UMI.

Data Protection & Security Policy

UMI IT Services Breakfree Ventures Pty Ltd ATF The Shah Family Trust (ABN 91 864 834 188), trading as UMI IT Services ("UMI", "we", "us", "our")

Last updated: 24 September 2026

1. Our commitment

As a managed IT and cybersecurity provider, we hold ourselves to the same standards of data protection we recommend to our clients. This Policy sets out, at a high level, how we protect the personal and business information entrusted to us — both our own, and our clients' data accessed in the course of delivering services.

This is a summary for clients and website visitors. Detailed technical security controls are documented internally and are not published for security reasons.

2. Scope

This Policy applies to:

  • Personal information collected via our website and in the course of client engagements;
  • Client systems, data and backups we access, manage or support as part of a service agreement.

3. How we protect data

We apply a layered approach to security, including:

  • Access control — access to client systems and data is restricted to authorised personnel and limited to what is necessary to deliver the engaged service.
  • Secure cloud platforms — we use reputable, enterprise-grade cloud and backup providers (such as Microsoft 365) with their own independent security certifications, rather than building unproven infrastructure of our own.
  • Patch and update management — we work towards applying vendor-released security patches to supported systems in a timely manner as part of ongoing managed services.
  • Backup and recovery — client data under our management is backed up in line with the terms of each client's service agreement, to support recovery in the event of loss, ransomware or hardware failure.
  • Staff awareness — as our team grows, all personnel with access to client systems will be trained on data handling, phishing and social engineering risks before being granted access.
  • Continuous improvement — we are progressively aligning our internal practices with the Australian Cyber Security Centre's Essential Eight framework, and we review our security posture as the business scales.

4. Data breach response

In the event of a data breach that is likely to result in serious harm, we will act in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth) — including assessing the breach, taking steps to contain and remediate it, and notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

If you are a client and become aware of a suspected security incident involving systems or data we manage on your behalf, please contact us immediately using the details below.

5. Data retention

We retain personal and client information only for as long as necessary to provide our services, meet legal and contractual obligations, or resolve disputes, after which it is securely deleted or de-identified.

6. Related policies

This Policy should be read together with our Privacy Policy and Cookie Policy.

7. Contact us

If you have any questions about this Policy, or wish to report a security concern, please contact:

UMI IT Services Breakfree Ventures Pty Ltd ATF The Shah Family Trust (ABN 91 864 834 188) Contact: maneesh@umi-it.com.au · 0489 222 864