Acceptable Use Policy

1. Purpose and scope

This Acceptable Use Policy establishes the standard of conduct required of all persons who access UniMatter information systems, networks, devices, applications, and data. It exists to protect the confidentiality, integrity, and availability of information entrusted to UniMatter, and to ensure that the firm discharges its obligations under the Privacy Act 1988 (Cth), the Australian Privacy Principles, and applicable contractual commitments to clients.

This policy applies to the sole principal, any engaged contractors or subprocessors, and any other person granted access to UniMatter systems, whether that access is provided on UniMatter-owned equipment or on personal equipment used for UniMatter purposes. It applies to all environments, including production, development, and administrative systems, and to all data classifications.

2. Acceptable use

Access to UniMatter systems is granted for legitimate business purposes connected to the delivery of the firm’s advisory, systems, and transformation engagements. Each authorised user is accountable for activity conducted under their credentials and must exercise the care expected of a person handling sensitive client information.

1. Use systems only for the purpose for which access was granted, and only to the extent necessary to perform assigned work.
2. Handle all client and personal information in accordance with its classification and the Data Retention and Deletion Policy.
3. Protect authentication credentials, multi-factor devices, and access tokens against disclosure or shared use.
4. Report suspected security weaknesses, malware, or unauthorised access without delay in accordance with the Incident Response Policy.
5. Lock or secure devices when unattended and store portable devices and removable media securely.

3. Prohibited use

The following uses of UniMatter systems are prohibited. The list is illustrative and not exhaustive; conduct that undermines the security, lawful operation, or reputation of the firm is prohibited whether or not it is enumerated here.

1. Accessing, copying, transmitting, or retaining information without a legitimate business need, or in excess of authorised access.
2. Circumventing, disabling, or attempting to defeat security controls, logging, or monitoring mechanisms.
3. Installing unauthorised software, browser extensions, or services, or connecting unauthorised devices to UniMatter systems.
4. Using systems to store, process, or transmit unlawful material, or material that infringes the intellectual property rights of another party.
5. Transmitting client or personal information to personal accounts, unapproved storage services, or unapproved artificial intelligence tools.
6. Conducting any financial transaction, trade, transfer, or payment instruction through UniMatter systems other than through the firm’s authorised processes.

4. Personal information and confidentiality

Personal information handled through UniMatter systems is protected by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Users must collect, use, and disclose personal information only for purposes consistent with the relevant collection notice and the firm’s engagement with the client to whom the information relates.

Confidential client information must not be disclosed to any party outside the engagement without authorisation. Confidentiality obligations subsist after the engagement concludes and after a user’s access is withdrawn.

5. Email, messaging, and external communications

External communications sent from UniMatter accounts must be accurate, professional, and consistent with the firm’s obligations. Users must verify the identity of recipients before transmitting sensitive information and must use approved encryption or secure-transfer mechanisms where the classification of the information requires it.

Users must remain alert to phishing, business email compromise, and social-engineering attempts. A request to transfer funds, change payment details, or release sensitive information received by email or message must be independently verified through a separate, trusted channel before it is actioned.

6. Use of personal and mobile devices

Where a personal device is used for UniMatter purposes, the user must maintain current operating-system and application updates, enable device encryption and an automatic screen lock, and run reputable endpoint protection. UniMatter information must be stored only within approved applications and must not be retained on a personal device after access is withdrawn.

Lost or stolen devices that hold or can access UniMatter information must be reported immediately so that access can be revoked and, where necessary, the device remotely wiped.

7. Monitoring

UniMatter may log and monitor access to and use of its systems for security, operational, and compliance purposes, to the extent permitted by law. Monitoring is conducted proportionately and for legitimate purposes, and logging records are handled in accordance with the firm’s retention schedule.

Users should not expect that activity conducted on UniMatter systems is private as against the firm, subject to applicable law. Monitoring does not extend to the content of a user’s personal accounts.

8. Breach and consequences

A breach of this policy may result in withdrawal of access, termination of engagement, and, where the conduct warrants it, referral to a regulator or law-enforcement agency. A breach that involves personal information is assessed against the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth) through the Incident Response Policy.

A user who becomes aware of a breach, whether their own or another’s, must report it promptly. Prompt and candid reporting is treated as a mitigating factor.

9. Review

This policy is reviewed at least annually, and on any material change to the firm’s systems, regulatory obligations, or risk profile. Questions about the application of this policy should be directed to UniMatter at administrator@unimatter.com.au.