Muru Bridge Privacy Policy

1. About this policy

Muru Bridge is a board governance advisory business, co-founded and directed by Karen Wood and Margaret Gilbert. Muru Bridge helps boards build genuine confidence in cyber and AI risk.

This policy explains, in plain English, what personal information Muru Bridge collects through murubridge.com, why we collect it, how we look after it, and what say you have over it.

2. Why we have this policy at all

Many advisory businesses our size (annual turnover under $3 million) are technically exempt from the federal Privacy Act 1988 (Cth) under its small business exemption.

Muru Bridge has chosen not to rely on that exemption. Our own work is helping boards take cyber and AI governance seriously — it would sit oddly if we didn't hold ourselves to the same standard we ask of our clients. So, this policy follows the Australian Privacy Principles (APPs) under the Privacy Act voluntarily, as a floor, not a ceiling.

3. What personal information we collect

Through the website's contact form, we collect only what we need to call you back:

• First Name
• Last Name
• Organisation
• Role (Chair / Director / Company Secretary / Executive – Management / Advisor / Other)
• Email
• Phone (optional)
• Best time to call
• Whether you'd like to receive occasional insights by email — unticked by default; see Section 6, Marketing emails.

If your enquiry becomes a client engagement, we collect further information as part of that work. That's set out separately in your engagement letter, not in this policy document.

Muru Bridge doesn't knowingly collect sensitive information (health, financial or government ID details, for example) through the website, and we ask that you don't include it in the contact form's free-text fields.

4. How we collect it

We collect it directly from you — when you submit the contact form, or email or call us directly. The form itself is built and hosted in HubSpot, with data held in Australia. See Section 8, Who we share your information with, for what that means for where your information travels before it reaches us.

5. Why we collect and use it

We only collect personal information to:

• Respond to your callback request and have the conversation you asked for;
• Deliver services you've engaged us for;
• Send you occasional insights by email, but only if you've actively ticked the box to opt in; and
• Meet our own legal, accounting and insurance obligations.

We don't use your information to make any automated decision about you — see Section 7, How we use AI — and what we don't do with it.

6. Marketing emails

The "Occasional Insights" checkbox on our contact form is unticked by default. We only add you to our Insights list if you actively tick it — this is express consent, not an assumption.

Every marketing email we send will clearly identify Muru Bridge and include a working Unsubscribe link, honoured within five business days, free of charge, for at least 30 days after sending — consistent with the Spam Act 2003 (Cth).

7. How we use AI — and what we don't do with it

AI is not intelligence; it is pattern recognition. We use AI, we test it against multiple models, and we're honest with you about both its benefits and its limits.

What this means in practice:

• Parts of this website, and some of our other content, were drafted with the help of Claude (Anthropic) and edited, fact-checked and improved by us before publishing.
• We have our own AI Charter — the same standard of guardrails, logging and human oversight we'd ask of your own organisation.
• We do not use AI to make any automated decision that affects you. No AI system decides whether or how we respond to your enquiry — a person reads and responds to every contact-form submission.

If that ever changes, the Privacy Act's own automated-decision transparency rules (Australian Privacy Principle 1.7–1.9, in force from 10 December 2026) would require us to tell you in advance — we'd update this section and notify you before making the change, not after.

7.1 Standards we hold ourselves to

Beyond what the law requires, we look to two voluntary national frameworks to keep our own AI use honest and ethical:

• Australia's AI Ethics Principles (Department of Industry, Science and Resources) — eight principles covering wellbeing, human-centred values, fairness, privacy and security, reliability and safety, transparency, contestability and accountability.
• The Voluntary AI Safety Standard (Department of Industry, Science and Resources) — ten practical guardrails for responsible AI use, from governance and risk management through to human oversight, end-user disclosure and contestability.

We also watch the direction of ISO/IEC 42001, the international standard for AI management systems, as a reference point for where AI governance practice is heading. We are not certified against it, and we don't claim to be.

8. Who we share your information with

We don't sell your personal information, to anyone, ever. We may also share limited information with trusted third parties who help us run the business — for example, our accountant, our insurer, or a cyber/AI delivery partner engaged on a specific client project — only where necessary, and only under terms that protect your information.

We will only disclose personal information where the law requires it — for example, in response to a valid court order.

9. Cookies and website analytics

If we add analytics to our murubridge.com website — for example, to understand which pages are the most useful — we will name the specific tool here and explain what it collects. If a page uses cookies that aren't strictly necessary for the site or page to function, we will ask for your consent before it runs, in keeping with the OAIC's guidance on cookies and tracking technologies.

10. Storage, security and retention

We store the information we hold in Australia. We keep it only as long as we reasonably need it:

• A contact-form enquiry that doesn't become a client engagement: kept for up to 24 months, then deleted.
• Client engagement records kept in line with our standard business recordkeeping obligations, typically a minimum of 6 years for financial records under Australian tax law.
• Your opt-in to receive insights emails, which is kept until you unsubscribe or ask us to stop.

We take reasonable technical and organisational steps to protect your information against misuse, loss, and unauthorised access, modification or disclosure — including restricting who can access it and reviewing our own practices periodically.

11. Your rights

You can ask us, at any time, to:

• See the personal information we hold about you;
• Correct it, if it's wrong or out of date; or
• Tell you more about how we've used it.

We'll respond within a reasonable time — generally within 30 days. There's no charge for a straightforward request.

12. How to make a complaint

If you're unhappy with how we've handled your personal information, tell us first — contact details are in Section 15, Contact us. We take this seriously and will respond promptly.

If you're not satisfied with our response, you can file a complaint to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, or 1300 363 992.

13. Children's privacy

This website and our services are directed at company directors, officers and professional advisers — not children. We do not knowingly collect personal information from anyone under 18.

14. Changes to this policy

We'll update this page as our practices change, particularly as the Privacy Act's own reform process continues — the Privacy Amendment (Personal Data Protection) Bill 2026 was still an exposure draft, not law, as at the date of this version. We'll date every version at the bottom of each page.

15. Contact us

• Margaret Gilbert — margaret.gilbert@murubridge.com
• Karen Wood — karen.wood@murubridge.com

16. References

This Privacy Policy document aligns with the following:

• The Australian Privacy Principles under the Privacy Act 1988 (Cth) — Office of the Australian Information Commissioner (OAIC).
• The Spam Act 2003 (Cth) — Australian Communications and Media Authority (ACMA).
• Australia's AI Ethics Principles — Department of Industry, Science and Resources.
• The Voluntary AI Safety Standard (10 guardrails) — Department of Industry, Science and Resources.
• ISO/IEC 42001, the international AI management-system standard — referenced only; Muru Bridge is not certified against it.
• The Privacy Amendment (Personal Data Protection) Bill 2026 (exposure draft) and the automated-decision transparency provisions commencing 10 December 2026.

17. Acronyms and abbreviations