Privacy Policy
Last updated 18 October 2026This Privacy Policy explains how JCR IT Services Pty Ltd t/a JCR Computers (JCR, we, us) collects, uses, stores, and discloses personal information through the RestorePath website at restorepath.io, and how we handle personal information in customer backup data. JCR IT Services Pty Ltd (ABN 95 163 939 839) is a small business under the Privacy Act 1988 (Cth) and is not currently required to comply with it. We have chosen to handle personal information in accordance with the Australian Privacy Principles anyway, and this policy describes how.
RestorePath is a Microsoft 365 backup platform. Most of this policy covers the marketing website and enquiries. The section "Customer backup data" explains how we handle data inside the RestorePath product. Use of the RestorePath product is governed by written terms we agree with you before you onboard.
What we collect
From the website and our enquiry channels we only collect what you give us, plus the request information needed to serve the site:
- What you enter in the contact form: your name, work email, company, the number of tenants you manage, the type of enquiry, and your message.
- Contact details and anything else you tell us when you email [email protected] or [email protected], or phone us on 1300 525 516 (typically your name, contact details, company, and the reason for your enquiry).
- Request information (IP address, user agent, referring URL, request path, timestamp) that Cloudflare processes when your browser loads a page. See "Logs" below.
We do not run analytics, advertising trackers, session replay tools, or behavioural analytics on this site. We do not buy, sell, or rent personal information.
How we use it
- To respond to your demo request, sales enquiry, or support question.
- To send you a follow-up email about RestorePath if you asked us to.
- To keep the website online, fast, and protected from abuse.
- To comply with our legal obligations, including Australian tax and corporate record-keeping requirements.
We do not use computer programs to make decisions about you that could significantly affect your rights or interests, and we do not profile you.
Cookies
This website does not set any cookies, and it does not use analytics or browser local storage. Cloudflare, which hosts the site, may set a short-lived security cookie, but only if it detects abusive traffic or shows you a challenge (for example, a check that you are not an automated bot). We do not set advertising or cross-site tracking cookies. If we add analytics in future we will update this policy first.
Logs
Cloudflare keeps request logs for its own security and operations, as described in its privacy policy. We do not keep separate copies of those logs, except where we need them to investigate a security incident.
To limit repeat submissions, the contact form counts submissions per IP address in memory for up to one hour. That count is not stored.
Where data lives
The marketing website is hosted on Cloudflare Pages. Cloudflare serves the site from its global network, which means a request from Australia is normally served from an Australian location. Cloudflare may process log data in the United States and other countries for operational and security reasons (for example, denial-of-service protection and abuse detection). Cloudflare is bound by its data processing terms, but it is not bound by the Australian Privacy Act.
Enquiries submitted through the form on this website are relayed to us by SMTP2GO, a transactional email provider headquartered in New Zealand. Our SMTP2GO account is hosted in its Australian region. The relay sees everything you enter in the form: your name, work email, company, the number of tenants you manage, the type of enquiry, and your message. We do not use it to send marketing.
Email correspondence is handled in Microsoft 365. Support and customer records are held on systems operated by or for JCR.
The fonts, styles, scripts, and images used by this site are served from our own domain. The site makes no requests to third-party font, analytics, or advertising networks, so no party other than Cloudflare, our host, sees your IP address when you load a page.
Who we share with
We share personal information only with the people and services we need to in order to run the business:
- Our hosting and infrastructure providers (Cloudflare for website hosting and protection, Microsoft for our email).
- SMTP2GO, which relays enquiries submitted through the contact form on this site.
- Our accountant, lawyer, or auditor, when they need access to do their job and are bound by their own confidentiality obligations.
- Australian regulators, courts, or law enforcement when we are legally required to do so.
We do not sell your information.
Customer backup data
When an organisation uses RestorePath, the Microsoft 365 or Google Workspace data we back up for it (mail, files, calendars, contacts, and similar) can contain personal information. That data belongs to our customer and the organisations they manage. JCR holds it as a service provider, on their instructions.
- We do not use customer backup data for our own purposes.
- We access it only to provide the service, to support a restore the customer has asked for, or to meet a legal obligation.
- On the managed service, backup data is stored on JCR's Sydney Hosting Cluster, encrypted with a separate key for each tenant.
- On a self-hosted deployment, backup data is stored on infrastructure the customer controls. Where JCR manages that RestorePath VM, we access it only to operate and support it.
If you are an individual whose information may be in a customer's backups, please contact that organisation first, because it decides how its data is used. We will help our customers respond to your request. We handle customer backup data in line with the Australian Privacy Principles, including the security and data breach commitments described below.
How we keep it safe
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change, or disclosure. These include:
- Access controls, so staff can reach only the systems and data they need for their role.
- Encryption in transit: this website is served only over HTTPS, and RestorePath connects to Microsoft 365 and Google Workspace only over encrypted connections.
- Encryption at rest for customer backup data: each tenant's backups are encrypted with AES-256-GCM using a key unique to that tenant. On the managed service JCR holds the master key that protects those tenant keys; on a self-hosted deployment, the customer holds it.
- Multi-factor authentication for every change made in the RestorePath console, and an audit log of those actions.
As a small business, JCR is not currently required by law to follow the Notifiable Data Breaches scheme, but we follow it voluntarily. If we have a data breach that is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC). If a breach affects customer backup data, we will also notify the customer promptly so they can meet their own obligations.
How long we keep it
We keep contact information for as long as you remain a prospect or customer, and for up to seven years after our last interaction so we can meet Australian record-keeping obligations.
Your rights
You can ask us to:
- Tell you what personal information we hold about you.
- Correct anything that is wrong or out of date.
- Delete your information. We will do so unless we need to keep it to meet a legal obligation or deal with a dispute.
- Stop emailing you (we will always honour an unsubscribe).
Email [email protected] with any of these requests. We will respond within a reasonable period, and in most cases within 30 days.
Marketing email
We send marketing email only if you ask for it. Every marketing email identifies us and includes a way to unsubscribe, and we action unsubscribe requests within five business days.
How to complain
If you think we have mishandled your personal information, email [email protected] with the details. We will acknowledge your complaint within 7 days and give you a written response within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au/privacy/privacy-complaints or on 1300 363 992. The OAIC generally expects you to raise your complaint with us first. Because JCR is a small business that follows the Australian Privacy Principles voluntarily, the OAIC may not be able to investigate a complaint about us. We will still deal with every complaint as described above.
Contact
JCR IT Services Pty Ltd t/a JCR Computers
ABN 95 163 939 839
Rouse Hill, New South Wales, Australia
[email protected]
1300 525 516
Changes
We will update this policy from time to time. The date at the top of the page reflects the last change. Material changes will be flagged on the website before they take effect.