Privacy Policy

MDP SEC ("we", "us", "our") is a registered business name of The Trustee for Swell Marketing Trust (ABN 52 387 691 784), operated by Marius du Preez in Queensland, Australia. We take your privacy seriously. This policy explains what personal information we collect through mdpsec.com and our security testing work, how we use it, who we share it with, and the choices you have.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). By using this website or contacting us, you agree to this policy.

1. What information we collect

Information you give us

When you apply for a security test, we collect the details you enter in the form: your name, your business email address, and the website domain taken from it. We send a one-time code to that email address to confirm it. We then record that your business confirmed control of its domain by adding a DNS record, and the record we found. Next, you tell us your business's legal name, country and ABN (or company registration number outside Australia), and what to test: which of your confirmed domains and subdomains to include (any extra domain is confirmed with its own DNS record, which we also record), Android apps, anything off limits, the name, role, email address and mobile number of the person who will sign the agreement, and a contact name, mobile number and email address for during testing if that's someone else.

When we send the testing agreement, the person signing it receives a link by email. To open it, they enter a one-time code we email to them. When they sign, we record the name they typed, the confirmations they ticked, and the signed agreement itself, and email a signed copy to them and to the applicant.

At each of these steps we also record the date and time, the IP address and approximate country it came from, and the browser used. Together, this is our record of who asked for and authorised the test. If you email us, we collect your email address and whatever you include in your message.

Information collected automatically

• Website hosting and security. Our website is hosted by Cloudflare. When you visit, Cloudflare processes technical information such as your IP address, browser and device type, the pages you request, and the date and time, so the site can be delivered and protected from attacks.
• Spam protection. The application form uses Cloudflare Turnstile to check that a real person is submitting it. Turnstile looks at signals from your browser and device to do this.
• Fonts. Our pages load fonts from Google Fonts, so your browser connects to Google, which receives your IP address.
• Theme preference. If you switch between light and dark mode, your choice is saved in your own browser. It is not sent to us.

We do not use analytics tools, advertising cookies, or tracking cookies.

Information we come across during a security test

When we test a client's website or Android app, their systems may contain personal information about their own customers. We test using our own accounts and avoid accessing real customers' information wherever possible. If we do come across someone's personal information, we take steps to blank it out on our own machines before using AI tools, and we keep collection and retention to a minimum. Because we use third-party AI services to help with testing, some information may still be processed by them, including outside Australia. The testing agreement sets out how this works, how long information is kept and when it is deleted, and the client consents to it when signing. We may also use de-identified information from security tests to build synthetic test labs for benchmarking AI tools. These never identify a client or any person, and are never used to train AI models. We handle this information only on behalf of the client who engaged us.

2. How we use your information

• To review your application, decide whether it's a fit, and reply to you
• To keep a record showing that testing was requested and authorised by the business, and to protect the form from abuse
• To send you the testing agreement, have it signed online, keep the signed copy, and communicate with you about your test
• To carry out the security test, write your report, and re-check fixes
• To run, secure, and improve our website
• To meet our legal obligations

We don't send newsletters or marketing emails, and we won't add you to a mailing list. We do not use your information to train AI models.

3. Who we share it with

We do not sell your personal information. We only share it:

• With service providers that help us run this website and our work: Cloudflare (hosting, security, spam protection, and the database that stores applications), Resend (sending emails from the application form), Google Workspace (our email), Google Fonts, and the AI services we use to help with security testing (as set out in each client's testing agreement). They may only use it to provide their service to us.
• When the law requires it, or to investigate fraud, abuse, or threats to safety or security
• With your consent

We never share details of a client's security test, or what we found, with anyone else without that client's written permission.

4. Information stored outside Australia

Applications submitted through our website are stored in a Cloudflare database located in the Oceania region. Some of our service providers, including the AI services we use to help with security testing, store or process information outside Australia, including in the United States. We take reasonable steps to make sure they protect your information in a way that is consistent with the Australian Privacy Principles.

5. How we keep it secure

We take reasonable steps to protect your information from misuse, loss, and unauthorised access. This includes encrypted connections to our website, restricted access to our systems and email, restricted access to the application database, a step-by-step record that can't be edited or deleted once written, emailed links that contain no personal details and expire, and keeping testing evidence on our own machines. No system is perfectly secure, so we can't guarantee complete security, but we treat your information the way we'd want ours treated.

6. How long we keep it

We keep your information only as long as we need it for the purposes above. Application and authorisation records, including signed agreements and those for applications that don't go ahead, are kept so we can show who requested and authorised any testing. Information from a security test is kept and deleted as set out in your testing agreement. We may keep some records longer where the law requires it.

7. Accessing and correcting your information

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it. Email [email protected]. We'll respond within 30 days. We may need to confirm your identity first.

8. If you live outside Australia

Depending on where you live, for example in the European Union, the United Kingdom, or California, you may have additional rights, such as the right to restrict or object to how your information is used, or to receive a copy in a portable format. We will honour requests to access, correct, or delete your information wherever you live, and we will never treat you differently for making one.

9. Complaints

If you have a concern about how we've handled your information, please email [email protected] first so we can try to fix it. We'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to the privacy regulator where you live.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.

11. Contact us

MDP SEC
The Trustee for Swell Marketing Trust
ABN 52 387 691 784
29/97 Creek St, Brisbane City QLD 4000
[email protected]

This policy is governed by the laws of Queensland, Australia.