BlueGorilla

Privacy Policy

Last updated 21 August 2026. How BlueGorilla collects, uses, stores and protects your personal information.

Privacy Policy

BlueGorilla (ABN 51 837 738 029, PO Box 31, Emerald VIC 3782, Australia) is the data controller for the personal information you provide to us through our website bluegorilla.au, our client area, and in the course of providing our hosting, domain name registration and related services.

This Privacy Policy applies to our website, client portal, support tickets, phone calls with our Melbourne-based team and any related product or service we supply. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Summary — the quick version

  • We only collect the minimum info needed to run your hosting/domains and get paid.
  • We do not sell, rent, share, trade or otherwise disclose your personal data to unrelated third parties for their marketing purposes.
  • Your data is stored inside Australian data centres (Sydney + Melbourne). Encrypted backups replicate within Australia only.
  • Payments are handled by PCI-DSS compliant processors (Square and PayPal). We never see or store full card numbers.
  • Managed Cloudflare DNS resolvers process DNS queries on our behalf under a signed Data Processing Addendum (DPA).
  • You can request access, correction, or deletion at any time by emailing privacy@bluegorilla.au.

1. What we collect

1.1 Account and billing information

  • Full name, company/trust name, phone, email, postal/mailing address.
  • ABN / ACN (only when provided by you).
  • Salted password hash — we never store plain text passwords.
  • Billing transaction records: amount, date, GST, invoice number, payment method reference tokens.
  • Correspondence: tickets, phone notes, email replies, contact form submissions.

1.2 Service information

  • Domain registrant data passed to auDA/Dreamscape Networks per registry policy.
  • Provisioning metadata: chosen plan, cycle, domain, cPanel username, status, next due date.
  • Managed Cloudflare DNS record data: record name/type/TTL/content/proxy status, mirrored via Cloudflare v4 API.
  • Account backups (files/databases/emails/DNS), encrypted, retained by plan cadence.

1.3 Website analytics and usage (minimal)

  • Server access logs (IP, user-agent, URL) for security abuse detection and DDoS mitigation only — not for advertising.
  • Short-lived cookies: PHPSESSID session + CSRF anti-forgery only. No Google Analytics, no Meta Pixel, no third-party tracking cookies by default.

2. Lawful basis (APPs)

  1. Contract performance — to open/maintain your account, provision cPanel, register domains, send invoices, renew services.
  2. Legitimate interest — access logs for intrusion detection, renewal reminders, outage security bulletins, support replies.
  3. Legal obligation — auDA mandatory registrant data retention, 7yr tax invoices, validly issued subpoenas.
  4. Consent — optional marketing newsletter opt-in, withdraw anytime.

3. Where we store it and who we share it with

3.1 Data residency — Australia first

  • Client area DB, metadata, invoices, tickets and DNS records live in Sydney + Melbourne MariaDB.
  • cPanel content + backups to ap-southeast-2 (Sydney).
  • Cloudflare queries served from SYD/MEL/PER/BNE/ADL edge PoPs per DPA.

3.2 Sub-processors (DPAs in place)

  • Square Australia / PayPal Australia — PCI DSS payments.
  • Cloudflare Inc. — Managed DNS, DDoS, CDN, WAF.
  • Dreamscape Networks (Synergy Wholesale) — domain registrar API, auDA registrar connection.
  • WHM/cPanel upstream — license + patch delivery only.

4. Retention

  • Active: life of relationship.
  • Closed accounts: 7 years (tax + auDA retention).
  • Access logs: rotated after 30 days (18 months for flagged abuse).
  • Marketing list: until unsubscribe or 24 months inactivity.

5. Security

  • Passwords: bcrypt work-factor 12+ per-user salt.
  • API keys & tokens: AES-256-GCM envelope encryption at rest.
  • HTTPS only with HSTS.
  • cPanel servers: CageFS, CSF/LFD, ModSecurity, ImunifyAV malware scan.
  • Staff access is role-based and audited. No offshore support.

Notifiable Data Breach scheme response: we will notify you and the OAIC within the 72-hour window where required by law.

6. Your privacy rights

  1. Ask for a copy of what we hold — email privacy@bluegorilla.au quoting account email.
  2. Correct inaccuracies — edit in Client Area → Account → Profile, or open a ticket (.au registrant changes may require auDA proof of entitlement).
  3. Request deletion — subject to legal retention carve-outs (7yr tax, auDA history).
  4. Object to processing where we rely on legitimate interest.
  5. Complain — first to us (10 business day response). Unresolved? OAIC at oaic.gov.au.

7. Children and sensitive information

We do not knowingly collect data from children under 15 without guardian contracting on their behalf. We do not process sensitive information (race, health, biometrics, religion) except where volunteered in a ticket and strictly necessary to resolve it.

8. International transfers

Primary data stays in Australia. Sub-processors with offshore components are bound by DPAs / SCCs meeting APP 8.1.

9. Changes to this policy

Material changes: 14-day client area banner before effect. Minor typo/copy edits: immediate on this URL. Last updated date at top = effective date.

10. Contact the Privacy Officer

BlueGorilla Privacy Officer · PO Box 31, Emerald VIC 3782 · privacy@bluegorilla.au · 1300 844 401 (Mon–Fri 9am–5:30pm Melbourne)