1.2 Information you give us automatically

Our website is hosted on Webflow. Webflow's servers automaticallycollect standard technical data needed to serve the site, including IPaddress, browser type, device type, and the pages youvisit. We do notuse analytics, advertising, or tracking tools on our website.

1.3 Information from third parties

- Public sources: we may review publicly available professional information about candidates and prospects
- Referrers: if someone refers you to us for a role or engagement, we may receive your name, contact details, and the context of the referral

We do not knowingly collect sensitive information (as defined under the Privacy Act) unless it is voluntarily provided and necessary for a specific purpose you have consented to.

2.1 Operating our business

- Responding to inquiries sent to us by email or through forms linked from our website
- Evaluating job applications and managing our recruiting process
- Matching candidates to potential client engagements
- Arranging interviews and other communications

2.2 Operating and securing our website

- Serving the website through our hosting provider (Webflow)
- Preventing fraud, abuse, and security incidents

2.3 Communications

- Replying to your messages
- Sending follow-ups relevant to a role, project, or inquiry
- Sharing updates about Lyra that you have asked to receive

2.4 Legal and compliance

- Meeting obligations under applicable laws and regulations
- Responding to lawful requests from regulators, courts, or law enforcement
- Enforcing our agreements and protecting our rights, property, and safety

We will not use personal information for materially different purposes without telling you first and, where required, obtaining your consent.

3.1 Service providers

We use third-party service providers (such as hosting, email, and payroll platforms) to help operate our business. They access personal information only to perform services for us and are contractually required to protect it.

3.2 Clients

If you apply for a role and we believe you are a fit for a client engagement, we may share information relevant to that engagement with the relevant client for their evaluation. The specific information we share depends on the client's requirements and the role, and may include things such as your name, professional skills, availability, and where relevant your CV or assessment materials. We only do this for legitimate recruiting purposes.

3.3 Legal obligations

We may disclose personal information where required by law, regulation, court order, or government request, or where we believe disclosure is necessary to protect the rights, property, or safety of Lyra, our personnel, our clients, or the public.

3.4 Business transfers

If Lyra is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will take reasonable steps to notify affected individuals before their information becomes subject to a different privacy policy.

3.5 Aggregated or anonymised data

We may create and share aggregated or de-identified data that cannot
reasonably be used to identify you.

8.2 Residents of the EU, UK, and EEA

If you are located in the European Union, United Kingdom, Liechtenstein, Norway, or Iceland, you may have additional rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, erase, restrict processing of, or port your personal data, and to object to processing.

To exercise any of these rights, contact privacy@lyratechnologies.com.au

8.3 California residents

California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and to request deletion. We do not sell personal information.

To make a request, contact privacy@lyratechnologies.com.au

10.1 Our commitments

- We do not send unsolicited commercial electronic messages advertising or linking to our website, and we do not authorise or engage any employee, contractor, agency, affiliate, reseller, or other third party to do so on our behalf.
- We send commercial electronic messages only where the recipient has given express or inferred consent, consistent with the Spam Act 2003 (Cth).
- Every commercial electronic message we send accurately identifies Lyra Technologies as the sender, includes accurate sender contact details, and includes a functional unsubscribe facility that is honoured within five (5) business days.
- We do not purchase, rent, trade, or harvest email address lists, and we do not use scraped or third-party-sourced contact data for unsolicited outreach.
- We do not use unrelated or disposable sending domains to conceal the origin of messages that link to our website.

10.2 Third parties

Any contractor, agency, affiliate, or partner who advertises our website using unsolicited messages is in breach of their agreement with us. On confirming a breach we terminate the arrangement and require the immediate cessation of all sending.

10.3 Reporting

To report a message you believe breaches this policy, contact abuse@lyratechnologies.com.au and include the full message headers where possible. We investigate all reports and respond within five (5) business days.

10.4 Enforcement

We maintain internal controls to enforce this policy, including a suppression list of all recipients who have unsubscribed or complained, restriction of outbound sending to authorised systems published in our SPF record, and DMARC monitoring of messages sent using our domain.