Privacy Policy

Effective date: 9 September 2026
Last updated: 9 September 2026
Applies to: thegluegroup.com and any subdomain of it

This Privacy Policy explains how The Glue Group handles personal information collected through this website. We take privacy seriously. We operate a certified information security management system and we apply a single global standard to how we handle personal information, aligned to the strictest of the privacy laws that apply to us.

1. Who we are

This website is operated by We're The Glue Pty Ltd (ACN 612 411 668, ABN 14 612 411 668), an Australian private company trading as The Glue Group, of 19 David Avenue, North Ryde NSW 2113, Australia. We are the data controller, and the APP entity, responsible for personal information collected through this website.

In this Privacy Policy, "we", "us" and "our" mean We're The Glue Pty Ltd. "Group Entities" means We're The Glue Pty Ltd, Illuminance Labs Kft (Hungary), Trust Panda Limited (New Zealand), Illuminance Labs LLC (United States), and each other subsidiary, related body corporate or affiliate within The Glue Group from time to time.

2. What this policy covers, and what it does not

This policy covers personal information we collect through this website, which is the corporate website of The Glue Group. This website is informational. It is not a transactional or e-commerce site and no goods or services are sold through it.

3. Our global compliance approach

We handle personal information in accordance with:

• the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including the Notifiable Data Breaches scheme;
• the EU General Data Protection Regulation, where we process personal data of individuals in the European Economic Area;
• the UK General Data Protection Regulation and the Data Protection Act 2018, where we process personal data of individuals in the United Kingdom;
• the New Zealand Privacy Act 2020 and the Information Privacy Principles;
• the California Consumer Privacy Act as amended by the California Privacy Rights Act, where it applies to our United States operations; and
• the Spam Act 2003 (Cth) and equivalent electronic marketing rules in the other markets in which we operate.

Rather than maintaining different standards by region, we apply one internal standard across the Group Entities and give every individual the substance of the rights described in section 11, wherever they are located. Our information security management system is certified to ISO/IEC 27001 and our quality management system to ISO 9001, both audited annually by BSI.

4. What personal information we collect

4.1 Information you give us

When you complete an enquiry form on this website we collect the information you enter, which is:

• your enquiry type, being investment or partnership, procurement or vendor validation, brand partnership or distribution, or career interest;
• your first name and last name;
• your organisation;
• your role or title;
• your email address;
• your country; and
• the content of your message.

If you contact us by telephone or email using the details on this website, we collect the contact details you use and the content of your correspondence. If you express interest in a career with us, we also collect whatever you choose to include, which may extend to your employment history, qualifications, professional registrations, right to work and referee details.

4.2 Information we collect automatically

When you visit this website we and our service providers automatically collect technical and usage information, including your IP address, approximate location derived from that address, browser and device type, operating system, screen and language settings, referring page, the pages you view, the links you follow, and the date, time and duration of your visit.

4.3 Information from other sources

We may collect information about you from publicly available sources such as company registers, ASIC and equivalent registers, professional networking sites, and your organisation's own website, where that information is relevant to an enquiry you have made or a commercial relationship we are considering. We may also receive your details from a colleague, a referrer or an introducer.

4.4 Sensitive information

We do not seek sensitive information through this website. That includes health information, information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation, biometric or genetic data, and criminal records. Please do not submit it through an enquiry form. If you send it to us anyway, we will handle it in accordance with this policy and applicable law and will delete it where we have no lawful basis and no need to keep it.

4.5 Children

This website is directed at business and professional audiences. It is not directed at children and we do not knowingly collect personal information from anyone under 16 through it. If you believe a child has provided us with personal information, please contact our Privacy Officer and we will delete it.

5. Why we collect it, and our lawful basis

Where we rely on legitimate interests, we have assessed that our interest in operating and protecting this website and in pursuing legitimate commercial and recruitment enquiries is not overridden by your interests, rights and freedoms. You can ask us for our assessment.

Under the Australian Privacy Principles, we collect only what is reasonably necessary for these functions and activities, and we do not use or disclose personal information for an unrelated secondary purpose without your consent unless an exception in the Privacy Act applies.

6. Cookies and analytics

Cookies are small files placed on your device. This website uses the following categories.

We do not use advertising, retargeting or social media tracking cookies on this website, and we do not run behavioural advertising from it.

6.1 Your cookie choices

If you are visiting from the European Economic Area or the United Kingdom, we ask for your consent before setting analytics cookies, and you can accept, decline or change your choice at any time through the cookie preferences control on this website. Declining analytics cookies does not affect your access to any part of this website.

Wherever you are located, you can also block or delete cookies through your browser settings, and you can opt out of Google Analytics specifically by installing the Google Analytics Opt-out Browser Add-on. Blocking strictly necessary cookies may stop parts of this website working. We have enabled IP anonymisation in Google Analytics and we have not enabled Google Signals, advertising features or data sharing for advertising purposes.

This website does not currently respond to Do Not Track browser signals, because there is no common standard for how to interpret them. We do honour Global Privacy Control signals where our platform supports them.

7. Who we disclose personal information to

We disclose personal information collected through this website only as follows:

• Group Entities. So that your enquiry reaches the team best placed to answer it, and for group governance, finance, risk and recruitment purposes.
• Our service providers. Including Webflow, our website platform and form host; Cloudflare, our content delivery, bot protection and security provider; Google, for website analytics; and Microsoft, for our email, document and collaboration systems. These providers act on our instructions under written agreements that restrict what they may do with the information.
• Our outsourced support provider in the Philippines. A business process outsourcing provider supports back-office and customer service functions for one of our brands. Its access is limited to what those functions require and is subject to written confidentiality and data protection obligations.
• Professional advisers. Our lawyers, accountants, auditors and certification bodies, where they need the information to advise us or to audit us.
• Acquirers. A prospective purchaser or investor in connection with a sale, restructure or reorganisation of a Group Entity or its business, under confidentiality obligations.
• Regulators, courts and law enforcement. Where we are required or authorised by law to disclose, or where disclosure is necessary to establish, exercise or defend legal claims.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not disclose it to data brokers. Under the CCPA as amended, we have not sold or shared personal information in the preceding 12 months.

8. Overseas disclosure and transfers

We are an international group and our providers are international, so personal information collected through this website may be accessed from or stored in countries other than the one you are in. The recipient countries are, or are likely to be:

• Australia, where our parent entity and primary systems are located;
• Hungary and the European Union, where Illuminance Labs Kft operates;
• New Zealand, where Trust Panda Limited operates;
• the United States, where Illuminance Labs LLC operates and where Webflow, Cloudflare, Google and Microsoft process data; and
• the Philippines, where our outsourced support provider operates.

For the purposes of Australian Privacy Principle 8, we take reasonable steps to ensure that overseas recipients handle personal information in a way consistent with the Australian Privacy Principles, principally through contractual data protection terms, and we remain accountable to you for their handling of it.

For transfers of personal data out of the European Economic Area or the United Kingdom to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, together with a transfer risk assessment and technical measures including encryption in transit and at rest. You can request a copy of the relevant transfer mechanism by contacting our Privacy Officer.

For the purposes of the New Zealand Privacy Act 2020, we take the steps required by Information Privacy Principle 12 before disclosing personal information outside New Zealand.

9. How long we keep it

We keep personal information only as long as we need it. Our standard periods for information collected through this website are:

At the end of the applicable period we delete the information or de-identify it so that it can no longer be associated with you. Where deletion is not technically possible, for example in a backup that is scheduled to expire, we isolate the information and delete it when that backup expires.

10. How we protect it

We maintain an information security management system certified to ISO/IEC 27001 and independently audited by BSI each year. Our controls include role-based access on a need-to-know basis, phishing-resistant multi-factor authentication for our own staff, encryption of data in transit and at rest, network and application-layer protection at the edge, logging and monitoring, supplier security assessment, staff training, and an incident response plan that is tested.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Enquiry forms and email are not secure channels. Please do not send us payment card details, account credentials, government identifiers or health information through them.

10.1 If something goes wrong

If we suffer a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Where the GDPR or UK GDPR applies, we will notify the competent supervisory authority within 72 hours of becoming aware of a reportable breach, and will notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms. Where the New Zealand Privacy Act applies, we will notify the Office of the Privacy Commissioner of any notifiable privacy breach.

11. Your rights and choices

Subject to the exceptions in the applicable law, you can ask us to:

Access your information

Get confirmation of whether we hold personal information about you, and a copy of it.

Correct it

Have inaccurate or incomplete information corrected or completed.

Delete it

Have it erased where we no longer have a lawful reason to keep it.

Restrict or object to our use of it

Have our processing paused while a concern is resolved, or object to processing we base on legitimate interests, including any profiling.

Receive it in a portable form

Get the information you gave us in a structured, commonly used, machine-readable format, or have us send it to another controller where that is technically feasible.

Withdraw consent

Withdraw a consent you have given at any time, without affecting the lawfulness of processing before you withdrew it.

Opt out of direct marketing

Unsubscribe from our communications at any time, using the unsubscribe link in any message or by contacting us.

Not be discriminated against

Exercise any of these rights without receiving a lesser service or a different price from us.

We do not make decisions about you that are based solely on automated processing and that produce legal effects or otherwise significantly affect you.

11.1 How to exercise a right

Contact our Privacy Officer using the details in section 14. We will ask for enough information to verify your identity so that we do not disclose your information to someone else. We respond within 30 days under the Australian Privacy Principles, and within one month where the GDPR or UK GDPR applies, extendable by two further months for complex requests, in which case we will tell you. We do not charge a fee to access your information, although we may charge a reasonable, non-excessive fee for the cost of giving it to you where the Privacy Act permits. If we refuse a request, we will tell you why in writing and explain how to complain. An authorised agent may act for you if you give them written authority.

12. Complaints

If you are concerned about how we have handled your personal information, please raise it with our Privacy Officer first. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to a regulator:

• Australia: Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992.
• European Economic Area: your local data protection authority, or the Hungarian National Authority for Data Protection and Freedom of Information, naih.hu.
• United Kingdom: Information Commissioner's Office, ico.org.uk.
• New Zealand: Office of the Privacy Commissioner, privacy.org.nz.

13. Our EU representative

For the purposes of Article 27 of the EU GDPR, we have designated Illuminance Labs Kft in Hungary as our representative in the European Union. Individuals in the European Economic Area, and supervisory authorities, may contact our EU representative on any matter relating to our processing of personal data under the GDPR, by writing to the Privacy Officer at the address in section 14 and marking the correspondence for the attention of the EU Representative, Illuminance Labs Kft.

Contacting our EU representative does not limit your right to contact us directly or to complain to your local supervisory authority.

14. How to contact us

Our Privacy Officer is responsible for this policy and for handling privacy enquiries, requests and complaints across the Group Entities.

The Privacy Officer
We're The Glue Pty Ltd trading as The Glue Group
ABN 14 612 411 668 | ACN 612 411 668
19 David Avenue, North Ryde NSW 2113, Australia
Email: privacy@theglue.com.au
Telephone: +61 2 9157 4555

For security vulnerability reports, please use security@theglue.com.au. For all other enquiries, see thegluegroup.com/contact.

15. Changes to this policy

We may update this policy to reflect changes in our practices, our systems or the law. We will publish the updated version on this page and update the "Last updated" date above. Where a change materially affects how we handle personal information we have already collected, we will take reasonable steps to tell you before the change takes effect, and will seek your consent where the law requires it. Previous versions are available from our Privacy Officer on request.

This policy should be read together with our Terms of Use.