as slavery, servitude, forced labour, forced marriage, debt bondage, deceptive recruiting and trafficking in persons — and the worst forms of child labour.
2My structure, operations and supply chains
2.1 Structure. I operate as a sole trader from Brisbane, Queensland. I do not own or control any other entity.
2.2 Operations. I provide specialised solutions architecting and fractional leadership in governance, strategy, and change to organisations in Australia, and I deliver those services personally.
2.3 Supply chains. My supply chain is small. It consists principally of: (a) cloud software and hosting services, including website hosting by Vercel Inc. and email and productivity services; (b) information technology hardware, such as computers and mobile devices; (c) office accommodation and related building services in Milton, Queensland; and (d) professional services, including legal, accounting and insurance services.
3Risks of modern slavery
3.1 I assess the risk of modern slavery in my own operations as low. My operations consist of professional services that I deliver personally in Australia.
3.2 The risks in my supply chain lie principally beyond my direct suppliers: in the manufacture of information technology hardware and its components, and in outsourced building services such as cleaning. Both involve long supply chains or labour-intensive work that I cannot observe directly.
4Actions I take to assess and address those risks
4.1 When I select or renew a significant supplier, I consider whether it publishes a modern slavery statement or a supplier code of conduct, and I prefer suppliers that do.
4.2 Where I advise clients on governance, compliance or procurement, I identify the modern slavery obligations and risks relevant to the engagement.
4.3 If I identify modern slavery in my operations or supply chain, I will act in proportion to the harm and in the interests of the people affected. Action may include working with the supplier on remediation, ending the relationship, or reporting the matter to the Australian Federal Police.
5Assessing the effectiveness of these actions
5.1 I review this statement and my significant suppliers at least once each year, and whenever I engage a new significant supplier. I record each review, any concern identified and the action taken.
6Consultation
6.1 I do not own or control any other entity, so no consultation with owned or controlled entities was required in preparing this statement.
7Raising a concern
7.1 Anyone with a concern about modern slavery connected with my operations or supply chain may contact me at max@vidler.io.
7.2 Suspected human trafficking or slavery can be reported to the Australian Federal Police on 131 AFP (131 237) or through the human trafficking and slavery report form at afp.gov.au. In an emergency, call 000 and ask for police.
8Approval
8.1 This statement is made by Maxwell Vidler, Principal. It will next be reviewed by September 2027.
What I believe