VDP Privacy Collection Notice

When you complete the online form to report a security vulnerability, or by submitting your vulnerability report directly to us via email at isms@orro.group, Orro Pty Ltd (ABN 72 111 999 663) and its related bodies corporate (Orro Group, we, us, or our) will collect your personal information (for example, your full name, email, and other information about you that you include in your report). We collect your personal information for the purpose of administering Orro Group’s Vulnerability Disclosure Program (VDP), which may include using your personal information for facilitating your participation in the VDP, our triage, investigation or remediation activities associated with your report, for the ongoing review and improvement of our cybersecurity posture, to fulfil our legal obligations, or to seek external professional advice (such as legal advice) where required. We may also use your personal information to respond and engage with you in relation to the VDP or any report you make, communicate with you, and for other purposes as permitted by law. If you do not provide us with the requested personal information (such as if you do not provide us with an accurate and up to date email address) we may be unable to facilitate your participation in the VDP as we will be unable to communicate with you. To the extent necessary to administer the VDP, we may disclose your personal information to other members of our corporate group, and our service providers and business partners, and where you have otherwise consented to the use or disclosure. Where required by law, we may disclose your personal information to regulators, law enforcement or other governing bodies. We may also disclose your personal information to overseas recipients, particularly to service providers or members of our corporate group located outside Australia, including in the Philippines and the United Kingdom. Our Privacy Policy available here contains further information about how we manage your personal information, including how you can seek access to, request correction of, the personal information we hold about you, and how you can make a complaint about our privacy practices. If you have any privacy queries, please contact us by email at isms@orro.group or by telephone at 1300 900 000.