Privacy Policy

1. Our commitment

Icono Building Design (“we”, “us”, “our”) is committed to protecting the privacy of visitors to www.iconobuildingdesign.com.au and the privacy of our clients, project enquirers and contractors. This Privacy Policy explains how we collect, use, disclose and safeguard personal information.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For background on the APPs, see the Office of the Australian Information Commissioner (OAIC).

2. Information we collect

The personal information we collect depends on how you interact with the site and our practice:

• Contact form submissions — your name, phone number, email address, project location, project type and the content of your message.
• Direct phone enquiries — your name and any details you choose to share when discussing a potential project.
• Site analytics — anonymised technical data such as browser, device type, approximate location (city/region), pages visited, time on site, and the referring page or search query.
• Server logs — IP addresses, timestamps and request data captured by our hosting provider for security, abuse prevention and operations.
• Project engagement information — once you become a client, we collect the information necessary to deliver design services, including site addresses, council references, briefs and reference material you supply.

We do not knowingly collect sensitive information (as defined in the Privacy Act) through this website.

3. How we use your information

We use personal information for the purpose for which it was provided and for related purposes, including to:

• Respond to enquiries and quote requests.
• Schedule and conduct obligation-free consultations.
• Deliver building design services and council documentation.
• Communicate project updates, drawings, fees and approvals.
• Operate, secure, maintain and improve this website.
• Comply with our legal and regulatory obligations.

We do not sell or rent personal information to third parties.

4. Third-party services

This website uses, or may use, the following third-party services that handle visitor data on our behalf. Each is bound by its own privacy policy.

5. Cookies and tracking

This site uses a small number of cookies and similar technologies:

• Strictly necessary — set by Cloudflare to deliver the site securely and prevent abuse.
• Analytics — if Google Analytics 4 is enabled, anonymised cookies record aggregate usage data with IP anonymisation. No individual user is identified.
• Form security — Cloudflare Turnstile may set short-lived tokens to verify that contact-form submissions are not from automated bots.

You can clear or block cookies at any time through your browser settings. Doing so may affect the functionality of contact forms.

6. Data security

We take reasonable steps to protect personal information from misuse, loss, unauthorised access, modification or disclosure. Measures include:

• HTTPS (TLS) encryption across the whole site.
• Hosting on Cloudflare’s globally-distributed, security-hardened edge network.
• Bot mitigation on submission forms.
• Restricted internal access to project files and enquiry data.

No internet-based transmission can be guaranteed 100% secure. If you have concerns about transmitting sensitive material, please call us on 02 6922 6388 rather than submitting it via web form.

7. Data retention

We retain personal information only for as long as is reasonably necessary for the purpose for which it was collected, or as required by law.

• Contact-form enquiries that do not progress to engagement are typically retained for 24 months, then deleted.
• Active client project files are retained for the duration of the engagement and for 7 years afterwards in line with NSW professional record-keeping practice and statutory limitation periods.
• Anonymous analytics data is retained per Google’s standard GA4 retention settings (currently 14 months).

8. Your rights

Under the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you.
• Correct personal information that is inaccurate, out of date, incomplete or misleading.
• Withdraw consent for non-essential processing (such as analytics).
• Request deletion of personal information that is no longer required for any lawful purpose.
• Lodge a complaint if you believe we have mishandled your information — first with us, then with the OAIC.

To exercise any of these rights, please contact us using the details below. We will respond within 30 days.

9. Complaints and the OAIC

If you are not satisfied with how we have handled a privacy concern, you may escalate to the Office of the Australian Information Commissioner:

10. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page shows when changes were last made. Material changes will be posted on this page; we encourage you to review it periodically.

11. Contact us

For privacy enquiries, access requests or complaints, please contact us: