Last updated: 25 May 2026
Epic Enterprises (WA) Pty Ltd (ABN 40 121 238 293) is committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains how we collect, use, store, and disclose your personal information.
Who we are
Epic IT is a managed IT services provider headquartered in North Perth, Western Australia, with offices in Sydney and Brisbane. We provide managed IT support, cybersecurity, cloud services, AI governance, and strategic IT advisory to Australian businesses. Our website is www.epicit.com.au.
Information we collect
We may collect the following personal information in the course of providing our services or through your use of our website:
- Identity information: name, job title, company name
- Contact information: email address, phone number, business address
- Technical information: IP address, browser type, device information, pages visited, referral source
- Service information: IT environment details, support tickets, system configurations, and documentation necessary to deliver our managed services
- Financial information: billing address and payment details (processed securely through our payment provider; we do not store credit card numbers on our servers)
- Communication records: emails, support requests, phone call records, and meeting notes related to service delivery
We do not collect personal information from individuals under 18. If we become aware that we have inadvertently collected such information, we will delete it promptly.
How we collect information
We collect personal information through:
- Contact forms and enquiry submissions on our website
- Phone calls and emails to our team
- Service agreements and onboarding processes
- Support tickets submitted through our helpdesk
- Cookies and analytics tools on our website (see Cookies section below)
- Third-party platforms including Microsoft 365, Google Analytics, and our CRM system
How we use your information
We use your personal information to:
- Deliver managed IT services, cybersecurity, and support under our service agreements
- Respond to enquiries and provide quotes
- Communicate service updates, maintenance windows, and security alerts
- Improve our services through analytics and feedback
- Send marketing communications (only where you have opted in; you can unsubscribe at any time)
- Comply with legal obligations, including the Notifiable Data Breaches scheme
- Protect the security of our systems and our clients’ environments
We will not use your personal information for purposes other than those described above without your consent.
Managed services and client data
As a managed IT services provider, we may have access to data within your IT environment as part of delivering our services. This includes system configurations, user accounts, email systems, and security settings. We treat all client environment data as confidential and subject to the terms of our service agreement.
Epic IT is ISO 27001 certified, which means we operate under an independently audited information security management system. Our security controls, access policies, and data handling procedures are reviewed annually by external auditors.
We do not access, read, or use client business data (such as emails, documents, or files) unless specifically requested by the client for support purposes or required by law.
Automated decisions and AI use
Epic IT uses AI tools internally to support our operations. Typical uses include drafting and reviewing written communications, triaging support tickets, generating service reports and summaries, and assisting our engineers during investigation and incident response.
These uses are designed to support, not replace, human judgement. Where AI is involved in any decision that could reasonably be expected to significantly affect an individual’s rights or interests, that decision is reviewed by a human before it is finalised. This applies to areas such as recruitment, credit assessment, and any other decision affecting a person’s access to our services or employment with us.
Our internal AI governance approach is aligned with ISO 42001, the international standard for AI management systems, separate from the ISO 27001 framework that governs our information security.
If you believe a decision has been made about you with substantial assistance from an automated system, and you would like to request a human review or an explanation, contact us at info@epicit.com.au. We will respond within 30 days.
This section is provided in anticipation of the new transparency requirements for automated decision-making that commence under the Privacy Act on 10 December 2026.
Epic IT as an AI operator for clients
Some of our clients use AI tools and AI agents that we operate on their behalf as part of their managed services. When this happens, Epic IT is the operator of the infrastructure. The client remains the APP entity, or equivalent privacy controller, for any decisions those AI tools make about their staff, customers, or other individuals.
Our role in those engagements is to provide the platform, identity and access controls, logging, governance enforcement, and audit trail. The client retains responsibility for what decisions the AI is permitted to make, what data it is permitted to see, and how those decisions are reviewed.
We log AI agent activity within our clients’ environments to support our clients’ own privacy and audit obligations. Those logs are held under the same security controls described elsewhere in this policy and are accessible to the client on request.
Data storage and security
Your personal information is stored on secure systems hosted in Australia. We implement technical and organisational measures to protect your information, including:
- Encryption in transit (TLS) and at rest
- Multi-factor authentication for all internal systems
- Role-based access controls following the principle of least privilege
- Regular security assessments and penetration testing
- Staff security awareness training
- Incident response procedures aligned with ISO 27001
Where we use third-party service providers (such as Microsoft Azure, ConnectWise, or Datto), we ensure they maintain appropriate security standards and that data remains within jurisdictions with adequate privacy protections.
Data retention
We retain your personal information for as long as necessary to provide our services and comply with legal obligations. Specifically:
- Client service records: retained for the duration of the service agreement plus 7 years, in accordance with Australian tax and business record requirements
- Support tickets: retained for 3 years after resolution
- Marketing contacts: retained until you unsubscribe or request deletion
- Website analytics: retained for 26 months (Google Analytics default)
- AI agent activity logs: retained for the duration of the relevant service agreement plus 12 months, unless a longer period is required by the client’s own retention obligations
You may request deletion of your personal information at any time by contacting us at info@epicit.com.au.
Cookies and tracking
Our website uses cookies and similar technologies to improve your experience, analyse traffic, and support our marketing activities. We use:
- Essential cookies: required for the website to function (session management, security)
- Analytics cookies: Google Analytics 4 to understand how visitors use our site (anonymised IP addresses)
- Marketing cookies: Google Ads and Meta (Facebook) pixels to measure advertising effectiveness and serve relevant ads
You can manage cookie preferences through your browser settings. Disabling cookies may affect your experience on our website.
Sharing your information
We do not sell, trade, or rent your personal information. We may share your information with:
- Service delivery partners: third-party vendors who assist in delivering our managed services (e.g., Microsoft, ConnectWise, Datto, Fortinet), subject to confidentiality agreements
- Professional advisers: accountants, lawyers, and auditors as required
- Regulatory authorities: where required by law, regulation, court order, or government request
All third-party providers are contractually required to handle your information in accordance with this privacy policy and applicable Australian privacy law.
Data breach notification
In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988.
Your rights
Under the Australian Privacy Principles, you have the right to:
- Access the personal information we hold about you
- Correct any inaccurate or outdated information
- Request deletion of your personal information (subject to legal retention requirements)
- Opt out of marketing communications at any time
- Request human review of any decision about you that was made with substantial assistance from an automated system
- Complain to the OAIC if you believe we have breached the APPs
To exercise any of these rights, contact us at info@epicit.com.au. We will respond within 30 days.
Links to other websites
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing any personal information.
Changes to this policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.
Contact us
If you have questions about this privacy policy or wish to make a complaint about how we handle your personal information, contact us:
Epic Enterprises (WA) Pty Ltd
62 Angove Street, North Perth WA 6006
Phone: 1300 EPIC IT (1300 374 248)
Email: info@epicit.com.au
Website: www.epicit.com.au
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner.