Privacy Policy

KeysToMarketing Pty Ltd (ACN 627 085 456), trading as DoubleKlick

Effective date: 28/10/2026 Version: 1.0

Contents

1. About this policy
2. Who we are
3. The personal information we collect
4. How we collect personal information
5. Why we collect, hold, use and disclose personal information
6. Our use of artificial intelligence
7. Automated decision-making
8. Call recording and transcription
9. Information we handle on behalf of our clients
10. Who we disclose personal information to
11. Overseas disclosure
12. Cookies, analytics and advertising technology
13. Direct marketing
14. How we hold and secure personal information
15. Retention and destruction
16. Accessing and correcting your personal information
17. Anonymity and pseudonymity
18. Data breaches
19. Children
20. Complaints
21. Changes to this policy
22. Contact us

1. About this policy

This Privacy Policy explains how KeysToMarketing Pty Ltd (ACN 627 085 456), trading as DoubleKlick (DoubleKlick, we, us, our), collects, holds, uses and discloses personal information, and how you can access and correct that information or make a complaint.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). Where relevant, we also comply with the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), the Surveillance Devices Act 2007 (NSW) and equivalent State and Territory surveillance legislation, and the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

Although DoubleKlick may fall within the small business exemption in the Privacy Act, we have chosen to comply with the Privacy Act and the APPs in full as a matter of policy, and we handle all personal information as if we were bound by them.

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information is true and whether or not it is recorded in a material form. Sensitive information is a subset of personal information that receives a higher level of protection and includes information about health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and biometric information.

This policy applies to personal information we collect through our website at doubleklick.com (Website), by email, phone and other direct communications, and in the course of providing our services. It does not apply to third-party websites or services linked from our Website, which have their own privacy policies.

2. Who we are

DoubleKlick is an Australian AI agency. We design, build, deploy and operate AI-powered systems and agents for business clients, including conversational agents, voice agents, workflow automation, software development, infrastructure and cybersecurity services.

3. The personal information we collect

The kinds of personal information we collect depend on how you interact with us. They may include:

Identity and contact information

• Name, job title, organisation
• Email address, phone number, postal address
• Social media handles and professional profile links

Enquiry and engagement information

• The content of enquiries, requests, feedback and correspondence
• Details of the products and services you are interested in or have engaged us to provide
• Information in proposals, contracts and project documentation
• Billing and payment details (we do not store full payment card numbers; card payments are processed by our payment provider)

Communications and interaction records

• Emails, messages and SMS exchanged with us
• Recordings and transcripts of calls and meetings, where recording has been announced and consented to (see section 8)
• Interactions with AI agents we operate, including conversation logs and transcripts

Technical and usage information

• IP address, device type, browser type and version, operating system
• Pages visited, time spent, referring URLs, clickstream data
• Cookie identifiers, advertising identifiers and similar tracking identifiers (see section 12)

Marketing preferences

• Whether you have subscribed to or unsubscribed from our communications
• Your preferred channels and topics

Recruitment information (if you apply to work with us)

• CV, qualifications, employment history, references, right-to-work information

Sensitive information We do not ask for sensitive information and do not need it to provide our services. If you choose to provide sensitive information to us (for example, by mentioning a health condition in a call or an enquiry), we will only collect and use it where you have consented and it is reasonably necessary for one of our functions or activities, or where otherwise permitted by law. We will take reasonable steps to delete sensitive information that is not required.

4. How we collect personal information

We collect personal information directly from you wherever reasonably practicable, including when you:

• Submit a contact, enquiry or quote request form on our Website
• Subscribe to our newsletter or other communications through a sign-up form
• Email, call or message us, or interact with an AI agent we operate
• Engage us to provide services, or are a representative or contact of a client, supplier or partner that does
• Attend a meeting, demonstration, webinar or event we run or participate in
• Apply for a role with us
• Connect with us on social media or professional networks

We collect technical and usage information automatically through cookies, pixels and similar technologies when you use our Website (see section 12).

We may also collect personal information from third parties, including:

• Our clients, where you are their customer, employee, contractor or contact and we handle your information on their behalf (see section 9)
• Publicly available sources, such as company websites, professional networks and public registers, where you have made your contact details publicly available in a business capacity
• Our service providers, such as analytics, advertising and communications platforms
• Referrers and business partners

If we collect personal information about you from someone else, or if you provide us with personal information about another person (for example, a colleague), we rely on you to have told that person about this policy and, where required, obtained their consent.

If you provide us with unsolicited personal information that we could not have collected under the APPs, we will destroy or de-identify it as soon as practicable, unless we are required by law to retain it.

5. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for the following purposes (Primary Purposes):

• Responding to enquiries and requests
• Providing quotes, proposals and demonstrations
• Entering into and performing contracts with clients, suppliers and partners
• Designing, building, testing, deploying, hosting, monitoring, maintaining and supporting AI systems, agents, software and infrastructure for our clients
• Operating AI agents on behalf of our clients, including handling conversations, calls, messages and workflows
• Billing, payment processing, account management and debt recovery
• Communicating with you about our services, projects and relationship
• Sending marketing communications where you have opted in (see section 13)
• Improving our Website, services and customer experience, including through analytics and testing
• Measuring the performance of our marketing and advertising
• Managing security, preventing fraud and misuse, and protecting our systems, clients and staff
• Recruiting staff and contractors
• Complying with our legal, regulatory, accounting, tax and insurance obligations
• Establishing, exercising or defending legal claims

We may also use or disclose personal information for a secondary purpose where you have consented, where you would reasonably expect it and it is related (or directly related, for sensitive information) to a Primary Purpose, or where otherwise required or authorised by Australian law.

6. Our use of artificial intelligence

As an AI agency, the use of AI systems is central to our business. This section explains how AI is involved in our handling of personal information.

6.1 AI providers we use

We use third-party large language model and AI platform providers to build and run our services, including providers operated by Anthropic, OpenAI, Google and Microsoft (Azure), as well as AI models hosted on our own infrastructure. We may add or change providers from time to time; this policy will be updated when we do.

When personal information is included in a prompt, document, conversation, recording or dataset that is processed by an AI system, that information is transmitted to and processed by the relevant provider. Their servers are located outside Australia (see section 11).

We only use third-party AI providers through their commercial API, business or enterprise services, under terms that:

• Prohibit the provider from using our inputs and outputs to train or improve their models
• Limit retention of inputs and outputs to a defined period for abuse monitoring, safety and legal purposes (typically no more than 30 days), or provide for zero data retention where available and enabled
• Require the provider to keep the information confidential and secure

We do not use consumer-tier AI products (such as personal chat accounts) to process personal information belonging to clients, prospects or end users.

In addition:

• We limit the personal information included in prompts and inputs to what is reasonably necessary for the task
• We do not knowingly submit sensitive information to a third-party AI provider unless it is reasonably necessary and you have consented
• We maintain a register of which providers, services and regions are used for which systems, and review provider terms and settings at least every 6 months and whenever a provider changes its terms
• Models hosted on our own infrastructure process information within our environments and are not shared with any third party

6.2 What we do not do

• We do not use your personal information, or our clients' data, to train, fine-tune or evaluate AI models, and we do not permit our contractors to do so
• We do not sell personal information to anyone
• We do not use AI systems to make decisions that have a legal or similarly significant effect on individuals without human involvement (see section 7)

6.3 AI-generated content

Outputs generated by AI systems may be inaccurate, incomplete or out of date. Where an AI agent we operate provides information to you, it is not a substitute for professional advice, and the relevant client's terms and policies govern any decisions made on the basis of that information. Where practicable, AI agents we operate identify themselves as automated systems.

7. Automated decision-making

From 10 December 2026, APP 1.7 requires us to disclose in this policy certain uses of personal information in computer programs that make, or do something substantially and directly related to making, decisions that could reasonably be expected to significantly affect your rights or interests.

At the date of this policy, we do not use personal information in any computer program that makes such decisions, or that does anything substantially and directly related to making such decisions. Our AI agents respond to enquiries, carry out instructed tasks and record information; they do not score, screen, rank, price or assess individuals, and they do not grant or refuse any benefit.

If this changes, we will update this section to describe:

• The kinds of personal information used in the operation of the relevant computer program
• The kinds of decisions made solely by the computer program
• The kinds of decisions for which the computer program does something substantially and directly related to making the decision

Where our clients configure systems we build to make automated decisions about their own customers, that use is governed by the client's privacy policy, not ours (see section 9).

8. Call recording and transcription

Some calls and meetings with us, and some calls handled by voice agents we operate, are recorded and transcribed.

• We tell you before recording starts. Recording does not begin until an announcement has been played or stated. On calls with our team you will hear: "This call is being recorded and transcribed for quality, training and record-keeping purposes. By continuing, you consent to the recording. If you would prefer not to be recorded, please let me know now and we can continue in writing instead." Voice agents we operate identify themselves as automated assistants and give an equivalent notice, for example: "I'm an automated assistant. This call is recorded and transcribed. By continuing you agree to that; if you'd rather not be recorded, say 'no recording' and I'll give you another way to reach us." Meetings that are recorded are announced at the start of the meeting and in the invitation. By continuing after the announcement, you consent to the recording. If you do not consent, tell us or the agent and recording will not proceed; you will be offered email or a callback instead. We keep a record of the announcement and your response with each recording
• Why we record. We record and transcribe to keep an accurate record of instructions and requests, to deliver the service the call relates to, to monitor quality and safety, to train and supervise our people (not to train AI models), and to resolve disputes
• How recordings are processed. Recordings are transcribed and may be summarised using AI systems described in section 6, which means recordings and transcripts may be processed by overseas providers (see section 11)
• How long we keep them. Recordings and transcripts are retained for up to 12 months from the date of the call, unless a longer period is required to resolve a dispute, comply with a legal obligation or at the documented request of a client in respect of calls handled on their behalf. They are then deleted or de-identified
• Access. You can request a copy of a recording or transcript of a call you participated in (see section 16)

9. Information we handle on behalf of our clients

Much of the personal information we handle belongs to our clients' customers, employees, contacts and end users. We handle this information in two ways:

Build and hand over. Where we design and build a system for a client and the client then operates it, the client collects and controls the personal information processed by that system. We may access that information during build, testing, migration and support, strictly for those purposes.

Build and operate. Where we host, run, monitor or support a system or AI agent on an ongoing basis on behalf of a client, we process personal information on the client's instructions, for the client's purposes, under a written agreement with that client.

In both cases:

• The client is responsible for the collection of that information, for notifying individuals and for the privacy policy that governs its use
• We only use the information to provide the contracted services, to secure and maintain the system, and as otherwise instructed by the client or required by law
• We do not use it for our own marketing or for training AI models
• Our agreements with clients require us to apply the security, retention, overseas disclosure and breach notification standards described in this policy
• If you contact us about personal information we hold on behalf of a client, we will refer your request to that client or assist them to respond, unless we are able to respond directly under our agreement with them

10. Who we disclose personal information to

We disclose personal information to the following categories of recipients, only to the extent necessary for the purposes in section 5:

• Our staff and contractors, who are bound by confidentiality obligations and this policy
• AI and cloud infrastructure providers, including the providers named in section 6 and cloud hosting providers
• Communications providers, including email delivery services and Twilio for SMS and voice services
• Analytics and advertising platforms, including Google (Google Analytics 4), Meta, LinkedIn, Microsoft (Clarity) and Hotjar, as described in section 12
• Business systems providers, such as CRM, project management, document management, accounting, invoicing and payment processing services
• Our clients, where we handle information on their behalf or where you are a contact relevant to a client engagement
• Professional advisers, including lawyers, accountants, auditors and insurers
• Regulators, law enforcement, courts and government agencies, where required or authorised by law
• A purchaser or prospective purchaser of our business or assets, subject to confidentiality obligations

We require our service providers to handle personal information only for the purposes we specify, to keep it secure and confidential, and, where they are overseas, to meet the standards in section 11.

11. Overseas disclosure

We disclose personal information to recipients located outside Australia. The countries in which these recipients are likely to be located are:

• United States of America (AI providers, cloud infrastructure, communications, analytics and advertising platforms, business systems)
• Singapore (cloud infrastructure and AI providers' Asia-Pacific regions)
• Other Asia-Pacific countries in which our cloud and AI providers operate data centres, and where our clients may require services to be hosted

Our own hosting is located in Australia, the United States and Singapore. Where a client requires it and it is reasonably practicable, we host their systems and data in Australian regions.

Before disclosing personal information overseas we take reasonable steps to ensure the recipient does not breach the APPs in relation to that information, including by:

• Using providers that offer contractual data protection commitments, security certifications (such as ISO 27001 or SOC 2) and defined retention limits
• Configuring services to use Australian or other agreed regions where available
• Limiting the personal information disclosed to what is reasonably necessary
• Maintaining a register of overseas recipients and reviewing it periodically

You should be aware that overseas recipients may be subject to foreign laws that permit access to information by government authorities, and that you may not be able to seek redress under the Privacy Act for acts of an overseas recipient in all cases. Where we rely on your consent to an overseas disclosure, we will tell you this at the time.

12. Cookies, analytics and advertising technology

Our Website uses cookies, pixels, tags, local storage and similar technologies (cookies) to operate the site, understand how it is used and measure and deliver advertising.

Consent. When you first visit our Website you will see a cookie banner before any non-essential cookie is set. The banner lets you accept all, reject all, or choose by category (analytics, session replay, advertising). Nothing in the analytics, session replay or advertising categories loads until you opt in, and declining has no effect on your ability to use the Website. Your choice is stored in a consent cookie for up to 12 months, after which you will be asked again, and we keep a log of consent choices (timestamp, categories, consent string) as evidence. You can change or withdraw your choices at any time through the "Cookie settings" link in the footer of every page; withdrawal takes effect immediately for new data, and you can ask us to delete data already collected under your earlier choice. Strictly necessary cookies that are required for the Website to function and to remember your consent choice are set without consent.

Technologies we use

Each provider receives information such as your IP address, device identifiers, pages visited and interactions, and processes it under its own privacy policy. Information collected by Google, Meta, LinkedIn, Microsoft and Hotjar may be combined by those providers with other information they hold about you and may be transferred overseas.

Managing cookies. In addition to our cookie banner, you can control cookies through your browser settings, opt out of Google Analytics with the Google Analytics opt-out browser add-on, and manage advertising preferences through your Meta and LinkedIn account settings. Disabling cookies may affect the functionality of the Website.

We do not currently respond to "Do Not Track" browser signals, but we do honour the choices you make in our cookie banner.

13. Direct marketing

We only send direct marketing communications to people who have opted in to receive them. We do not cold-email or cold-call.

• Email and SMS. We send marketing emails and SMS messages (through Twilio) only where you have consented, in accordance with the Spam Act 2003 (Cth). Every message identifies us and includes a functional unsubscribe mechanism. Unsubscribe requests are actioned within 5 business days
• Phone. We do not make unsolicited telemarketing calls. Where we call you for marketing purposes, we do so only with your consent and in compliance with the Do Not Call Register Act 2006 (Cth)
• Online advertising. With your consent given through our cookie banner, we use the Meta Pixel and LinkedIn Insight Tag to show you ads on those platforms based on your visits to our Website. You can opt out through the cookie settings on our Website or through your Meta and LinkedIn account settings
• Opting out. You can opt out of any marketing at any time by using the unsubscribe link or reply instruction in the message, or by contacting privacy@doubleklick.com. We will continue to send you service and administrative communications that are not marketing, such as invoices and project notices, where you have a relationship with us

If you ask, we will tell you where we obtained your personal information for marketing purposes, to the extent it is reasonable and practicable to do so.

14. How we hold and secure personal information

We hold personal information in electronic form in cloud-hosted systems and on our own managed infrastructure. We hold minimal information in paper form.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, including:

• Encryption of data in transit and at rest
• Multi-factor authentication, role-based access controls and least-privilege access
• Logging and monitoring of access to systems that hold personal information
• Secure configuration and patching of infrastructure, and vulnerability management
• Separation of client environments and data
• Masking of form field contents in session replay tools
• Vetting of staff and contractors, confidentiality agreements and privacy and security training
• Due diligence on service providers, and contractual security obligations
• Regular backups with tested restoration
• An information security program aligned with the Australian Cyber Security Centre's Essential Eight and industry standards

No system is completely secure. If you believe your interaction with us is no longer secure, contact us immediately at privacy@doubleklick.com.

15. Retention and destruction

We keep personal information only for as long as it is reasonably necessary for the purposes for which it was collected, or as required by law. As a guide:

When personal information is no longer required, we take reasonable steps to destroy it securely or to de-identify it, including by deleting it from active systems and allowing backup copies to expire in the ordinary course.

16. Accessing and correcting your personal information

You have the right to request access to the personal information we hold about you and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

To make a request, contact the Privacy Officer at privacy@doubleklick.com. We will need to verify your identity before we respond.

• We will respond to access requests within 30 days. We will give you access in the manner you request where reasonable and practicable. We may charge a reasonable fee for providing access where the request involves significant effort, but we will not charge for making the request and we will tell you about any fee before proceeding
• We will respond to correction requests within 30 days. If we correct information that we have previously disclosed to another entity, we will take reasonable steps to notify that entity if you ask us to
• If we refuse access or correction, we will give you written reasons (except where it would be unreasonable to do so) and explain how you can complain. If we refuse to correct information, you can ask us to attach a statement to the record noting that you consider it inaccurate, out of date, incomplete, irrelevant or misleading

We may refuse access in the circumstances permitted by the Privacy Act, for example where giving access would unreasonably affect the privacy of others, would be unlawful, or would reveal commercially sensitive information.

If the information you are asking about is held by us on behalf of a client, we will refer your request to the client or assist them to respond (see section 9).

17. Anonymity and pseudonymity

Where it is lawful and practicable, you can deal with us anonymously or using a pseudonym, for example when making a general enquiry about our services. We will need your name and contact details to enter into a contract, provide services, respond to a detailed request or handle a complaint.

18. Data breaches

We maintain a Data Breach Response Plan that sets out how we identify, contain, assess, notify and review data breaches.

If we become aware of a data breach involving personal information that is likely to result in serious harm to any individual, and we are unable to prevent that risk through remedial action, we will notify the Office of the Australian Information Commissioner and affected individuals as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. We will provide a description of the breach, the kinds of information involved and recommended steps you can take.

Where a breach involves information we hold on behalf of a client, we will notify the client without undue delay in accordance with our agreement with them, and we will cooperate with the client in any assessment and notification.

19. Children

Our services and Website are directed at businesses and are not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact privacy@doubleklick.com and we will delete it. Where an AI agent we operate on behalf of a client is intended to be accessed by children, that agent is subject to the client's privacy policy and the client is responsible for compliance with the Children's Online Privacy Code.

20. Complaints

If you believe we have breached the Privacy Act, the APPs or this policy, or you are concerned about how we have handled your personal information, you can complain to our Privacy Officer:

• Email: privacy@doubleklick.com
• Post: Privacy Officer, KeysToMarketing Pty Ltd, PO Box 7991, Norwest NSW 2153

Please include your name, contact details, a description of your concern and what you would like us to do. We will acknowledge your complaint within 7 days, investigate it, and respond to you in writing within 30 days. If we need more time we will tell you why and when you can expect a response.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

21. Changes to this policy

We review this policy at least annually and whenever our practices or the law change. The current version is always available at doubleklick.com/privacy. Material changes will be flagged on our Website and, where we have your contact details and the change affects you significantly, by direct notice. Continued use of our Website or services after a change takes effect indicates your acceptance of the updated policy.

Scheduled review. This policy will be reviewed before 10 December 2026 to confirm compliance with the automated decision-making transparency requirements in APP 1.7 and 1.8 and the Children's Online Privacy Code, and again on passage of the Privacy Amendment (Personal Data Protection) Bill 2026 or any successor legislation.

22. Contact us

Privacy Officer KeysToMarketing Pty Ltd (trading as DoubleKlick) ACN 627 085 456 PO Box 7991, Norwest NSW 2153, Australia Email: privacy@doubleklick.com Website: doubleklick.com

Version history