Privacy Policy
Last updated: 26 July 2026
The short version
- We collect only what we need — usually your name, contact details and whatever you tell us.
- We use it to answer you, to deliver the services you’ve asked for, and to run our business.
- Some personal information we hold belongs to our customers, not to us. In that case their policy applies, not this one — see section 3.
- We never sell personal information, and we never pass it on for someone else’s marketing.
- You can ask us what we hold, ask us to correct it, opt out, or complain — see Contact us.
Who we are
This website is operated by Leftorium Pty Ltd, trading as Gibble (ACN 657 612 792), an Australian company. In this policy, “we” and “us” mean Leftorium Pty Ltd, trading as Gibble.
We provide software licensing, technology and related business services, including technical support and managed IT services. We work alongside other companies in our group, including a related company in Cambodia — see Where information is held and sent.
Who this policy is for
This policy applies to:
- visitors to this website;
- people enquiring about our services;
- our customers, current and former, and the staff of customer organisations we deal with;
- our suppliers and contractors, and their staff;
- other business contacts.
When we’re responsible for your information — and when we’re not
We handle personal information in two quite different situations, and it matters which one you’re in.
Information we’re responsible for
When you visit this website, enquire about our services, deal with us as a customer contact, or work for one of our suppliers or contractors, we decide what personal information is collected and why. We’re responsible for that information, and everything in this policy applies to it.
Information we handle for a customer
We also supply licensing, hosted platforms, technical support and managed IT services to customer organisations. In doing that, we handle personal information belonging to those organisations — about their staff, their students, or their own clients.
For that information:
- the customer decides what’s collected and what it’s used for — not us;
- we act only on that customer’s instructions and within our agreement with them;
- we don’t use it for our own purposes, and we never use it to market to anyone;
- their privacy policy applies to it, not this one.
If you’re a student, learner, employee or client of one of our customers and you want to see, correct or ask about information held about you, please contact that organisation directly. If you contact us instead, we’ll pass your request on promptly and tell you we’ve done so — but we can’t action it ourselves, because the information isn’t ours to act on.
Support and managed services access
When we provide technical support or managed IT services, our people sometimes need access to a customer’s systems, and those systems contain personal information. When that happens, access is limited to the people carrying out the work, only for the task at hand, and only as our agreement with that customer allows. We don’t copy, extract or retain that information beyond what the task requires.
The tools we use to manage and support customer systems also collect technical and operational information — things like device health, software inventory, system events and performance data. Where any of that information relates to an identifiable person, it belongs to the customer and we treat it exactly as described above.
What this policy doesn’t cover
This policy doesn’t cover other websites we link to, which have their own policies, or our own employee records, which are handled under our internal employment policies.
The rules we follow
We handle personal information in accordance with the Australian Privacy Principles, set out in Australia’s Privacy Act 1988 (Cth), and with any other privacy obligations that apply to our activities.
In practice that means we collect only what we need, tell you why we’re collecting it, use it only for the purposes we’ve told you about, keep it secure, and don’t keep it longer than we need to.
We keep an internal record of the personal information we hold, why we hold it, and who we share it with. Before we adopt a new system or service that involves personal information, we consider its effect on privacy.
What we collect
What we collect depends on how you deal with us. We collect only what’s reasonably necessary for that relationship.
If you contact us through this website
Your name, your email address, your phone number and organisation if you choose to give them, and whatever you write in your message.
If you’re a customer, or work for one
Your name, role and business contact details; your organisation’s business details, including ABN or ACN; account and licensing information; support requests and the correspondence around them; records of our meetings and communications; and billing, invoicing and payment records.
If you’re a supplier or contractor, or work for one
Your name, role and business contact details; your organisation’s business details; the information we need to engage and pay you, including invoicing and payment details; and where it’s relevant to the engagement, insurance, qualification, licensing or right-to-work information.
Automatically, when you visit this website
Your IP address and the approximate region it indicates, your browser and device type, the pages you viewed and when, the page that referred you, and error or diagnostic records if something goes wrong. We use this to keep the site working and secure and to understand how it’s used overall. We don’t use it to build a profile of you as an individual.
Sensitive information
We don’t ask for sensitive information — health information, biometric information, or information about your racial or ethnic origin, political opinions or religious beliefs — through this website, and we’d ask you not to include it in an enquiry. If an engagement genuinely requires something of this kind, we’ll ask for it separately, explain why, and only collect it with your consent or where the law requires it.
If you don’t give us the information
You don’t have to give us your personal information. But if you don’t, we may not be able to answer your enquiry, provide a service, engage you as a supplier, or process a payment.
Dealing with us anonymously
You can browse this website without telling us who you are, and you can deal with us anonymously or under a pseudonym where that’s lawful and practical. If you want a reply to an enquiry, we’ll need a name and a way to contact you.
How we collect it
We collect personal information:
- directly from you — through our enquiry form, by email or phone, in meetings, or in documents you send us;
- from the organisation you work for, where it gives us your business contact details so we can work together;
- automatically when you visit this website, as described above;
- occasionally from publicly available sources such as company registers or professional networking sites, where we’re checking a business contact or a prospective supplier.
Where it’s reasonable and practical, we collect information from you rather than from someone else. When you fill in a form on this website, we tell you at that point what we’ll use your details for.
Why we collect and use it
We collect and use personal information to:
- respond to your enquiry and give you the information you asked for;
- provide, support, maintain and administer our services;
- manage our relationships with customers, suppliers and contractors — quoting, contracting, invoicing and payment;
- keep records of our dealings with you;
- keep our website and systems secure, and prevent spam, fraud and misuse;
- send you administrative messages about service changes, account matters and updates to this policy;
- meet our legal, tax, regulatory and record-keeping obligations, and respond to lawful requests;
- understand and improve our website and services, using combined figures that don’t identify anyone;
- tell you about services that may interest you, where you’ve agreed to that or would reasonably expect it.
If we want to use your information for a different purpose, we’ll ask you first — unless it’s a purpose you’d reasonably expect given what we’ve told you, or the law requires or permits us to do it without asking.
We don’t sell personal information. We don’t disclose it for another organisation’s marketing. We don’t use it to make automated decisions about you without a person involved.
Marketing
We’ll only send you marketing if you’ve asked for it, or if you’d reasonably expect it from your dealings with us. Every marketing message includes a way to unsubscribe, and we’ll action that promptly and at no cost. You can also opt out at any time by emailing us. Our marketing complies with Australia’s Spam Act 2003.
Opting out of marketing won’t stop us sending you messages we need to send — service notices, account and billing information, and legal or security notifications.
Cookies and analytics
Cookies are small files a website stores on your device. Ours uses them in two categories:
| Category | What it does | Set without asking? |
|---|---|---|
| Strictly necessary | Makes the site work — page delivery, form submission, protecting the site from misuse, and remembering your cookie choice. | Yes — the site can’t function without these |
| Analytics | Tells us which pages are visited and how people move through the site, so we can improve it. Reported to us as combined figures, not individual records. | No — only if you agree |
We don’t use advertising or remarketing cookies, and we don’t allow advertising networks to track you through this site.
You can accept or decline analytics cookies when you first visit, and change your mind at any time through the cookie settings on our site. You can also block or delete cookies through your browser, though blocking the strictly necessary ones will stop parts of the site working.
Our analytics reports are produced by a third-party service, which handles the technical information described above on our behalf and under contract. It isn’t permitted to use that information for its own purposes.
Who we share it with
We share personal information only where it’s necessary for the purposes described above, and only with:
- the service providers who host our website and provide our business software, communications, support tooling and analytics;
- other companies within our group, including our related company in Cambodia, where that’s needed to deliver a service or answer your enquiry;
- our professional advisers, insurers and auditors, under confidentiality obligations;
- banks and payment providers, where a payment is involved;
- anyone you’ve asked or agreed that we share it with;
- law enforcement agencies, courts, regulators and other authorities, where we’re required or authorised by law.
We may also disclose information if our business is sold or restructured, in which case it stays subject to protections equivalent to this policy.
Our service providers are engaged under written agreements requiring them to keep information confidential, protect it appropriately, and use it only for the purpose we engaged them for. We don’t allow them to use your information for their own purposes. Where we engage a provider to help us deliver a service, we remain accountable to you for how they handle your information.
Where information is held and sent
We use service providers based in other countries, and we work with a related company in Cambodia. Personal information we hold is stored in, or accessed from, Australia, Cambodia, Singapore and the United States.
Before we disclose personal information overseas, we take steps that are reasonable in the circumstances to ensure the recipient handles it in a way consistent with the Australian Privacy Principles. Those steps include limiting what we send to what’s needed, putting written contractual protections in place with the recipient, and checking the provider’s privacy and security commitments before we engage them.
Where we hold information for a customer, any cross-border handling is governed by our agreement with that customer.
Privacy laws in other countries may differ from those in Australia, and in some cases you may not be able to enforce them against an overseas recipient directly. If that’s a concern, contact us before providing information and we’ll tell you what we can.
Keeping information secure
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Those steps include:
- limiting access to personal information to the people who need it for their role;
- protecting information while it is being sent and while it is stored;
- checking the providers who handle information for us before we engage them;
- requiring our people to keep information confidential;
- destroying or de-identifying personal information when we no longer need it.
We don’t publish the detail of our security arrangements, because doing so would weaken them. Customers and suppliers who need assurance for their own compliance can ask us using the contact details below, and we’ll provide what we reasonably can in confidence.
No system or transmission method is completely secure. We take our obligations seriously, but we can’t guarantee absolute security.
Data breaches
Information we’re responsible for. If a data breach is likely to result in serious harm to anyone affected, we will notify those individuals and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme in the Privacy Act 1988. Our notification will describe the breach, the kinds of information involved, and what we recommend you do about it.
Information we hold for a customer. If a breach affects information belonging to one of our customers, we’ll tell that customer without undue delay and give them what they need to assess it. The decision about notifying affected individuals in that situation rests with the customer, not with us.
How long we keep it
We keep personal information only for as long as we need it for the purposes in this policy, or for as long as the law requires. In general:
| Information | How long we keep it |
|---|---|
| Enquiries that don’t lead to a working relationship | 12 months from our last contact with you |
| Customer, supplier and contractor records, including billing | 7 years after the relationship ends |
| Website server and security logs | 90 days |
| Analytics information | Combined into reports that don’t identify anyone |
| Marketing preferences and opt-outs | Kept, so we can honour your choice |
| Information we hold for a customer | Kept, returned or deleted as our agreement with that customer requires |
Some records are kept longer where tax, corporate, contractual or dispute obligations require it. When we no longer need personal information and aren’t required to keep it, we destroy it or remove anything that identifies you.
Your rights and choices
For information we’re responsible for, you can:
- Ask what we hold. Request access to the personal information we hold about you.
- Ask us to correct it. If something is inaccurate, out of date, incomplete, irrelevant or misleading, tell us and we’ll fix it.
- Ask us to delete it. We’ll do that where we no longer have a lawful reason to keep it.
- Opt out of marketing at any time.
- Withdraw consent you’ve given us. That doesn’t affect anything we did lawfully beforehand.
- Deal with us anonymously, where that’s lawful and practical.
- Complain — see below.
To make a request, email us using the details below. We’ll confirm your identity first, then respond within 30 days. There’s no charge for making a request. We may charge a reasonable amount for the cost of giving access in some circumstances — never more than our direct costs, and we’ll always tell you before we do.
If we can’t do what you’ve asked — for example where the law requires us to keep the information, or where giving access would unreasonably affect someone else’s privacy — we’ll explain why in writing and tell you how to take it further.
For information we hold on a customer’s behalf, please make your request to that organisation. See section 3.
Making a complaint
If you think we’ve breached this policy or the Australian Privacy Principles, please raise it with us first by email. We’ll acknowledge your complaint promptly, look into it, and respond within 30 days. If we need longer, we’ll tell you why and keep you updated.
If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, where you’ll find their current contact details and complaint process.
Other websites
This website links to other sites. We’re not responsible for their content or their privacy practices, and we’d encourage you to read their policies before giving them your information.
Changes to this policy
We review this policy periodically and update it when our practices or the law change. The current version is always published here, and the date at the top shows when it last changed. Where a change is significant, we’ll say so on our website or let you know directly.
Contact us
For anything to do with privacy — questions, access requests, corrections or complaints — email our Privacy Officer at privacy@gbau.staging.gici.com.au.