Search Labs Privacy Policy

This Privacy Policy explains how Search Labs Pty Ltd (ABN 94 622 684 075) (“Search Labs”, “we”, “us”, “our”) handles personal information. We are a digital search experience optimisation consultancy based in Australia, specialising in AI-backed search, analytics and optimisation services delivered primarily to business clients.

For the purposes of Australian law, we are an APP entity under the Privacy Act 1988 (Cth) and are bound by the 13 Australian Privacy Principles (APPs).

For individuals in the European Economic Area (EEA), United Kingdom (UK) and other regions with comparable laws, we generally act as a “controller” for our own marketing, website and business operations data, and as a “processor”/“service provider” when we handle data on behalf of our clients.

This Privacy Policy applies to:

• our website at https://www.searchlabs.com/ and any country-specific domains or subdomains we operate;

• our marketing and communications activities (email, social media, webinars, events, surveys);

• provision of consulting and implementation services to clients; and

• any other interactions where we determine the purposes and means of processing personal information.

It does not apply where we handle personal information solely as a service provider for a client under a separate contract (e.g. a data processing agreement). In those cases, our client’s privacy policy will apply and we act on their instructions.

Consistent with APP 1.4(a), we collect and hold the following categories of personal information.

3.1 Contact and identity information

• Name, job title and role

• Business email address and phone number

• Company/organisation name

• Country, state and city

• Your relationship with Search Labs or our clients

3.2 Business and engagement information

• Records of enquiries, proposals and statements of work

• Information about your organisation’s websites, tools and marketing stack (where shared with us)

• Meeting notes, project documentation and feedback

• Information you provide when you participate in our research, workshops, or training

3.3 Website, usage and device data

When you visit our website or interact with our online content, we may automatically collect:

• IP address and approximate location

• Browser type, device type, operating system

• Referring URLs, pages visited, links clicked, time and date of access

• Session information (e.g. scroll depth, button clicks) where we use analytics or session replay tools

• Cookie identifiers and similar tracking identifiers (see Section 7)

3.4 AI and content inputs

As an AI-driven consultancy, we may receive content for analysis through:

• documents, spreadsheets and datasets you upload or share with us;

• website content, logs or exports you provide or authorise us to collect;

• prompts and instructions sent to AI tools we configure for you.

Where these contain personal information, they are treated as confidential client data and handled in accordance with this policy and any applicable contract.

3.5 Marketing and preferences

• Marketing subscription status and preferences

• Records of email interactions (opens, clicks) at an aggregate or pseudonymous level

• Event registrations, feedback forms and surveys

3.6 Recruitment information

If you apply for a role or collaborate with us as a contractor, we may collect:

• CVs, cover letters, LinkedIn or portfolio links

• Employment history, qualifications, references

• Right-to-work and background-check information where lawful and relevant

3.7 Sensitive information

We do not intentionally seek to collect sensitive information (e.g. health, political opinions, religious beliefs) under the Privacy Act. Where such information is incidentally provided (for example in free-text fields or documents), we will handle it in accordance with applicable law and, where appropriate, de-identify or delete it.

In line with APP 1.4(b), we collect personal information in the following ways.

4.1 Information you provide directly

• When you fill in forms on our website (e.g. “Contact”, “Request a proposal”, “Download resources”)

• When you email, call or message us, or meet with us in person or online

• When you register for our webinars, events or training sessions

• When you respond to surveys, research invitations, or feedback forms

• When you provide documentation or access to systems as part of a project

4.2 Information we collect automatically

• Through cookies, analytics and similar technologies when you visit our website (see Section 7)

• Via server logs and security systems that capture technical and usage data

4.3 Information from third parties

• Public or industry sources (e.g. LinkedIn, professional directories, public websites)

• Referral partners, agencies and technology vendors (where lawful)

• Our clients, where your details are provided as a project contact or stakeholder

We collect personal information only where it is reasonably necessary for our functions and activities, in accordance with APP 3.

Consistent with APP 1.4(c), we collect, hold, use and disclose personal information for the following purposes.

5.1 Service delivery and operations

• Responding to enquiries and providing proposals

• Delivering consulting and implementation services

• Setting up and managing client accounts, access and authorisations

• Providing training, documentation and support

• Analysing performance and improving the services we provide

5.2 AI-based analytics and optimisation

• Analysing website, content and campaign performance

• Building and testing AI-powered prototypes, dashboards and workflows for clients

• Applying natural language processing, embeddings and related techniques to client datasets, subject to contract and law

• De-identifying or aggregating personal information to generate insights and benchmarks

We do not use client personal information to train publicly-available AI models without a clear legal basis and, where required, a written agreement or consent.

5.3 Marketing and relationship management

• Sending newsletters, updates, invitations and thought leadership content

• Personalising our communications based on your interests and interactions

• Managing event registrations, attendance and follow-up

• Generating anonymised or aggregated statistics about marketing effectiveness

You can opt out of direct marketing at any time (see Section 6).

5.4 Security, compliance and risk management

• Monitoring, detecting and preventing fraud, abuse or security incidents

• Complying with our legal and regulatory obligations

• Responding to lawful requests from regulators, law enforcement or courts

• Exercising or defending our legal rights

Where the Privacy Act or other law permits, we may use or disclose personal information for related secondary purposes that you would reasonably expect, or with your consent.

We may use your contact details to send you information about:

• search experience optimisation, SEO and AI-based analytics;

• events, training and webinars;

• new services, tools or resources relevant to your role.

You can opt out of marketing communications at any time by:

• clicking the “unsubscribe” link in our emails; or

• contacting us directly (see Section 17).

We may still contact you for non-marketing purposes, such as service updates, security notices, debt collection, or responses to your enquiries.

We use cookies and similar technologies to help our website function and to understand how it is used. This may include:

• Strictly necessary cookies – required for security and basic site functionality;

• Analytics cookies – to measure website performance, traffic sources and user journeys (e.g. via web analytics tools);

• Preference cookies – to remember your choices (e.g. language or region).

Some third-party tools (e.g. analytics, tag managers, session-replay, A/B testing tools) may set their own cookies when integrated on our site. These providers process data on our behalf or as independent controllers, under their own privacy terms.

You can manage or disable cookies via your browser settings. Note that certain features of our website may not function correctly if cookies are disabled.

If we later implement a cookie banner or granular consent controls, those controls will work in conjunction with, and not replace, this Privacy Policy.

We do not sell personal information. We may disclose personal information to:

• Internal personnel – our directors, staff and contractors who need access to perform their duties and are subject to confidentiality obligations;

• Service providers and vendors – such as cloud hosting providers, email and CRM platforms, analytics tools, AI platform providers, document storage providers and professional advisers (legal, accounting, insurance), who assist us to operate our business;

• Clients – where your information is shared in the course of a project and you are a project stakeholder or contact;

• Authorities and regulators – where required or authorised by law, or where we reasonably believe disclosure is necessary to protect rights, property or safety;

• Prospective buyers or investors – in the context of a merger, acquisition or similar transaction, subject to confidentiality.

We require third-party service providers who process personal information on our behalf to implement appropriate security measures and use the information only for the purposes we specify.

Search Labs is based in Australia, but many of our service providers and clients operate globally. Consistent with APP 1.4(f)–(g), your personal information may be transferred to, or stored in, countries including (but not limited to):

• Australia

• United States

• Member States of the European Union / EEA

• United Kingdom

• Other locations where our cloud, analytics or AI providers host their infrastructure

When we disclose personal information to overseas recipients, we take reasonable steps to ensure those recipients handle the information in a way that is consistent with the APPs and any other applicable laws. This may include:

• using providers that commit contractually to appropriate data protection standards;

• implementing standard contractual clauses or similar mechanisms where required; and

• minimising personal information shared, and de-identifying data where feasible.

For EU/UK individuals, we rely on appropriate safeguards such as standard contractual clauses or other recognised transfer mechanisms where required by GDPR/UK GDPR.

Search Labs makes extensive use of AI, machine learning and advanced analytics, primarily to optimise websites and digital experiences for our clients.

10.1 Use of AI tools

We may send data (including some personal information) to third-party AI tools via secure APIs for purposes such as:

• topic analysis, clustering and summarisation

• generating draft content for review by human experts

• automated categorisation and quality checks

• building recommendation or search relevance models

Where possible, we configure these tools so that data sent via enterprise/API channels is not used to train publicly-available AI models, unless we have a clear legal basis and contractual protections.

10.2 Automated decision-making

At the date of this policy, we do not rely solely on automated decision-making (including profiling) to make decisions that produce legal or similarly significant effects on individuals (for example, decisions about employment, credit, or access to essential services).

If in future we introduce such systems, we will update this policy to include the additional information required under applicable law, including the Privacy Act 1988 changes scheduled to require more transparency for computer-based decisions that significantly affect individuals’ rights or interests.

In line with APP 11, we take reasonable steps to protect personal information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure.

Measures we use include:

• access controls, authentication and role-based permissions;

• encryption in transit (and at rest, where supported by our providers);

• secure configuration and monitoring of our cloud and SaaS services;

• regular updates and patching of critical systems;

• staff training and internal policies on confidentiality and acceptable use.

No method of transmission or storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security.

Where lawful and practicable (for example, when browsing our website, or making a general enquiry that does not require a personalised response), you may choose to deal with us anonymously or using a pseudonym, as contemplated by APP 2.

However, in many cases we may need certain information (such as your name and contact details) in order to respond to you, enter into a contract, or provide services.

In accordance with APPs 12 and 13, you have the right to request:

• Access to the personal information we hold about you; and

• Correction of that information if it is inaccurate, out-of-date, incomplete, irrelevant or misleading.

To make such a request, please contact us using the details in Section 17. We may need to verify your identity before providing access or making corrections.

In some circumstances, we may refuse access or correction, or provide limited access (for example, where providing access would unreasonably impact the privacy of others, or where we are required by law to withhold certain information). If that happens, we will explain the reasons for our decision and outline how you can complain or seek review.

If you are located in the EEA or UK, in addition to the rights above you may have rights under GDPR/UK GDPR including the right to: 

• Access your personal data and obtain a copy;

• Rectify inaccurate or incomplete personal data;

• Erase your personal data (“right to be forgotten”) in certain circumstances;

• Restrict our processing of your personal data in certain circumstances;

• Object to processing based on our legitimate interests (including profiling), particularly in relation to direct marketing;

• Data portability, where technically feasible, for personal data you provided to us on the basis of consent or contract;

• Withdraw consent at any time where processing is based on consent (without affecting the lawfulness of processing before withdrawal); and

• Lodge a complaint with your local data protection authority.

Where we rely on legitimate interests as our legal basis for processing, those interests typically include: providing and improving our services, communicating with current and prospective clients, ensuring security and preventing fraud, and analysing how people use our website and content.

Our website, services and content are aimed at business and professional users. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected personal information about a child, please contact us so we can investigate and, where appropriate, delete it.

17.1 Contacting Search Labs

If you have any questions, concerns or complaints about how we handle your personal information, or if you wish to exercise your privacy rights, please contact us:

Privacy Officer
Search Labs Pty Ltd
Address: 585 Little Collins Street, Melbourne VIC 3000, Australia 
Email: [support@searchlabs.com]
Phone: [0415575737]

We will acknowledge your complaint and aim to respond within a reasonable timeframe. We may ask for additional information to help us understand and resolve your concerns.

17.2 Complaints to the OAIC (Australia)

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC): 

• Online: via the forms on the OAIC website

• Mail: GPO Box 5288, Sydney NSW 2001, Australia

• Phone: 1300 363 992 (within Australia)

The OAIC generally expects that you first raise your complaint with the organisation concerned before contacting them.

17.3 Other regulators

Depending on where you are located, you may also have the right to complain to:

• Your local data protection authority in the EEA or UK; or

• Other regional privacy regulators (for example, state information commissioners in Australia).

We can provide guidance on which authority may be appropriate based on your location.

Our website and content may contain links to third-party sites, services, tools or platforms that are not operated by us. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information to them.

We may update this Privacy Policy from time to time, for example to reflect changes in:

• our services and business operations;

• the technologies we use (including AI tools); or

• applicable laws and regulatory guidance, such as reforms to the Privacy Act 1988 and APPs.

We will post the updated policy on our website with a new “Last updated” date. In some cases, we may also notify you directly (for example, by email or a notice on our website) where changes are significant.

Your continued use of our website or services after any changes take effect will constitute your acknowledgement of the updated policy.