Privacy Policy
How 10XR collects, holds, uses, discloses and protects personal information, for our own business and on behalf of our clients.
1. About This Policy
This Privacy Policy sets out how 10XR collects, holds, uses, discloses and protects personal information. 10XR is committed to complying with the Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles (APPs), and all applicable privacy legislation.
This Policy applies to:
(a) visitors to the 10XR website at www.10xr.com.au;
(b) clients and prospective clients of 10XR;
(c) individuals whose personal information is collected or processed by 10XR in the course of providing services to its clients; and
(d) users of the 10XR CRM Platform and associated software tools.
A copy of the Australian Privacy Principles may be obtained from the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
In this Policy, "we", "us" and "our" refer to 10XR.
2. What Personal Information We Collect
The types of personal information we may collect include:
2.1 Information You Provide Directly
(a) Name, email address, phone number, postal address and business name (when you contact us, submit a form, or enter into a service agreement);
(b) billing and payment information (bank account or credit card details) for the purpose of processing fees and direct debit payments;
(c) business information including ABN, company name and authorised contact details; and
(d) any other personal information you provide to us in the course of our engagement.
2.2 Information We Collect Through Our Services
When providing digital marketing, lead tracking, CRM and related services to our clients, we may collect personal information about the client's customers and leads, including:
(a) names, email addresses, phone numbers and enquiry details submitted through website forms;
(b) phone call recordings and call metadata (inbound calls made through tracked phone numbers);
(c) chat transcripts from website live chat tools;
(d) website browsing behaviour, IP addresses, device identifiers and cookie data;
(e) marketing attribution data including the source, medium, campaign, keyword and landing page associated with each lead or enquiry;
(f) AI-generated call transcriptions, commercial-intent scores and lead qualification data; and
(g) CRM records including contact details, interaction history, pipeline stages, deal values and communication logs.
2.3 Information Collected Automatically
When you visit the 10XR website, we may automatically collect:
(a) IP address, browser type, operating system and device information;
(b) pages visited, time on site, referral source and click behaviour; and
(c) cookies and similar tracking technologies (see Section 10 below).
3. How We Collect Personal Information
We collect personal information:
(a) directly from you, when you contact us, complete a form on our website, sign a service agreement, or communicate with us by phone, email or other means;
(b) from our clients, when they provide us with access to their customer databases, advertising accounts, CRM systems and website analytics for the purpose of delivering agreed services;
(c) from third-party platforms used in the delivery of our services, including Google Ads, Meta (Facebook/Instagram), LinkedIn, Microsoft/Bing, analytics platforms, call tracking systems and CRM platforms;
(d) through automated data collection technologies including cookies, web beacons, tracking pixels, call tracking software and marketing automation tools; and
(e) from publicly available sources such as company websites, business directories and social media profiles.
Where practicable, we collect personal information directly from the individual to whom it relates. Where we collect personal information from a third party or from our client's systems, we take reasonable steps to ensure that the individual has been informed of the collection, or that the collection is otherwise authorised.
4. Purposes for Which We Collect, Use and Disclose Personal Information
4.1 Our Own Business Purposes (10XR as Controller)
We collect, use and disclose personal information for the following purposes:
(a) to respond to enquiries and communicate with prospective and existing clients;
(b) to enter into, manage and perform our service agreements;
(c) to issue invoices, process payments and manage billing;
(d) to comply with our legal and regulatory obligations;
(e) to protect our rights and enforce our terms and conditions;
(f) to improve our website, services and business operations;
(g) to send you marketing communications about our services, where you have consented or where we are otherwise permitted by law (you may opt out at any time); and
(h) for any other purpose directly related to the above, or for which you have given your consent.
4.2 Services Provided on Behalf of Our Clients (10XR as Processor)
When we collect, store or process personal information on behalf of our clients in the course of providing digital marketing, lead tracking, CRM and related services, we do so as a data processor acting on the client's instructions. The client remains the data controller and is responsible for establishing the lawful basis for the collection and processing of that personal information.
In this capacity, we process personal information for the following purposes:
(a) managing and optimising paid advertising campaigns across Google, Meta, LinkedIn, Microsoft/Bing and other platforms;
(b) search engine optimisation (SEO) and AI/answer engine optimisation (AEO) services;
(c) lead tracking and marketing attribution, including tracking phone calls, form submissions, chat conversations and e-commerce conversions back to their marketing source;
(d) call recording, AI-powered call transcription and commercial-intent scoring for lead qualification and campaign performance analysis;
(e) CRM platform management, including contact records, pipeline tracking, marketing automation, email and SMS communications;
(f) campaign performance reporting, analytics and return-on-investment analysis; and
(g) any other services described in the agreed Scope of Work or Proposal.
We will only process personal information in accordance with our client's reasonable instructions and for the purposes of performing the agreed services, unless required to do otherwise by law.
This section aligns with clause 10.5 of the 10XR Terms and Conditions (2026).
5. Call Tracking and Recordings
As part of our lead tracking and marketing attribution services, we may implement call tracking software that records inbound calls made through tracked phone numbers assigned to our clients' marketing campaigns.
(a) Callers are notified with a voice prompt at the beginning of the call stating: "This call is being recorded for quality assurance."
(b) Call recordings are used for quality control, lead validation, training, conversion tracking and campaign optimisation.
(c) AI-powered transcription technology may be used to convert call recordings into searchable text. These transcriptions may be analysed to classify leads by purchase readiness, enquiry type, service interest and commercial intent.
(d) Call recordings and transcriptions are stored securely and access is restricted to authorised personnel.
(e) Call tracking data, including caller phone number, call duration, call outcome and marketing attribution data, is stored within the lead tracking platform and may be integrated with the client's CRM.
This section aligns with clause 10.2 of the 10XR Terms and Conditions (2026).
6. Disclosure of Personal Information
We may disclose personal information to:
(a) our clients, as part of lead tracking reports, campaign performance data, CRM records and other service deliverables;
(b) our subcontractors, specialist partners and White Label Service providers who assist in delivering the services, provided they are bound by equivalent confidentiality and privacy obligations;
(c) third-party platform providers used in the delivery of our services, including:
- Google (Google Ads, Google Analytics, Google Tag Manager)
- Meta (Facebook, Instagram)
- Microsoft/Bing
- Call tracking and lead attribution platforms
- CRM and marketing automation platforms
- Email and SMS service providers
- Website hosting and content delivery providers
(e) government authorities, regulators or law enforcement agencies, where required or authorised by law; and
(f) any other party with your consent.
We do not sell, rent or trade personal information to third parties for their own marketing purposes.
7. Cross-Border Disclosure of Personal Information
Some of the third-party platforms and service providers we use to deliver our services may store or process personal information on servers located outside of Australia, including in the United States, the European Union and other jurisdictions.
Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure that the recipient handles the information in accordance with the APPs, or that the disclosure is otherwise permitted under the Privacy Act (for example, where the recipient is subject to substantially similar privacy protections, or where the individual has consented to the disclosure).
8. Security of Personal Information
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. Our security measures include:
(a) access controls and authentication requirements for all systems and platforms;
(b) encryption of data in transit (TLS/SSL) and at rest where supported by the platform;
(c) regular review of access permissions and removal of access when no longer required;
(d) confidentiality obligations on all personnel, subcontractors and service providers;
(e) secure storage of billing and payment information through PCI-compliant payment processors; and
(f) incident response procedures for identifying, containing and reporting data breaches.
Where we no longer need personal information for the purposes for which it was collected, and we are not required by law to retain it, we will take reasonable steps to destroy or de-identify that information.
9. Automated Decision-Making
In the course of providing our services, we use software tools that incorporate automated processes, including:
(a) Lead scoring and qualification: Automated rules and AI-powered analysis are used to classify leads by commercial intent, enquiry type, service interest and estimated value. These scores inform campaign optimisation and reporting but do not, on their own, determine whether an individual receives a particular service or outcome.
(b) Call transcription and intent analysis: AI-powered speech-to-text technology automatically transcribes call recordings and analyses transcriptions to detect purchase readiness and lead quality signals.
(c) Marketing automation: Automated workflows within our CRM platform may trigger email sequences, SMS messages, task assignments and pipeline stage changes based on predefined rules and lead behaviour.
(d) Ad platform optimisation: Advertising platforms (Google Ads, Meta Ads, LinkedIn Ads) use automated bidding strategies and audience targeting algorithms that process personal information (such as website behaviour and conversion data) to optimise campaign delivery.
These automated processes assist in the delivery and optimisation of our services. Where automated decision-making has a significant effect on an individual, our clients (as the data controller) are responsible for ensuring that appropriate safeguards are in place, including the ability for individuals to request human review.
This section is provided in compliance with Australian Privacy Principle 1.7–1.9 as introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth).
10. Cookies and Tracking Technologies
Our website and the services we deliver on behalf of our clients may use cookies and similar tracking technologies, including:
(a) Essential cookies: Required for the operation of the website, including session management and security.
(b) Analytics cookies: Used to understand how visitors interact with the website, including pages visited, time on site and referral source (e.g. Google Analytics).
(c) Advertising and remarketing cookies: Used by advertising platforms (Google Ads, Meta, LinkedIn) to deliver targeted advertisements, measure ad performance and build remarketing audiences.
(d) Tracking pixels and conversion tags: Small code snippets placed on client websites to track form submissions, phone calls, purchases and other conversion events for campaign attribution.
(e) Call tracking scripts: Used to dynamically swap phone numbers on client websites to attribute inbound calls to their marketing source.
You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the website or the accuracy of marketing attribution reporting.
11. Access to and Correction of Personal Information
You have the right to request access to personal information we hold about you, and to request that we correct any information that is inaccurate, incomplete, out of date or misleading.
To make an access or correction request, please contact us using the details in Section 14 below.
We will respond to your request within a reasonable period (and in any case within 30 days). We may need to verify your identity before processing your request.
In some circumstances, we may refuse access or correction where permitted by the Privacy Act (for example, where providing access would unreasonably impact the privacy of another individual, or where the information relates to legal proceedings). If we refuse a request, we will provide written reasons for the refusal.
Where we process personal information on behalf of one of our clients (as data processor), we will refer your request to the relevant client, who is responsible for responding as the data controller.
12. Complaints
If you believe we have breached the APPs or handled your personal information in a manner that does not comply with this Policy, you may lodge a complaint with us by contacting:
Privacy Officer 10XR
191 St Georges Tce, Perth WA 6000
Email: info@10xr.com.au
We will acknowledge your complaint within 5 business days and investigate and respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
Office of the Australian Information Commissioner
Website: www.oaic.gov.au
Phone: 1300 363 992
Email: enquiries@oaic.gov.au Post: GPO Box 5218, Sydney NSW 2001
13. Data Breach Notification
In the event of an eligible data breach (as defined under Part IIIC of the Privacy Act), we will comply with the Notifiable Data Breaches (NDB) scheme by:
(a) taking reasonable steps to contain the breach and minimise any resulting harm;
(b) assessing whether the breach is likely to result in serious harm to any individual;
(c) where the breach is likely to result in serious harm, notifying affected individuals and the OAIC as soon as practicable; and
(d) maintaining records of all data breaches, including breaches that are assessed as not likely to result in serious harm.
Where a data breach occurs in relation to personal information we process on behalf of a client (as data processor), we will notify the client promptly so that they can assess and fulfil their own notification obligations as data controller.
14. Contact Us
If you have any questions about this Privacy Policy, wish to make an access or correction request, or have a privacy complaint, please contact us:
10XR
191 St Georges Tce, Perth WA 6000
Email: info@10xr.com.au
Phone: 08 6727 9005
Website: www.10xr.com.au
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices, services or legal obligations. The updated policy will be published on our website at 10xr.com.au/privacy. We encourage you to review this page periodically.
The "Last Updated" date at the top of this Policy indicates when it was most recently revised.
10XR | Gerry Wagner Pty Ltd ATF Gerry Wagner Trust | ABN: 20 631 508 185 | www.10xr.com.au