Privacy Policy

This Privacy Policy ("Policy") explains how Shado Pty Ltd ("Shado", "we", "us", or "our") collects, uses, protects, and discloses personal information obtained through our website, applications, and related services (collectively, the "Site"). By accessing the Site, you acknowledge that you have read and understood this Policy.

This Policy operates alongside Shado's Terms of Use, Product Warranty Terms, and any partner or ownership agreements (together, the "Shado Policies"). This Policy applies to personal information collected directly by Shado and by trusted service providers acting on our behalf in connection with website functionality, authentication, or customer contact.

If you provide information on behalf of a business or organisation, you confirm that you are authorised to do so. The Terms of Use are available at www.shadosecurity.com/terms.

We may collect the following categories of information:

• Personal Identifiers: name, phone number, and email address provided through contact, registration, or verification steps.
• Technical and Usage Information: device type, operating system, browser, IP address, session metadata, and click activity.
• Cookies and Similar Technologies: strictly necessary cookies, and analytics or marketing cookies only if you allow them (see Section 6).
• Vault Interaction Data: logs from Vault Lookup or ownership verification requests, including time, outcome, and reference information.
• Support and Correspondence: information voluntarily provided when contacting Shado support, reporting theft, or requesting assistance.

We do not collect product device data or app-controlled recovery data when you are using this public website. Those areas are governed by separate product or app privacy notices. We do not collect financial information, government identification numbers, or behavioural tracking data across unaffiliated websites through this Site.

Operational and service delivery

To provide authentication, Vault Lookup, and ownership verification services; to respond to enquiries. Personal Information processed through Vault Lookup does not determine, confirm, or adjudicate legal ownership, authenticity, or any dispute between parties.

Security and integrity

To detect, prevent, and investigate fraud, counterfeit activity, or unauthorised access; to enforce Shado Policies.

Legal and compliance

To comply with obligations under the Privacy Act 1988 (Cth), GDPR/UK GDPR, and other applicable frameworks; to cooperate with lawful requests.

Analytics and improvement

To analyse usage patterns, optimise website design, and improve reliability; using pseudonymisation and aggregation where technically feasible. Website analytics (Google Analytics) run only if you allow them in the cookie settings.

We process Personal Information on the basis of: performance of a contract where you engage our services; our legitimate interests in security, fraud prevention, and platform integrity; compliance with legal obligations; and your consent where required (for example, for analytics or marketing cookies).

We use certain information (including server logs and Vault Lookup queries) to detect, investigate, and prevent fraud, counterfeiting, unauthorised ownership claims, suspicious activity, and misuse of the Site. We may, where lawful, provide relevant information to law enforcement, insurers, or brand partners for legitimate security or recovery purposes.

We may use automated systems or machine-learning models to analyse patterns, detect suspicious behaviour, support incident prevention, or enhance the accuracy and security of our services. These systems support human review and do not independently make legal or ownership determinations about individual data subjects. They do not produce decisions with legal or similarly significant effects within the meaning of GDPR Article 22.

Shado does not sell, rent, or trade personal information to third parties.

• Encryption: industry-standard safeguards appropriate to the information processed.
• Access Controls: role-based access, least-privilege principles, and confidentiality obligations.
• Data Minimisation: collection limited to necessary purposes; retention controlled by policy (see Section 9).
• Incident Response: breach assessment and notification to the OAIC and affected individuals (Australia); supervisory authority within 72 hours and affected individuals without undue delay (EU/UK GDPR), where required by applicable law.
• Cross-Border Safeguards: contractual and technical measures for international processing (see Section 8).

• Service Providers (Processors): our website host (Hostinger), our cloud infrastructure provider (Amazon Web Services) and our email provider (also Hostinger, which holds the support@shadosecurity.com inbox), under data processing terms. The current list is kept in Shado's Sub-processor Register, available on request from support@shadosecurity.com. With your consent, Shado uses Google Analytics (provided by Google Ireland Limited) to understand how the website is used. Shado uses no advertising vendor.
• Brands: the brand of a protected item can see registry status and tamper events for its own items, item counts and aggregate figures. Brands never see an owner's identity, an item's location or its previous owners.
• Law Enforcement and Insurers: data is shared only where lawful process or user authorisation applies.
• Corporate Transactions: mergers, acquisitions, reorganisations, or asset transfers subject to continuity of privacy protections.
• Legal Obligations and Rights: to comply with laws, court orders, and to protect Shado, users, and the public from harm, fraud, or counterfeit activity.

Shado does not sell personal information or permit third parties to use your information for their own marketing without your explicit consent.

Cookies are small text files stored on your device. The Site uses strictly necessary cookies to work and to remember your cookie choice. Analytics and marketing cookies are optional: they are off until you allow them, and you can change your choice at any time.

Type	Purpose	Required
Strictly necessary	Core security and session management, and remembering your cookie choice (shado_consent, kept for 12 months)	Always active
Analytics	Google Analytics (_ga, _ga_*): counts visits and shows which pages are used and how the Site performs, in aggregate. The _ga cookies expire after 14 months, and Google Analytics keeps the associated event data for 14 months before deleting it.	Only with your consent
Marketing	Measuring campaigns and showing relevant Shado content on other platforms. Not currently in use; no marketing cookie is set unless you allow it.	Only with your consent

On your first visit, a cookie bar lets you accept all cookies, keep essential cookies only, or choose by category. You can change your choice at any time using “Cookie settings” at the bottom of every page, or block or delete cookies in your browser settings.

• Access: request a copy of personal information we hold about you.
• Rectification: correct inaccurate or incomplete information.
• Deletion: request erasure where the applicable legal basis permits. Some provenance and ownership records may need to be retained to preserve record integrity, comply with legal obligations, or prevent fraud. On a valid erasure request, Shado will pseudonymise personal identifiers where appropriate and confirm what has been deleted and what has been retained, and on what legal basis.
• Restriction: request that we limit processing in certain circumstances.
• Object (GDPR Art. 21): object to processing based on legitimate interests. We will assess your objection against our specific legitimate interests and respond within 30 days. Compelling legitimate grounds, including transfer-record integrity and legal claims, may apply to objections relating to provenance records.
• Withdraw Consent: withdrawal does not affect prior lawful processing.
• Portability: obtain certain data in a structured, machine-readable format.
• Complaints: lodge a complaint with the OAIC (Australia), your EU supervisory authority, or the UK ICO (www.ico.org.uk). We will acknowledge complaints within 5 business days and respond substantively within 30 days.

To exercise any of the above rights, email support@shadosecurity.com with the subject line "Privacy Request". We may need to verify your identity; some rights are subject to legal limits which we will explain in our response.

Shado hosts customer personal data with Amazon Web Services in Ireland, with a standby in Frankfurt, Germany. Support emails sent to support@shadosecurity.com are currently held by Hostinger, which hosts our email, on servers in Indonesia. The Site is hosted by Hostinger and will be served from an EU or UK data centre before it collects any personal information. Shado Pty Ltd is an Australian company, and its founder may access data from Australia or the UK; that is access by Shado itself.

Where personal data relating to EU or UK data subjects is processed by our infrastructure sub-processors, Shado relies on EU Standard Contractual Clauses (Module 2, Controller to Processor) and the UK Addendum to the EU Standard Contractual Clauses (issued by the UK Information Commissioner) as the applicable cross-border transfer mechanism.

Shado does not routinely transfer personal data to jurisdictions outside the EU, the UK and Australia other than as described above.

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy or as required by law.

Data type	Retention period
Account data (name, email, credentials)	7 years from account closure
Security and audit logs	24 months rolling
Vault Lookup logs that include an IP address	30 days, after which only a count of lookups per Shado ID is kept
Support correspondence	Duration of active relationship plus 24 months
Provenance and ownership records	Operational life of the authenticated piece (criteria-based retention, GDPR Art. 13(2)(a))

Personal identifiers are pseudonymised on account closure where technically feasible, so ongoing retention of provenance records does not mean ongoing retention of identifiable personal data. Aggregated or de-identified data may be retained without re-identification.

The Site is intended for individuals aged 16 and over. Shado accounts in the app are available from age 16, with the under-18 safeguards set out in the Terms and Conditions. If you use the Site on behalf of a business or organisation, you represent that you are authorised to do so. If you believe a child has provided personal information to us, please contact us to request deletion.

We use safeguards appropriate to the information we hold, designed to protect its confidentiality, integrity and availability, including encryption, access controls and incident response procedures. No online service can guarantee absolute security. We review our controls as our services and risks change.

• Data Controller: Shado Pty Ltd (ABN 17 688 231 781)
• Contact: support@shadosecurity.com
• EU Representative (GDPR Art. 27): To be appointed prior to EU market launch. Details will be published here before any EU consumer data is processed.

We may update this Privacy Policy periodically. The "Last Updated" date reflects the latest version. Your continued use of the Site after updates constitutes acceptance of the revised Policy.

The Site does not currently collect personal information through forms. Enquiries and Vault reports open your own email app, addressed to support@shadosecurity.com, and are held in Shado's support inbox, which is currently hosted by Hostinger in Indonesia (see section 8).

Australia (Privacy Act 1988 (Cth) and 2024 Amendments)

If you are located in Australia, the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs) apply to how we handle your personal information. You have the right to access and correct personal information we hold about you. You may also complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au if you believe we have breached the APPs. We will acknowledge privacy complaints within 5 business days and respond substantively within 30 days. Where a data breach is likely to result in serious harm, we will notify affected individuals and the OAIC as soon as practicable. Our automated decision-making systems support human review and do not independently produce decisions with significant legal or similar effects on individuals, consistent with our obligations under the 2024 Privacy Act amendments (effective December 2026).

European Union (EU GDPR)

If you are located in the European Economic Area, the EU General Data Protection Regulation (GDPR) applies. Our legal bases for processing are set out in the Annex above. You have the right to access, rectify, erase, restrict, object to, and port your personal data. You also have the right to lodge a complaint with your local EU supervisory authority. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and affected individuals without undue delay where the risk is high. We appoint an EU representative under GDPR Article 27 prior to processing EU consumer data at scale; details will be published here before that point. Cross-border transfers of EU personal data to Australia are protected by EU Standard Contractual Clauses (Module 2, Controller to Processor).

United Kingdom (UK GDPR and Data Protection Act 2018)

If you are located in the United Kingdom, the UK GDPR and Data Protection Act 2018 apply. Your rights mirror those under EU GDPR above. You may lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk. Cross-border transfers of UK personal data to Australia are protected by the UK Addendum to the EU Standard Contractual Clauses, issued by the UK Information Commissioner. The EU and UK have mutual adequacy decisions; data flows between them do not require additional safeguards at present. We monitor UK regulatory developments, including the Data (Use and Access) Act 2025, and will update this policy as requirements change.

• Entity: Shado Pty Ltd (ABN 17 688 231 781)
• Governing law: New South Wales, Australia
• Jurisdiction: Courts of New South Wales, Australia
• Effective date: 31 October 2025
• Last updated: 13 October 2026
• Contact: support@shadosecurity.com

Where you are accessing this Site from a jurisdiction with mandatory consumer protection laws that cannot be excluded by contract, those laws apply to the extent required regardless of this governing law clause.