Data Breach Response | Faunify Business

Data Breach Response Process

Effective date: 21 October 2026 · Last updated: 21 October 2026

This process explains how Faunify detects, contains, assesses, notifies and learns from a data breach, in line with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) and Australian Privacy Principle 11.

1. Scope

This process covers any suspected or actual loss of, unauthorised access to, unauthorised disclosure of, or interference with personal information that Faunify holds or handles, including information inside a business workspace and information held by our service providers.

2. Roles

Privacy contact (breach lead) — receives every report, runs the assessment, decides on notification and keeps the register. Reachable at admin@faunify.co.
Technical lead — contains the incident, preserves logs and applies the fix.
Workspace administrator — the contact for a business whose data is affected; reports incidents to us and notifies its own customers or staff.
Service providers — Base44 (platform, database and authentication), Stripe (payments) and Resend (email) notify us of incidents in their systems that affect our data.

3. What Counts as a Breach

A staff account or administrator login is compromised, or credentials are shared.
Records from one store become visible to staff or administrators of another business.
A store or department assignment error exposes data to the wrong team.
A file, export, care sheet or incident report is sent to the wrong person.
A database, backup or device holding personal information is lost or accessed without permission.
A service provider reports unauthorised access to data we store with them.
Ransomware, malicious code, or an insider accessing records they have no reason to see.

4. Response Steps

Step 1 · Report and log

Anyone who suspects a breach tells the Faunify privacy contact straight away, and a workspace tells us within 24 hours of becoming aware. The report records what happened, when it was discovered, who found it and what information is involved. A breach register entry is opened immediately, even if the report later turns out to be a false alarm.

Step 2 · Contain

Within the first 24 hours we act to stop the loss: revoke sessions and rotate credentials, disable a compromised account, correct a sharing or store assignment error, take an exposed file or endpoint offline, restore from backup, and preserve evidence such as logs before anything is cleaned up.

Step 3 · Assess

We establish which records were involved, whose information it was, whether the information was encrypted or otherwise protected, who could have obtained it, and whether there is a real risk of serious harm. Harm includes physical, psychological, emotional, financial, reputational or other significant harm.

Step 4 · Decide

If there are reasonable grounds to believe an eligible data breach has occurred, it is treated as one. If we are not yet sure, we complete the assessment within 30 days of becoming aware. The decision, the reasoning and the date are recorded in the breach register.

Step 5 · Notify

Affected individuals and the Office of the Australian Information Commissioner (OAIC) are notified as soon as practicable, using the OAIC’s online notification form. Where a workspace holds the affected records, we tell its administrator what happened and what to send to its own customers or staff, and we support them in doing so.

Step 6 · Remediate and review

Within 30 days of closing the incident we review the cause, fix it, and record what changed: permissions, store assignments, session handling, monitoring or staff guidance. Lessons are applied across every workspace, not only the one affected.

5. When an Assessment Is Not Required

If we reasonably conclude there is no real risk of serious harm, no notification is made. The reasoning is still recorded in the register, so the decision can be reviewed later. We reassess if new information changes the picture, for example if stolen data appears online.

6. What a Notification Says

Our identity and contact details, and the date of the breach.
A description of what happened and the kind of information involved.
What we have done to contain the breach and to reduce the harm.
What the person should do, for example change a password or watch for unexpected contact.
Where relevant, that the matter has been reported to the OAIC.

7. Record Keeping

Every report is entered in a breach register that records the date discovered, the information involved, the assessment and its outcome, who was notified and when, and the actions taken. The register is reviewed annually with this process.

8. Preventing a Repeat

Controls that reduce the chance of a breach include store-scoped access enforced in the database, administrator-only assignment of stores and staff, single active sessions, encrypted connections, hashed passwords, restricted administrative access and regular review of who holds access.

9. Reporting a Suspected Breach

Contact admin@faunify.co immediately, with what you observed and when. Do not delete records, emails or logs that may help the investigation, and do not attempt to contact anyone who may be responsible.

Read this together with our Privacy Policy and Data Retention Policy.

Faunify · Email: admin@faunify.co · Website: https://faunify.co