Privacy Policy

UAS Sentinel Pty Ltd Privacy Policy

How we collect, use, protect and disclose personal information

Policy detail Information Legal entity UAS Sentinel Pty Ltd ABN 52 682 008 233 Version 2.0 Effective date 28 July 2026 Previous version Policy effective 30 January 2025 Policy owner and privacy contact Managing Director Email enquiries@deepskyiq.com Postal address P.O. Box 1223, Runaway Bay, Queensland 4216, Australia

  1. Purpose and scope

UAS Sentinel Pty Ltd is committed to handling personal information openly, carefully and consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply to our activities.

This Privacy Policy applies to UAS Sentinel Pty Ltd and its registered business names, including DeepSky IQ, DeepSky Terra, DeepSky Protect, DeepSky Exterior, UAS Sentinel and Sentinel Group Solutions. These are business names of the same legal entity, not separate subsidiaries. In this policy, “we”, “us” and “our” refer to UAS Sentinel Pty Ltd.

The policy applies when a person visits our websites, submits an enquiry, requests or receives a quotation, communicates with us, supplies goods or services to us, engages us for a project, receives marketing from us, or otherwise deals with our business. It should be read with any project-specific collection notice, contract, consent or confidentiality obligation that applies to a particular engagement.

  1. What is personal information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. It may include contact details, communications, photographs, recordings, location information and project records linked to an individual. Sensitive information includes certain information about health, biometric characteristics, racial or ethnic origin, political or religious beliefs, sexual orientation, criminal records and other categories defined by law.

Information about a company is not ordinarily personal information by itself. However, company enquiries can contain personal information when they identify an employee, director, sole trader, property owner, contractor or other individual.

  1. Personal information we may collect

We only seek to collect information that is reasonably necessary for our functions and activities. Depending on the interaction, this may include:

Category Examples Identity and contact information Name, business role, employer or organisation, email address, phone number, postal or site address and communication preferences. Enquiry and quotation information Company name, enquiry details, requested service, asset or site type, project location, timing, budget parameters, quotation history and correspondence. Customer, supplier and project information Contracts, scopes, purchase orders, project contacts, site-access information, records of instructions, deliverables, invoices, payment status and dispute or complaint records. Operational imagery and data Drone, robot, ROV, thermal, LiDAR, sonar, 360-degree, photographic, video, geospatial and digital-twin data that may incidentally capture people, vehicles, addresses, licence plates or other identifiers. Website and device information IP address, browser and device type, approximate location, pages or content viewed, links selected, access times, referring source, cookie identifiers and similar analytics information. Marketing information Areas of interest, campaign interaction, event participation, feedback and subscription or opt-out preferences. AI-assisted workflow information Company names and non-sensitive enquiry or scope details used to assist with research, drafting, quotation preparation, customer communications, visualisation or data processing, subject to Section 7.

We do not intentionally collect sensitive information unless it is reasonably necessary for a lawful business purpose and any consent or other legal requirement has been addressed.

  1. How we collect information

We may collect information directly from an individual through website forms, email, telephone calls, meetings, quotations, contracts, project delivery, event registrations or other communications. We may also receive information from an individual’s employer or representative, a customer, supplier, professional adviser, project participant, publicly available source, referral partner, analytics provider or other service provider.

Our field services may incidentally capture personal information in imagery or sensor data. We seek to limit unnecessary capture, follow applicable site and client requirements, and use the information for the agreed operational or project purpose.

Where lawful and practicable, a person may interact with us anonymously or using a pseudonym. We may still require accurate identifying and contact information where it is needed to provide a quotation, enter a contract, arrange site access, manage safety, verify authority, collect payment or meet a legal obligation.

  1. Why we collect, use and hold information

We may handle personal information to:

  1. respond to enquiries and prepare quotations, proposals and service information;

  2. verify instructions, authority, identity or site-access requirements;

  3. plan, perform and document drone, robotics, ROV, mapping, digital-twin, inspection, data-acquisition and related services;

  4. provide customer communications, project outputs and technical documentation;

  5. administer contracts, suppliers, invoicing, payment, insurance and business records;

  6. manage quality, safety, security, incidents, complaints, disputes and legal obligations;

  7. improve our services, website, workflows, customer experience and business performance;

  8. conduct analytics, research and internal planning;

  9. provide relevant marketing and business-development communications, subject to applicable consent and opt-out requirements; and

  10. use approved AI-assisted and automated tools as described in Section 7.

We will not use or disclose personal information for an unrelated purpose unless the individual has consented or the use or disclosure is otherwise permitted or required by law.

  1. Website analytics and cookies

Our websites may use cookies and similar technologies to support functionality, remember preferences, understand site use, measure performance and improve content. These technologies may be supplied by third-party analytics, marketing or website-service providers.

Cookies may include:

Cookie type Purpose Functional Remember selections and support site operation. Analytical Measure how visitors reach and use content so we can improve performance and usability. Marketing or targeting Measure campaign interaction and, where enabled, tailor relevant content. Third-party Support embedded content, analytics, communications or other services supplied by external platforms.

A user can control or disable cookies through browser settings. Some site functions may not operate as intended if cookies are disabled. Where a consent-management tool is provided, users may also adjust available preferences through that tool.

  1. Use of artificial intelligence and automated tools

We use approved artificial-intelligence-enabled and automated tools to assist with internal research, drafting, quotation preparation, customer communications, marketing content, visualisation, data processing and digital-twin outputs. Tools may include Bentley iTwin and other digital-twin or data platforms, Manus, ChatGPT, Midjourney, InVideo AI and similar approved services.

Our AI use is governed by the following controls:

Control Our approach Data minimisation Inputs are limited to information reasonably necessary for the relevant task. Routine inputs are generally company names and non-sensitive enquiry or scope details. Prohibited public-tool inputs We do not intentionally enter sensitive personal information, passwords, access credentials, direct personal contact details or confidential client documents into publicly available generative-AI tools. Controlled project data Personal, confidential or client-controlled information may only be used in an approved enterprise or contracted platform when the use is necessary, authorised and subject to appropriate privacy, security and contractual controls. Human accountability A person reviews and approves customer-facing communications, quotations and professional outputs before release. Material facts, calculations, limitations and professional boundaries are checked rather than accepted solely because an AI tool generated them. Professional limits AI is not authorised to make final engineering, certification, safety-critical, legal, loss-adjusting or trade decisions on our behalf. Any regulated or specialist opinion must be provided or confirmed by an appropriately qualified person. Significant decisions We do not use AI to make solely automated decisions that have a legal or similarly significant effect on an individual. Transparency We will identify public-facing AI systems as such and disclose material AI assistance where required by law, contract, professional obligation or the circumstances of the engagement.

AI systems can process information through external infrastructure and may generate inaccurate, incomplete or unexpected material. We therefore apply human oversight, verification and data-minimisation controls. The Office of the Australian Information Commissioner recommends clear privacy disclosures, due diligence, human oversight and caution before entering personal information into publicly available generative-AI tools.

A person who has concerns about the use of their personal information in an AI-assisted workflow may contact our Privacy Contact. We will consider any reasonable request for an alternative process, subject to operational, contractual and legal requirements.

  1. Who we may disclose information to

We may disclose information, on a need-to-know basis, to:

Recipient Purpose Our personnel and authorised contractors Business administration, customer service, project delivery, quality, safety and support. Website, hosting, communications and analytics providers Website operation, email, forms, analytics, customer communications and related support. Cloud, software, AI, media and digital-twin providers Approved storage, processing, drafting, visualisation, content production, data analysis and digital-twin services. Project participants and specialist professionals Coordinating an authorised project or obtaining engineering, technical, legal, accounting, insurance or other specialist input. Payment, accounting and business-administration providers Invoicing, payment, record keeping and business operations. Government, regulators, emergency services, courts or law-enforcement bodies Where required or authorised by law, or reasonably necessary to address safety, fraud, claims, disputes or legal rights. Insurers, brokers and advisers Obtaining or administering insurance, managing notifications or claims, and receiving professional advice. A purchaser or successor Due diligence or transfer associated with a proposed or completed sale, restructure or transfer of the business, subject to appropriate confidentiality controls.

We do not sell personal information. Service providers are only given information reasonably necessary for the relevant purpose, and we seek to use contractual, account, access and security controls proportionate to the information and service involved.

  1. Overseas processing and disclosure

Some cloud, communications, analytics, AI, media and software providers operate or use infrastructure and subcontractors outside Australia. Depending on the provider and engagement, information may be processed in countries including the United States, Singapore, India, the United Kingdom, countries within the European Economic Area, and other locations identified in the provider’s current service or privacy documentation.

Provider locations and subcontracting arrangements can change. Before intentionally providing personal or confidential information to an overseas service provider, we take reasonable steps proportionate to the risk, which may include reviewing privacy and security terms, account settings, data use, retention, deletion, data deidentification, on-premises processing where possible, access and contractual controls. APP 8 contains requirements relevant to cross-border disclosure of personal information.

Further information about a material provider or likely processing location may be requested from our Privacy Contact, subject to confidentiality, security and commercial limitations.

  1. Direct marketing

We may use contact details to send relevant service information or marketing where permitted. Marketing messages will identify us and provide a practical means to opt out. A person may unsubscribe at any time by using the available link or contacting us. We may still send non-marketing communications required to respond to an enquiry, administer a contract, deliver a service, issue an invoice or meet a legal obligation.

  1. How we protect information

We use reasonable safeguards proportionate to the nature of the information and the size of our business. These may include access restrictions, strong authentication, multi-factor authentication where available, device and software updates, secure cloud services, backups, confidentiality requirements, approved-provider controls and procedures for identifying and responding to incidents.

No internet transmission, storage platform or security measure can be guaranteed to be completely secure. If we become aware of suspected unauthorised access, disclosure, loss or misuse, we will assess and respond to the incident and make notifications where required by law.

  1. Retention and disposal

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and for applicable contractual, accounting, tax, insurance, safety, dispute-resolution, evidentiary and legal requirements. Retention periods may differ by record type and project. When information is no longer reasonably required, we take reasonable steps to delete, destroy or de-identify it, subject to lawful retention and technical backup requirements.

  1. Access, correction and deletion requests

A person may ask whether we hold their personal information and request access to or correction of it. A person may also request deletion or object to a particular use. We will consider the request and respond within a reasonable period.

We may need to verify identity before acting. Access or deletion may be refused or limited where permitted or required by law, including where records must be retained for contractual, accounting, insurance, safety, dispute or legal purposes. If we refuse a request, we will explain the basis where it is reasonable and lawful to do so.

Requests should be sent to:

Privacy Contact: Managing Director Email: enquiries@deepskyiq.com Postal address: P.O. Box 1223, Runaway Bay, Queensland 4216, Australia

  1. Children

Our services and websites are not directed to children under 16, and we do not knowingly collect their personal information without appropriate authority. If we learn that information has been collected from a child without appropriate authority, we will assess and take reasonable steps to delete or otherwise handle it lawfully. A parent or guardian may contact our Privacy Contact.

  1. Complaints

A privacy question, concern or complaint should first be sent to our Privacy Contact using the details above. Please provide enough information for us to understand and investigate the matter. We will acknowledge and assess the complaint and aim to provide a substantive response within a reasonable period.

If a person is not satisfied with our response, they may be able to contact the Office of the Australian Information Commissioner through www.oaic.gov.au, subject to the OAIC’s jurisdiction and complaint requirements.

  1. External links

Our websites may link to third-party websites or services. We do not control their privacy, security or content practices. Users should review the relevant third party’s privacy information before providing personal information.

  1. Changes to this policy

We may amend this Privacy Policy to reflect changes in our services, technology, providers, information-handling practices or legal obligations. The effective date and version number will be updated when a material revision is adopted. The current public version should be made available through our website or on request.

  1. Version history

Version Effective date Summary 1.0 30 January 2025 Original website privacy policy. 2.0 28 July 2026 Corrected entity scope; expanded project-data, provider, overseas-processing, security, retention and complaint provisions; added AI-assisted processing disclosure and human-review controls.

References

[1] Privacy Act 1988 (Cth ) [2] OAIC: Guidance on privacy and the use of commercially available AI products [3] OAIC: APP 8 cross-border disclosure of personal information