Book a demo

Privacy Policy

Last updated:

Curium Co Pty Ltd
ABN 36 651 164 171
(“Curium”, “we”, “us”, “our”)

If you have any questions or concerns about this Privacy Policy or how we handle personal information, you can contact our:

  • Data Protection Officer: david@getcurium.com (Chief Technology Officer)
  • Postal address: Suite 603, Level 6, 1 Elizabeth Plaza, North Sydney NSW 2060

1. Scope and application

  • References to “APP” are to the Australian Privacy Principles, contained within the Privacy Act 1988 (Cth)
  • We are not currently an “APP entity” under the Privacy Act 1988 (Cth), and as such, the APPs do not apply to us.
  • Nonetheless, we aim to adopt certain best practices drawn from the APPs in our handling of personal information.
  • This policy applies to information we collect when people use or access our website, software, services, or contact us.

2. What kinds of personal information we collect

Below is a non-exhaustive list of the types of personal or sensitive information we may collect or be given, especially in the context of our risk, compliance and claims software for the Financial Services industry.

Personal / sensitive information we may collect:

  • Name, job title, DOB, contact details (email, phone, address)
  • Organisation / company name, role, business contact details
  • Claim-specific detail, including: date/time/location of loss, claim amounts, incident descriptions, cause, supporting documents or media, policy details (e.g., coverage type and dates), insurer and broker details, coverage types
  • Compliance-specific detail, including aggregated incident, breach, risks, controls and complaints data
  • Inputs to automated decisions (e.g., risk scores, fraud scores, claim categorisation, AI/ML-derived suggestions)
  • Other compliance / risk metadata, including usage of Curium software, internal notes, audit trails
  • Certain account-related information (e.g., IP address, account settings, browser user agents)
  • Information about how you use our website, such as pages viewed, clicks and the cookie identifiers set in your browser (see Section 8)

We will only collect personal information that is reasonably necessary for our functions or services (aligned with the principle of data minimisation). We also note our clients / users can elect to capture bespoke data relevant to their business and store it in Curium, so the above list may not be exhaustive.

3. How we collect personal information

We collect personal information in a few ways:

  • Directly from you or your organisation — e.g. via web forms, submitted documents, onboarding, emails, calls, support requests
  • Automatically as you use our website or software, including log files, analytics, servers
  • From third parties or partners (with your consent or as permitted), for example your insurer or your organisation
  • From websites or other publicly available sources (if applicable)

4. Why we collect it / how we use it

We collect and use personal information for legitimate purposes, including:

  • To deliver, support and improve our software, services, and features
  • To respond to enquiries, provide customer support, training, and communications
  • To administer client relationships, billing, disputes, audits
  • To comply with legal or regulatory obligations
  • To detect, prevent, investigate and address security risks, fraud, misuse, data breaches
  • For statistical, reporting, analytics, performance measurement and benchmarking (in de-identified or aggregated form, except as described in Section 8)
  • To provide clients and users rationale for automated triage or decisions (e.g., regarding claims)
  • To communicate with you about updates, new features, product changes, or marketing (where permitted / with your consent)

We will not use personal information for purposes incompatible with the purposes for which it was collected, unless we obtain your consent or there is another lawful basis.

5. Disclosing personal information

We may share personal information with:

  • Our service providers, contractors or subcontractors (e.g. cloud hosting, analytics, support)
  • Our professional advisers (e.g. lawyers, auditors)
  • Government, regulators or statutory bodies where required by law
  • Our clients or partners (if required to fulfil our contractual obligations)

If we disclose personal information to a recipient overseas, we will take reasonable steps to ensure that the overseas recipient handles the information in a way that is consistent with the APPs, in line with APP 8.

Where possible, we will notify you (or obtain your consent) before disclosing personal information overseas, or tell you which countries we are likely to disclose it to.

The countries we are likely to disclose personal information to include the United States, where some of our service providers, including our analytics providers, store and process data (see Section 8).

If you choose not to provide personal information we request, we may not be able to provide you with certain services or features.

6. Data quality, retention and correction

We take reasonable steps to ensure the personal information we hold is accurate, complete and up to date. If you believe any information we hold about you is inaccurate, incomplete or out-of-date, please contact us (see Section 11 below) and we will take reasonable steps to correct it.

We will retain personal information for as long as it is needed to fulfil the purposes for which it was collected, or to satisfy legal, regulatory, business or audit obligations. After that, we will securely delete it or de-identify it.

7. Security and protection

We implement technical and organisational safeguards to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Examples of security measures include:

  • Encryption in transit and at rest
  • Access controls and strict permissioning
  • Secure authentication, logging, monitoring
  • Vulnerability assessments

If there is a suspected data breach, we will act promptly to contain, investigate, notify affected parties, and mitigate risks.

8. Cookies, tracking & website analytics

We use cookies, web beacons, analytics tools and similar technologies on our website to:

  • Understand how users interact with our website
  • Improve site functionality, performance, usability
  • Diagnose issues, monitor traffic, detect misuse or fraud
  • Deliver and measure marketing or promotional campaigns

The tools we use on our website are:

  • Google Analytics, loaded through Google Tag Manager, to measure visits and how our pages are used
  • LinkedIn Insight Tag, to measure the results of our LinkedIn campaigns
  • PostHog, to measure visits and how our pages are used, to record sessions and errors, and to test changes to our website, as described below

Session recording. PostHog records how a visitor moves through our website, such as the pages viewed, clicks, scrolling and mouse movement, so that we can find and fix problems and improve the site. Anything typed into a form field is masked in your browser before the recording is sent, so it is not recorded.

Error reports. If something on a page fails to work in your browser, PostHog records the technical details of the error, such as the error message and the page it happened on, so that we can fix it.

Testing changes. We sometimes show different versions of part of a page to different visitors, to learn which works better. PostHog records which version your browser was shown.

Linking your details to your visits. If you submit a form on our website, for example to book a demo, contact us, subscribe to our newsletter or download a resource, we link the email address, name, company and type of business you provide to the record of your visits to our website from that browser, including visits made before you submitted the form. We use this to understand what you are interested in and to respond to your enquiry. We do not add your phone number or the content of your message to that record.

Where this information is held. PostHog stores this information on servers in the United States. Google and LinkedIn may store and process information in the United States and other countries.

Your choices. You may choose to disable cookies via your browser settings, but that may limit your ability to use certain features. You can also ask us to delete the information we hold about you, or to stop linking your details to your visits (see Section 9).

We may also embed links to third-party sites or APIs; those third parties may set their own cookies. We encourage you to review their privacy policies.

9. Access, correction, deletion & opt-out

You may request:

  • Access to the personal information we hold about you
  • Correction or amendment of that information
  • Deletion or erasure (where legal or contractual obligations allow)
  • To opt out of receiving direct marketing (where applicable)
  • To stop linking your details to your visits to our website (see Section 8)

To make such a request, please contact our Data Protection Officer (see Section 11). We may ask you to verify your identity before acting on the request. We will respond within a reasonable timeframe.

If we refuse a request (or part of it), we will provide written reasons, consistent with APP 12.

10. Direct marketing

Where permitted by law / with your consent, we may use your personal information to send you marketing or promotional materials about our services, updates or related offerings. Each marketing message will include a means by which you can opt out (e.g. “unsubscribe” link or email), consistent with APP 7.

If you opt out, we will not send further direct marketing (unless you later opt back in).

11. How to contact us, make complaints

If you have any questions, comments or concerns about this Privacy Policy or how we handle your personal information, please contact:

Data Protection Officer: david@getcurium.com (Chief Technology Officer)
Address: Suite 603, Level 6, 1 Elizabeth Plaza, North Sydney NSW 2060

If you believe we have mishandled your personal information, you may lodge a complaint with us. We will investigate and respond promptly.

Please note, the Office of the Australian Information Commissioner (OAIC) can only investigate complaints made in respect of APP entities under the Privacy Act 1988 (Cth), which does not currently include Curium Co Pty Ltd.

12. Changes to our Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, practices or our business circumstances. When we make material changes, we will publish the updated version on our website and update the ‘Last updated’ date. Where appropriate, we may also notify affected individuals.