Privacy Policy | Agent-Z

1. Who we are

In this policy, Agent-Z, we, us and our means YTM Australia Pty Ltd. This policy applies to personal information collected through the Agent-Z website, contact forms, commercial communications, demonstrations, evaluations, onboarding processes and related business activities.

2. The kinds of personal information we collect

Depending on the circumstances, we may collect and hold:

identity and contact details, including name, email address, phone number and employer
professional details, including job title, business unit and enquiry context
account and access details for portal, trial or support interactions
communications with us, including enquiries, meeting notes and support correspondence
technical and usage information, including IP address, browser information, device information and website interaction data
billing, contracting and transaction information where relevant to supply of services
any other personal information you provide to us directly or authorise us to collect

We do not seek to collect sensitive information unless it is reasonably necessary for our functions or activities and we are permitted or required by law to do so. If sensitive information is provided to us, we may collect, use or disclose it only as permitted by law.

3. How we collect personal information

We may collect personal information:

directly from you when you contact us, submit a form, request information, attend a meeting or engage with us
from your organisation where it provides your details in connection with a business enquiry or procurement process
automatically through website technologies such as server logs, analytics tools and similar technologies
from service providers, professional advisers, resellers, integration partners or publicly available sources where lawful and appropriate

Where reasonable and practicable, we will collect personal information directly from you.

4. Why we collect, hold, use and disclose personal information

We may collect, hold, use and disclose personal information to:

respond to enquiries, requests for demonstrations and other communications
provide, administer, secure and improve our website, products and services
evaluate customer requirements, solution fit, onboarding and service delivery
manage accounts, authentication, support requests and ongoing customer relationships
perform analytics, diagnostics, testing, monitoring and product improvement
comply with legal, regulatory, security and risk management obligations
protect our rights, systems, personnel and users
send service-related notices and, where permitted by law, marketing or business updates

We may de-identify or aggregate information for analytics, service improvement, reporting and business planning. We will not use or disclose de-identified information in a way that re-identifies individuals except where permitted by law.

5. Cookies, analytics and website technologies

Our website may use cookies, analytics technologies and similar tools to recognise returning users, understand website traffic and improve performance and usability. You can configure your browser to reject or restrict cookies, but some website functionality may be affected.

6. Disclosure of personal information

We may disclose personal information to:

our related entities, contractors and professional advisers
hosting, infrastructure, security, communications and support providers
payment, billing and administration service providers where relevant
technology vendors and model providers engaged in connection with our products and services
your authorised representatives or your organisation
courts, regulators, law enforcement bodies or government agencies where required or authorised by law
another party in connection with a restructure, merger, financing, sale of assets or similar transaction

We do not sell personal information. We require service providers handling personal information on our behalf to implement appropriate confidentiality and security controls.

7. Overseas disclosure and model providers

Agent-Z may support integrations with external model and technology providers, including providers such as OpenAI, Anthropic, Google and X, where those integrations are configured by us or by customers. Depending on the deployment model, personal information may be disclosed to recipients located outside Australia.

Where we disclose personal information overseas, we take reasonable steps to ensure the overseas recipient handles the information in a manner consistent with Australian privacy law, unless an exception under the Privacy Act applies. In many cases, Agent-Z can also be deployed using private infrastructure or local model runtimes to reduce or avoid offshore disclosure.

8. Data sovereignty and hosting choices

We design Agent-Z to support customer-controlled deployment models, including private infrastructure and on-premises operation. The specific location in which information is stored and processed depends on the deployment and integration choices made for the relevant environment. Where local hosting or customer-controlled infrastructure is used, data may remain within systems designated by the customer.

9. Security and retention

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Measures may include access controls, authentication controls, logging, encryption, network protections, staff confidentiality obligations and vendor due diligence.

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, to comply with legal obligations, resolve disputes, enforce agreements and maintain appropriate business and audit records. When personal information is no longer required, we take reasonable steps to destroy it or de-identify it, unless we are required or authorised by law to retain it.

10. Access and correction

You may request access to personal information we hold about you, and you may ask us to correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading. We may require verification of identity before processing a request. We may refuse access or correction in limited circumstances permitted by law, in which case we will provide written reasons where required.

11. Direct marketing

We may send marketing or business development communications where permitted by law. You may opt out of receiving marketing communications at any time by using the unsubscribe mechanism in the communication or by contacting us using the details below.

12. Data breach response

We maintain processes for identifying, assessing and responding to security incidents. If we determine that an eligible data breach has occurred, we will comply with our obligations under the Notifiable Data Breaches scheme, including notification where required by law.

13. Complaints

If you believe we have breached the Privacy Act or mishandled your personal information, you may make a complaint by contacting us using the details below. Please provide enough detail for us to investigate the matter. We will acknowledge the complaint and respond within a reasonable period.

If you are not satisfied with our response, you may be able to lodge a complaint with the Office of the Australian Information Commissioner.

14. Changes to this policy

We may update this Privacy Policy from time to time. The current version will be published on this page together with its effective date.

15. Contact details

If you have any questions about this privacy policy, please use our contact form.