Karamawari Privacy Policy

Last updated: August 26, 2026

1. Our commitment to your privacy

Karamawari respects your privacy and is committed to handling personal information responsibly, transparently and securely.

This Privacy Policy explains how Karamawari Pty Ltd, trading as Karamawari (“Karamawari”, “we”, “us” or “our”), collects, uses, stores, protects and discloses personal information when you interact with us, including when you:

• visit our website;
• contact or correspond with us;
• subscribe to communications;
• enquire about or engage our services;
• attend meetings, workshops or events;
• interact with us through professional or social media platforms; or
• otherwise conduct business with us.

We comply with applicable privacy and data protection laws, including the Australian Privacy Act 1988 (Cth) and Australian Privacy Principles where applicable. Where other privacy laws apply to our activities or to individuals with whom we interact, we will handle personal information in accordance with those applicable requirements.

2. Personal information we collect

The personal information we collect depends upon how you interact with us.

It may include:

• your name;
• job title, organisation and professional responsibilities;
• business address;
• email address and telephone number;
• information contained in enquiries or correspondence;
• information you provide when engaging Karamawari;
• information relating to meetings, workshops or other professional interactions;
• marketing and communication preferences;
• information you provide through forms on our website;
• publicly available professional information;
• technical information relating to your use of our website, such as IP address, browser type, device information, referring pages and website activity; and
• any other personal information you voluntarily provide to us.

We seek to collect only information that is reasonably necessary for our legitimate business activities and services.

3. Sensitive information

Karamawari does not generally seek to collect sensitive personal information through its website.

During advisory engagements, however, information provided to us may occasionally contain information that is considered sensitive under applicable privacy laws.

Where sensitive information is collected, we will handle it with appropriate care and only collect, use or disclose it where we have an appropriate legal basis to do so.

Please avoid providing sensitive personal information through general website enquiry forms unless it is necessary for your enquiry.

4. How we collect personal information

We may collect personal information:

• directly from you;
• through our website;
• through email, telephone calls, meetings or correspondence;
• during the provision of our services;
• through referrals and introductions;
• from your organisation or colleagues where appropriate;
• through professional networking platforms;
• from publicly available sources; and
• through service providers supporting our website and business operations.

Where practicable and lawful, you may interact with us anonymously or using a pseudonym. However, there will be circumstances where we need to know your identity in order to respond to you or provide our services.

5. Why we use personal information

We may collect and use personal information to:

• respond to enquiries;
• provide and improve our services;
• communicate with clients and prospective clients;
• understand client requirements;
• administer client relationships and engagements;
• arrange meetings and workshops;
• prepare proposals and agreements;
• operate and improve our website;
• maintain the security and integrity of our systems;
• manage our business and professional relationships;
• send information, insights or marketing communications where permitted by law;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal rights; and
• prevent fraud, misuse or unlawful activity.

We will not use personal information for materially unrelated purposes unless permitted by law or, where required, we have obtained your consent.

6. Legal bases for processing

Where laws such as the EU GDPR or UK GDPR apply and require us to identify a lawful basis for processing personal data, we may rely upon one or more of the following:

Contract — where processing is necessary to enter into or perform an agreement with you.

Legitimate interests — where processing is reasonably necessary for our legitimate business interests or those of another party, provided those interests are not overridden by your rights and interests.

Consent — where you have freely given us consent for a particular purpose and applicable law permits us to rely upon that consent.

Legal obligation — where processing is necessary for us to comply with a legal obligation.

Legal claims and other permitted grounds — where applicable privacy laws otherwise permit or require processing.

Where processing relies upon consent, you may withdraw that consent at any time, although this will not affect processing lawfully undertaken before withdrawal.

7. Marketing communications

We may occasionally send you information about Karamawari, our services, insights or events where we are legally permitted to do so.

You may opt out of marketing communications at any time by using the unsubscribe facility included in the communication or by contacting us.

Opting out of marketing communications will not prevent us from sending communications that are necessary for an existing business relationship or engagement.

8. Cookies and website technologies

Our website may use cookies and similar technologies to operate the website, remember preferences, understand website usage, maintain security and improve the visitor experience.

Some technologies may be essential for operation of the website, while others may be used for analytics, functionality or marketing.

Where required by applicable law, non-essential cookies and similar technologies will not be activated until you have provided the required consent.

You can manage your preferences by clicking on the cookie icon in the bottom left corner of the web browser

9. Disclosure of personal information

We may disclose personal information where reasonably necessary to:

• technology and hosting providers;
• professional advisers;
• contractors and service providers;
• communications and email service providers;
• analytics providers;
• organisations assisting us in delivering services;
• regulatory, law enforcement or government authorities where required or authorised by law; and
• other parties where you have authorised us to do so.

We do not disclose personal information unnecessarily and expect service providers handling personal information on our behalf to protect it appropriately.

Karamawari does not sell personal information for money.

10. International transfers and overseas disclosure

Some of our technology providers or other service providers may store or process information outside Australia.

Where personal information is transferred internationally, we take reasonable and appropriate measures to ensure it is protected in accordance with applicable privacy and data protection laws.

Where required, these measures may include contractual protections or other recognised safeguards for international transfers.

Personal information may be processed or stored in Australia and United States of America.

This section should not be left generic if Karamawari is subject to the APPs and overseas recipients can reasonably be identified. APP 1 expressly requires a privacy policy to state whether overseas disclosures are likely and, where practicable, identify the countries concerned.

11. How we protect personal information

We take reasonable administrative, technical and organisational measures designed to protect personal information against:

• loss;
• misuse;
• interference;
• unauthorised access;
• unauthorised disclosure; and
• unauthorised alteration.

These measures may include access controls, authentication, appropriate technology safeguards, secure service providers and internal information-handling practices.

No method of electronic transmission or storage is completely secure, however, and we cannot guarantee absolute security.

12. How long we retain information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

• provide services;
• maintain appropriate business records;
• manage our relationship with you;
• comply with legal, tax, accounting or regulatory obligations;
• resolve disputes; and
• establish or defend legal claims.

When personal information is no longer reasonably required and we are not legally required to retain it, we will take appropriate steps to delete, destroy or de-identify it.

Specific retention periods may vary according to the nature of the information and the reason it is held.

13. Your privacy rights

Depending upon where you live and which privacy laws apply, you may have rights concerning your personal information.

These may include the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal information;
• restrict or object to certain processing;
• withdraw consent;
• object to direct marketing;
• request portability of certain personal information;
• obtain information concerning how we use and disclose your information;
• opt out of certain sales, sharing or targeted advertising where applicable; and
• lodge a complaint with an applicable privacy or data protection authority.

Not every right applies in every jurisdiction or circumstance.

We will not unlawfully discriminate against you for exercising an applicable privacy right.

To exercise a privacy right, contact us using the details below. We may need to verify your identity before completing your request.

14. Australian privacy rights

If the Australian Privacy Principles apply to your personal information, you may request access to personal information we hold about you and request that inaccurate, out-of-date, incomplete, irrelevant or misleading information be corrected.

You may also complain if you believe we have breached an applicable Australian privacy obligation.

We will consider and respond to requests and complaints in accordance with applicable law.

The OAIC specifically requires an APP privacy policy to explain how individuals can seek access or correction and how they can complain about an APP breach and how that complaint will be handled.

15. European Economic Area and United Kingdom

Where the EU GDPR, UK GDPR or related data protection legislation applies to our processing, individuals may have additional rights, including rights of access, rectification, erasure, restriction, objection and data portability, subject to applicable limitations.

You may also have the right to lodge a complaint with the data protection supervisory authority responsible for your jurisdiction.

Where we are required to appoint an EU or UK representative or Data Protection Officer, the applicable contact details will be provided here:

GDPR/UK GDPR transparency rules require organisations to provide privacy information at collection and, in relevant circumstances, when information is obtained indirectly. The information must be concise, transparent, intelligible and easily accessible.

16. United States privacy rights

Residents of certain US states may have additional privacy rights under applicable state laws.

Depending upon the law and whether it applies to Karamawari, these may include rights to know or access personal information, correct information, delete information, obtain a portable copy, and opt out of certain uses or disclosures.

Where required, Karamawari will provide applicable notices and mechanisms for exercising those rights.

[This section should be expanded if Karamawari meets the applicability thresholds of California or another US state privacy law, particularly if advertising or cross-context behavioural tracking is used.]

California's current rules also impose detailed requirements concerning the presentation, accessibility and content of privacy disclosures.

17. Children's privacy

Karamawari's website and services are intended for businesses and professionals and are not directed toward children.

We do not knowingly seek to collect personal information from children through our website.

If you believe a child has provided personal information to us inappropriately, please contact us so we can investigate and take appropriate action.

18. Third-party websites

Our website may contain links to websites, platforms or services operated by third parties.

Karamawari does not control the privacy practices of those third parties. We encourage you to review their privacy policies before providing personal information to them.

19. Automated decision-making and artificial intelligence

Karamawari does not currently use personal information collected through this website to make solely automated decisions that produce legal or similarly significant effects concerning individuals.

If this changes, we will update this Privacy Policy and provide any additional information, rights or safeguards required by applicable law.

This deserves particular attention in Australia now: the OAIC states that from 10 December 2026, APP entities will have additional privacy-policy disclosure obligations where they arrange for computer programs to use personal information in decisions that could reasonably be expected to significantly affect an individual's rights or interests.

20. Privacy complaints

If you have concerns about how Karamawari has handled your personal information, please contact us first using the details below.

We will:

1. acknowledge your complaint within a reasonable period;
2. investigate the matter appropriately;
3. communicate the outcome to you; and
4. take reasonable corrective action where appropriate.

If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant privacy or data protection regulator in your jurisdiction.

In Australia, this may include the Office of the Australian Information Commissioner (OAIC).

21. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technology, services or legal obligations.

The current version will be published on this website and will identify the date it was last updated.

Where a change materially affects how we use personal information, we will provide additional notice where required by applicable law.

22. Contact us

Questions, requests or complaints concerning privacy can be directed to:

Karamawari
Legal entity: Karamawari Pty Ltd
Privacy contact: Andrew Bycroft
Email: privacy@karamawari.com
Postal address: Level 1, 63-73 Ann St, Surry Hills NSW 2010
Country: Australia