Privacy

Last updated: 19 August 2026

Zephyr One respects your privacy. This policy explains what personal information we collect, how we handle it, and how you can access it, correct it or complain.

We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1. Who we are

Zephyr One is the trading name of Zephyr Empire Pty Ltd (ABN 50 656 314 662), an Australian marketing agency.

We work with businesses on advertising, analytics, search and commercial reporting. We are not a consumer business, so most of the personal information we handle belongs to people we deal with in a business capacity, or to customers of our clients where we act on that client’s instructions.

2. The kinds of personal information we collect and hold

People at our clients and suppliers. Name, business email address, telephone number, job title and employer. We also hold correspondence and meeting records, including notes and transcripts of meetings you attend with us.

People at businesses we approach. Where we contact a business about our services, we hold the name, business email address, job title and employer of the relevant person. We obtain this from business contact databases and publicly available professional sources, not from you directly.

Visitors to our website. Our website uses the Meta advertising pixel and Meta’s Conversions API, which record your visit and actions on the site and send that information to Meta, including where you arrived from and which pages you viewed. If you complete an enquiry form we collect the details you provide, which typically include your name, email address, telephone number and company.

Job candidates. We do not operate our own recruitment process and we do not maintain a candidate database. Hiring is handled by third party recruiters, who hold candidate information under their own privacy policies. Where a recruiter provides us with candidate details during a search, we use them only to assess that candidate for that role and do not retain them once the search is complete.

Customers of our clients. When a client engages us to report on their business, we may hold records of their customers’ transactions. We do not hold names, email addresses, telephone numbers or street addresses of those customers. What we hold is a coded reference that we cannot reverse, together with what was purchased, when, for how much, and the country of the order. Only the client can connect that coded reference to a person.

Where a client’s systems do not support an automated connection and the client instructs us in writing, we may handle customer contact lists on their behalf for advertising purposes. In those cases we delete our copy once the task is complete.

We do not seek sensitive information as defined in the Privacy Act, and we ask clients not to provide it.

3. How we collect and hold personal information

We collect information directly from you when you contact us, meet with us, complete a form on our website, engage our services or subscribe to something we send.

We collect information about people at businesses we approach from business contact databases and publicly available professional sources.

We collect information about our clients’ customers from the client’s own systems, through connections the client authorises and can withdraw at any time. Those connections are read only. We cannot change anything in a client’s systems through them.

We hold personal information in access controlled systems. Our reporting platform stores data in a database hosted in Sydney, Australia. Access is limited to authorised personnel, and to each client’s own nominated people for their own data only.

We protect personal information with measures including restricted access, multi-factor authentication, encryption of stored credentials, and separation of each client’s data from every other client’s. We do not describe these measures in detail here, because doing so would weaken them.

We do not keep personal information longer than we need it. Client reporting data is deleted at the end of an engagement plus thirty days, or earlier on request.

4. Why we collect, hold, use and disclose personal information

To provide our services and report to our clients.
To communicate with people at our clients and suppliers about work in progress.
To let businesses know about our services, and to stop when they ask us to.
To operate, measure and improve our website and our own advertising.
To meet our legal, tax and record keeping obligations.

We do not sell personal information. We do not use one client’s customer data to benefit another client. We do not use a client’s customer data to build advertising audiences unless that client has instructed us to in writing.

5. Who we disclose personal information to

We use the following service providers. They act on our instructions, or under their own published terms, and only for the purposes described above.

Email, documents and file storage: Google Workspace (United States)
Website hosting, forms and analytics: Automattic (WordPress), Gravity Forms, Meta (United States)
Reporting platform hosting: Supabase, database located in Sydney, and Vercel (Australia; provider entities United States)
Artificial intelligence analysis: Anthropic (United States)
Advertising and analytics platforms: Meta, Google, TikTok, LinkedIn, Pinterest (United States)
Client commerce and marketing platforms: Shopify, Klaviyo (United States, Canada)
Business contact data and outreach: Apollo.io, Instantly (United States)
Scheduling: Calendly (United States)
Internal communication and meeting notes: Slack, Granola (United States)
Project management: Productive.io (European Union)
Accounting and invoicing: Xero (Australia, New Zealand)
Recruitment: third party recruiters engaged from time to time (Australia)

We also disclose personal information where you have consented, or where we are required or permitted by law.

On written request, a client may obtain a summary of the material platforms and tools used in their specific engagement.

6. Overseas disclosure

We are likely to disclose personal information to recipients located overseas.

Those recipients are located principally in the United States, and also in Canada, New Zealand and the European Union, as set out above.

Some providers store data in Australia even though the provider itself is a foreign company. Our reporting database is hosted in Sydney.

Where we use an artificial intelligence service to help draft analysis of a client’s results, we send aggregate figures only. We do not send names, contact details, customer records or coded customer references. Our AI provider’s commercial terms state that customer content is not used to train models.

7. Accessing and correcting your personal information

You have the right to ask for access to the personal information we hold about you, and to ask us to correct it if it is wrong.

We may need to verify who you are before we release information.

If we refuse access or correction, we will tell you why in writing and explain how to complain.

If you are a customer of one of our clients, we will not be able to identify you in our records, because we do not hold names or contact details for our clients’ customers. Please contact that business directly. If you tell us which business it is, we will help them respond.

8. Complaints

If you think we have breached the Australian Privacy Principles, tell us. Put your complaint in writing to the contact below.

We will acknowledge your complaint within five business days and respond within thirty days. If we need longer we will tell you why and when to expect an answer.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.

Website: oaic.gov.au
Telephone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001

9. Contact us

Chris Faulkner, Privacy Officer
Zephyr One
Email: chrisf@zephyrone.co
Telephone: +61 416 892 782
Post: 3/75 Pitt Street, Sydney NSW 2000

10. Dealing with us anonymously

Where it is lawful and practicable, you can deal with us without identifying yourself or by using a pseudonym. This will not usually be practicable where we are delivering services to you or your business.

11. Changes to this policy

We review this policy at least annually and whenever our practices change. The current version is always available at zephyrone.co/privacy, and the date it was last updated appears at the top.