Skip to content

    Privacy Policy

    October 2025

    Sandstone Technology is committed to protecting and respecting your privacy. We understand the importance of keeping personal information private and secure.

    This Privacy Notice describes generally how we collect and manage your personal information in connection with your use of this website and public events hosted by us. We will treat all personal information in accordance with any and all applicable data protection laws that are binding upon us including the Australia Privacy Act 1988 (Cth), the Philippines Data Privacy Act 2012, the UK General Data Protection Regulations and Data Protection Act 2018.

     

    How we may collect your personal information

    We only collect personal information that is necessary for us to conduct our business or to meet our legal and regulatory obligations. We will not collect, nor do not wish to receive in connection with your use of the website, any categories of sensitive personal information.

     

    Information that you provide

    We collect information from you when you provide us with personal information through submission portals available on the website or by correspondence when you contact us. Information collected may include your name, company, job title, email, phone number, and residential address. If you contact us by email or post, we will retain a record of that correspondence in accordance with our internal data retention policy.

    Personal information is also collected when you submit an application form or your resume through a third-party website; we interview you either over the phone, video conference or in person; we undertake reference checks by inquiring with, or we otherwise receive references or performance feedback from any of your former or current employers, work colleagues, professional associations, educational bodies or registration bodies. We may also collect the personal information of any individual who is contacted for the purposes of such reference checks.

     

    Information that is collected automatically

    We may obtain information from online tools such as marketing automation tools and online analytics tools, for example Google Analytics. This includes personal information as to which web pages you visit and how long you are on each page, your inferred country, your IP address or server name, traffic and other related data. We may ask you to provide personal information when accessing or downloading certain information from us such as your name, company, job title and contact details. We use this information to ensure our content has the most value to visitors to our website, to make changes to the layout and to respond to country specific regulations.

    Our website uses cookies to collect information about our customers' behaviours while using our website. This enables us to offer the best possible customer experience. The information is stored on a secure server and will be used in website analytics and reporting.

     

    How we may use and disclose your personal information

    We only collect, use, store and transmit personal information for legitimate purposes which are directly related to our business functions or activities and only when it is necessary for or directly related to such purposes.

    We do not transmit or disclose personal information collected from you to any individual or entity outside of authorised personnel at the Sandstone Group, unless one of the following applies:

    • you have provided explicit consent for the disclosure;
    • it is required or authorised by law. We may be required to disclose your personal information to government agencies as a result of a judicial proceeding, court order, or legal process in an applicable jurisdiction. We may also share your information with our related parties or advisers in connection with defending a claim.
    • where we have reasonable grounds to suspect unlawful activity or misconduct of a serious nature in connection with information.
    • it is reasonably necessary for the provision of our services
    • you would reasonably expect, or have been informed, that information of that kind is usually passed to those individuals, bodies or agencies;
    • to conduct appropriate checks for fraud or malicious activity; or
    • where reasonably necessary to investigate, evaluate and or respond to a data breach.

    We will maintain records of the particulars of our processing of your personal information provided in connection of your use of the website. These will be maintained in compliance with applicable data protection laws and in accordance with our internal data policies.

    You may withdraw your consent to the collection and processing of your personal information at any time by discontinuing your use of the website, contacting us at legal@sandstone.com.au and/or by opting-out of receiving marketing materials.

     

    Legal basis for processing personal information (UK and European Economic Area (EEA) visitors only)

    Where we are acting as a processor in providing product and services to our Customers, our Customer is acting as a controller which retains control of any personal information that you have provided to them and remains responsible for its compliance obligations under the applicable data protection legislation.

    Where Sandstone is acting as a controller, we will collect personal information from you only (i) where we need the personal information to establish a contractual relationship with you, (ii) where the processing is in our legitimate interests and not overridden by your rights, or (iii) where we have your consent to do so. In some limited cases, we may also have a legal obligation to collect personal information from you.

    If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not and any possible consequences if the personal information is not provided.

    If we collect and use your personal information in reliance on our legitimate interests, this interest will be within the scope of this Privacy Notice and only where we have a lawful basis to process your personal information. These legitimate interests include the operation of our website and services, communicating with you as necessary to provide our services or respond to enquiries, improving our platform, undertaking marketing, or for the purposes of detecting or preventing illegal activities.

    If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us at legal@sandstone.com.au.

    If you are from the UK or EEA, the personal information that we collect from you will be transferred to, and stored at, a destination outside the UK or EEA. It may also be processed by staff operating outside the UK or EEA who work for us in our Australia or Philippines locations. Such staff may be engaged in, among other things, the fulfilment of or responding to your request and the provision of support services. We have established appropriate safeguards that are consistent with UK data protection laws to protect any personal information that is transferred or stored outside of the UK or EEA.

     

    Data Retention

    We retain personal information we collect from you only where we have an ongoing legitimate business need to do so. For example, to provide you with marketing materials you have ‘opted in’ to receive or as necessary to comply with applicable legal requirements.

    When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it, or, if this is not possible (for example, where your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

    The length of time we keep your personal data depends on what it is and whether we have an ongoing need to retain it but will generally not exceed seven years unless specified otherwise. You may also request the deletion or de-identification of any personal information prior to the expiry of this period through submitting a request to legal@sandstone.com.au and provide the necessary information to support your request.

     

    Security of Your Personal Information & Eligible Data Breaches

    We are committed to maintaining the confidentiality of the personal information you provide to us and we will take all reasonable technical and organizational measures to protect your personal information from unauthorised access, use or alteration. We use firewalls, anti-virus software, email filters, as well as security and access controls to
    protect all personal information that is processed in our systems. However, no security system is impenetrable and where personal information is transmitted through the internet we cannot guarantee the security of your information.

    All information we hold about you is stored securely within Australia, the United Kingdom, the Philippines and the United States. As we are a global company with teams in the United Kingdom, Australia and the Philippines, we may share information about you within Sandstone related entities in order for the right staff to respond to your queries or address your business needs. This means that when we collect your personal information, we may transfer or process such personal information in countries beyond the country of collection, including the United States.

    In the event we identify or are otherwise made aware of a data breach involving any of your personal information that we process in connection with your use of the website, we have internal policies and procedures in place to respond to and, where applicable, report such breach to the relevant regulatory body within 72 hours in compliance with applicable data protection laws.

     

    Access to your personal information
    In most cases, you may have access to personal information that we hold about you. We will handle requests for access to your personal information in accordance with the applicable data protection laws. All requests for access to your personal information must be directed to us by email to legal@sandstone.com.au. We may take reasonable steps to identify you, including requesting copies of your ID to accompany your request. Once we receive all necessary information and details, we will deal with all requests for access to your personal information as quickly as possible and where practicable, provide a response within 20 days of receipt of your request. Requests for a large amount of information, or information that is not currently in use, may require further time before a response can be given. We reserve the right to charge you an administrative fee for access for costs incurred by us in retrieving your information, but in no case will we charge you a fee for your application for access.

    In certain cases, we may refuse to give you access to personal information that we hold about you. This may include circumstances where giving you access would:

    • be unlawful (e.g. where a record that contains personal information about you is subject to a claim for legal professional privilege by one of our contractual counterparties);
    • have an unreasonable impact on another person’s privacy; or
    • prejudice an investigation of unlawful activity.

    We may also refuse access where the personal information relates to existing or anticipated legal proceedings, and the information would not be accessible by the process of discovery in those proceedings.

    If we refuse to give you access, we will provide you with reasons for our refusal.

     

    Correcting your personal information

    We will take all reasonable steps to ensure that all information stored, controlled or processed is accurate, up-to-date, complete and not misleading. You may request us to amend any personal information about you that is held by us and that is inaccurate, incomplete or out of date. If we disagree with your view about the accuracy, completeness or currency of a record of your personal information that is held by us, and you ask us to associate with that record a statement that you have a contrary view, we will take reasonable steps to do so.

     

    Third party websites and services

    You may click-through third party websites from this site, in which case we recommend that you refer to the privacy statement of the websites you visit. This Privacy Notice applies to this site only and we assume no responsibility for the content or data processing of any third-party websites.

    When assessing applicants for employment opportunities, we may use and provide your information to third-party services during the application and onboarding process. We will obtain your consent before providing your information (including sensitive information) to any third-party services, such as background checks. The use of your information by such third-party services will be governed by the privacy policies of those third-party providers and is not subject to our control.

     

    Re-marketing

    We may use re-marketing services to advertise on third party websites to previous visitors to this site based upon their activity on this site. This allows us to tailor our marketing to better suit your needs and to only display advertisements that are relevant to you. Such advertising may be displayed on a search engine results page or on an online advertising platform, for example in a website on the Google Display Network. Third party webpages may use cookies and/or pixel tags to achieve this. Any data so collected by these third-party re-marketing services will be used in accordance with their own respective privacy policies. None of your personal information that you provide to these re-marketing services is reported to us.

     

    Changes to this Privacy Notice

    From time to time, it may be necessary for us to revise this Privacy Notice. Any changes will be in accordance with any applicable data protection laws in the countries that we operate within. Please review this page periodically and at each occasion when you provide your personal information to us. When we make changes to this Privacy Notice, we will notify you by updating the revision date at the top of this page.

     

    Your Data Protection Rights

    Under applicable data protection laws in your region, you may have the following data protection rights:

    • You have the right to access, correct, update, request a portable copy, deletion, de-identification or restriction of processing of your personal information.
    • You may object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information.
    • You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you.
    • Where we have collected and processed your personal information with your consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

    If you would like to exercise any of these rights, you may submit a request at any time by contacting us at legal@sandstone.com.au. We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with data protection laws applicable to their region. We endeavor to provide a response to all inquiries within 20 days from receipt.



    How to Complain

    We hope that we can resolve any query or concern you raise about our use of your information. Any complaints will be taken seriously, and we will make every effort to investigate and resolve your complaint within a reasonable time frame and in accordance with applicable data protection laws.


    If you require any further information about the Privacy Act and the Australian Privacy Principles, you can visit the Federal Privacy Commissioner’s website at www.privacy.gov.au. If you are not satisfied with how we have resolved your complaint, then you may apply to the Federal Privacy Commissioner to have your complaint investigated in Australia. More information is available at: www.oaic.gov.au.

    If you located in the UK or EEA, you have a number of important rights free of charge. If your complaint is about personal information in the UK or EEA or further information on those rights, including the circumstances in which they apply, you may contact the UK Information Commissioner’s Office. More information is available at: https://ico.org.uk/

    If you are located in the Philippines and require further information or wish to make a complaint, you may contact the National Privacy Commission. More information is available at: https://privacy.gov.ph/

     

    Contacting us about privacy

    If you would like more information on how we manage personal information that we hold about you, please contact us by email at legal@sandstone.com or by post. Our head office address is 1/182-186 Blues Point Rd, McMahons Point, NSW 2060 Australia. Our UK office contact information is Sandstone UK, Platform, New Station Street, Leeds LS14JB, United Kingdom.