Privacy policy

Last updated: 25 September 2026

Who we are and how to contact us

CSA Consulting is an Australian leadership and organisational psychology consultancy based in Brisbane. This policy explains personal information handled through our website, enquiries, research-library accounts, newsletter and shop. Client assessments and consulting engagements may require a separate privacy notice or agreement.

For privacy questions, access or correction requests, deletion requests or complaints, email info@csaconsulting.biz, call +61 7 3010 9735, or write to CSA Consulting, Level 7, 320 Adelaide Street, Brisbane QLD 4000, Australia.

What we collect and why

• Enquiries: your name, contact details, message and any information you choose to provide, so we can respond and discuss our services.
• Research accounts: your username, name, email address, password in a protected form, account activity and newsletter preference, so we can manage access to the research library.
• Purchases: billing and delivery details, items ordered, payment status and correspondence, so we can process orders, arrange delivery and respond to purchase enquiries. Payment providers handle the payment details requested by their service.
• Newsletters: your name, email address, subscription preference and records of that choice, so we can send updates you request and manage unsubscribing.
• Website operation: technical information such as IP address, browser and device details, pages requested, cookies and security logs, to operate the website, maintain sessions, prevent abuse and understand website use where permitted.

We usually collect information directly from you or your browser. Service providers may also supply order, delivery, subscription or security information. Required form fields identify information needed to provide the requested service. Without it, we may be unable to create an account, respond or fulfil an order. You can browse public pages without creating an account and ask a general question without giving your full name where practical.

Please do not send health information, assessment results or other sensitive information through the general enquiry form. Contact us first to arrange an appropriate way to share information needed for a consulting engagement.

Service providers and overseas processing

Information may be handled by providers of website hosting, email, website maintenance, security, payment processing, delivery and newsletter services as needed for those functions. Mailchimp is used for newsletters. Google services used on the website include fonts, maps and reCAPTCHA, which may receive technical information when loaded. Their own privacy information also applies to their services.

Providers may process information outside Australia, including in the United States. Locations depend on the provider and service. Contact us for information about the providers and overseas processing relevant to your enquiry or purchase. We must take the steps required by applicable privacy law when disclosing information overseas. Using this website does not waive those obligations or constitute blanket consent to an overseas disclosure.

We may also disclose information where required by law or where otherwise permitted by applicable privacy law, including to respond to a lawful request or protect against fraud.

Cookies, embedded services and newsletters

Cookies and similar technologies can support login, cart and checkout functions, security, analytics and embedded content. Some third-party services receive your IP address and browser details even without setting a cookie. Your browser can restrict cookies, although account and shopping functions may then stop working. Where optional storage or tracking requires consent, it must wait for that consent and allow you to withdraw it. Browser settings alone are not a substitute for that requirement.

Newsletter signup is separate from creating an account or making an enquiry. You can unsubscribe using the link in a newsletter or by contacting us. We will action a marketing unsubscribe request within five working days. Account, order or enquiry messages that are needed to provide a requested service may still be sent.

Storage, security and retention

Website records are held in the website database, operational systems and backups used to provide these services. Access should be limited to people and providers who need it for their work. No website or transmission can be guaranteed completely secure.

Information is retained while needed for the purpose for which it was collected, to resolve a dispute or meet a legal obligation. When it is no longer needed and the law does not require retention, it must be deleted or de-identified. A deletion request may need to account for tax records, transaction records, marketing suppression records and backup recovery cycles. We will explain any applicable retention reason when responding to your request.

Your requests and complaints

Contact us using the details above to request access, correction or deletion, or raise a privacy complaint. We may need proportionate information to verify your identity. We will consider your request under the law that applies, explain any refusal and respond within the applicable legal timeframe. If a complaint is not resolved, you can contact the Office of the Australian Information Commissioner or another privacy regulator with jurisdiction.

Where European or UK data protection law applies to our handling of your information, relevant grounds may include responding to a request or performing a contract, complying with legal obligations, legitimate interests in operating and protecting the service, and consent where required. Depending on the circumstances, you may also have rights to object, restrict processing, obtain portable data and withdraw consent without affecting earlier lawful processing. You may complain to your local supervisory authority. These rights and any international-transfer requirements depend on the law and processing involved.

Changes

We will update this page when our website practices or legal requirements change. The date above identifies this version. A policy update does not create consent for a new use of your information.