Privacy Policy

1.1Lyra is committed to protecting your privacy.

1.2This Privacy Policy (the Policy, as at 8 October 2026, Version 2) explains how Atlas Intelligence Pty Ltd ACN 696 535 529 (trading as Lyra) (“Lyra”, “we”, “us”, or “our”) may process, use, retain and disclose any and all personal information we collect from you, and the rights you have in relation to the personal information related to you in our possession.

1.3All capitalised terms not defined in this Policy are set out in the Terms and Conditions on our Website.

1.4We are committed to safeguarding your personal information. This Policy is governed by the laws of New South Wales, Australia, and the parties submit to the non-exclusive jurisdiction of the courts of New South Wales.

2.1By either:

1. (1)using the Lyra website at lyracybr.com (Website);
2. (2)using, accessing or browsing the cyber and technology risk advisory web application ‘Lyra’ (Platform);
3. (3)signing up for a user account on the Platform (Account);
4. (4)entering into a contract, agreement or understanding with us; or
5. (5)otherwise supplying us with your personal information,

you confirm that you have read and accepted the terms of this Policy, and expressly consent to Lyra’s processing, use, retention and disclosure of your personal information collected in accordance with this Policy.

3.1Lyra reserves all rights to make changes to this Privacy Policy in our sole discretion. Where we make material changes to this Policy, we will notify Account holders by email at least 10 Business Days prior to the changes taking effect and will post an updated version on the Website. Non-material updates may be made without prior notification to the reader.

3.2We encourage you to review and monitor our Privacy Policy from time to time. You can ensure you are reading the most recent version of the Policy by accessing the Policy from the Website.

4.1What type of information does Lyra collect?

Lyra endeavours to only collect the minimum level of personal information necessary to facilitate, support and ensure a pleasant user experience of the Platform and any third party integrations. Lyra may collect the following types of personal information from you:

1. (1)your name;
2. (2)your email address;
3. (3)your device ID, device type, website browser and device operating system details, geo-location information (including country and suburb name), computer and connection information, statistics on page views, traffic to and from the Website and Platform, ad data, IP address and standard web log information;
4. (4)your marketing and communications preferences, as well as any preferences you have specified in relation to the Platform;
5. (5)feedback, ratings, comments and other information you submit through the Platform, including your views about insurers, their products and performance and market conditions, and any information about other individuals (such as insurer staff) that you include in it;
6. (6)Any information you provide us by applying for a position at Lyra, including your education, employment background, references and other related applicant information;
7. (7)Any information you voluntarily provide us that is separate to the information you are required to provide for an Account, including any pseudonyms you may use;
8. (8)Any information related to your visit to our office or to events we are exhibiting at; or
9. (9)Any other personal information that you provide to us directly or indirectly, either through third parties or other means.

We do not ask for client or placement data and our Terms and Conditions prohibit you from submitting it.

It may not be reasonable for Lyra to notify you, or to ensure you are made aware where we have received your information from third parties (e.g. our clients). However, Lyra will process, use, retain and disclose your information in a manner that is consistent with this Privacy Policy and any obligations binding upon us under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APP).

4.2What about unsolicited personal information?

In the event that Lyra receives personal information about you that we did not solicit, or expressly request from you, we will determine as soon as reasonably practicable whether we would have otherwise collected that information under APP 3 if we had actively sought to obtain that information.

Where we determine that we could not have collected the information, we will take all reasonable steps to destroy or permanently de-identify it as soon as practicable, provided it is lawful and reasonable to do so. Alternatively, we will handle the information in accordance with this Policy if we determine that we could have collected the information.

4.3How does Lyra collect information?

Where practicably possible, Lyra aims to collect information directly from you. Circumstances under which your information may be indirectly collected include:

1. (1)when the organisation you work for signs you up for an Account;
2. (2)when the organisation you work for provides services to us, or we provide services to them;
3. (3)when another user of the Platform submits feedback that refers to you (for example, if you work for an insurer);
4. (4)when you attend events we are exhibiting at;
5. (5)when you engage with Lyra on our social media accounts; and
6. (6)when you interact with Lyra’s online advertising or marketing on other third party websites.

The above list is not exhaustive, and Lyra may collect personal information specified in this Policy through other indirect means. If you would like to check whether we have personal information pertaining to you, please contact our Privacy Officer using the details in section 11.3.

4.4Why does Lyra collect information?

Lyra collects, holds, uses and discloses personal information for the following purposes:

1. (1)to provide you and our existing Account user base with access to the Platform;
2. (2)to help us enhance and improve our Platform to existing and future Account holders;
3. (3)to verify, correct and improve the accuracy of the information on the Platform;
4. (4)to create de-identified and aggregated insights about the insurance market, which we may share with or sell to insurers, brokers and other third parties;
5. (5)to promote and market the Platform to you;
6. (6)to maintain and develop our commercial relationship with you;
7. (7)to communicate with you, including about the Platform, your Account, or our other products and services;
8. (8)to facilitate payments for using the Platform;
9. (9)to comply with our legal, regulatory or professional obligations;
10. (10)to enforce, defend and protect the property and rights of Lyra; or
11. (11)to facilitate the sale or potential sale of Lyra.

Lyra will never rent, sell or make publicly available your personal information without your consent. Any personal information we collect and use for the primary purposes of analytics and performance reporting we will ensure to aggregate, anonymise and de-identify where reasonably practicable.

4.5Does Lyra collect information from children?

Lyra understands the importance of protecting children’s safety on the internet. We do not knowingly collect personal information from children under the age of 16 without parental notice or consent. If you are under the age of 16, please refrain from engaging or interacting with the Platform to prevent the collection of your personal information.

5.1Lyra ensures that any information collected in accordance with this Policy is stored following our strict physical and technological security processes and procedures. This also includes information we receive when you access, use or navigate the Platform (e.g., IP addresses, HTTP request headers, browser metadata, et cetera) that we may never use.

5.2We will take all reasonable measures to safeguard the information from misuse, interference and loss. Any hard copies of personal information are stored in a secure, locked storage space only authorised personnel would have access credentials for. Similarly, stored electronic data are anonymised where practicably possible, encrypted, and only accessed on an as-needed basis by approved personnel with a legitimate business need. All personnel with access to information collected under this Policy are subject to confidentiality obligations.

5.3All personal information is retained according to legal, statutory and contractual obligations. Lyra will take reasonable steps to destroy entirely, or permanently de-identify the information where it is no longer required for the purposes in section 4.4.

6.1Who does Lyra disclose my personal information to?

Lyra only discloses information where reasonably and practicably necessary, for the purposes outlined in section 4.4. We may share your information with:

1. (1)our personnel, including officers, employees, independent contractors and agents of Lyra;
2. (2)financial institutions for payment processing;
3. (3)insurers, brokers and other third parties who receive de-identified and aggregated insights from us, which do not identify you;
4. (4)Australian courts, tribunals or other law enforcement agencies or regulatory bodies; and
5. (5)other third parties as reasonably and practicably required.

When sharing your personal information with a third party, we will endeavour to ensure that the information is secure and encrypted during transit, and that the recipient is committed to maintaining the confidentiality of the information given to them.

6.2Does Lyra disclose my personal information to overseas entities?

1. (1)We may disclose personal information outside of Australia to cloud providers and software providers located outside of Australia.
2. (2)When you provide your personal information to us, you consent to the disclosure of your information outside of Australia and acknowledge that we are not required to ensure that overseas recipients handle that personal information in compliance with the Privacy Act 1988 (Cth). We will, however, take reasonable steps to ensure that any overseas recipient will deal with such personal information in a way that is consistent with the Australian Privacy Principles.

7.1From time to time, Lyra may promote or market the Platform by email, post or phone, subject to compliance with the Spam Act 2003 (Cth) and the Privacy Act 1988 (Cth).

7.2Where we have collected your personal information directly from you, we will only use it for direct marketing purposes if you have consented to receiving marketing communications.

7.3Where we collected your personal information from a third party, we will not use it for direct marketing purposes unless you have consented to receive such communications, or it is impracticable to obtain your consent.

7.4If you would like to withdraw your consent to receiving marketing materials, please utilise the opt-out mechanisms provided in each of these communications. Alternatively, you can inform us of your preferences by notifying our Privacy Officer using the details in section 11.3. We will fulfill to your opt-out request within a reasonable period, and at no cost to you.

8.1Cookies are small files sent from websites you visit to the device you are accessing the websites on. These small files track your browsing activity and store your setting choices and content preferences to facilitate a tailored and seamless web experience as they ensure you are served information that is personalised and relevant to you.

8.2Lyra may use cookies or similar tracking technologies on the Platform to improve your browsing experience. Some of these cookies are necessary to ensure the functionality of the Platform, and some are used to capture your interactions with the Platform and recall your choices and preferences for your next session.

8.3You can disable cookies through your internet browser, but the Platform may not work as intended for you if you do so.

8.4Lyra may also use cookies to collect data that may include personal information. We will handle any personal information collected by cookies in the same way that we handle all other personal information as described in this Policy.

9.1The Platform or the Website may link to third party websites. Please note that any personal information collected, processed, used, retained or disclosed by these third parties may not be in accordance with our Policy. We do not accept responsibility for the privacy practices of any of the third party websites, and recommend you to read and review the privacy policies of these websites during your visit.

10.1Lyra will take reasonable steps to ensure that the personal information we have collected is accurate, up to date and complete.

10.2You may request that we correct personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant or misleading. To make a correction request, please notify our Privacy Officer using the details in section 11.3.

10.3We will respond to your request within a reasonable period. If we correct information that we have previously disclosed to a third party, we will take reasonable steps to notify that third party of the correction.

10.4If we decline to correct your personal information, we will notify you in writing of our reasons for refusing and the mechanisms available to you to complain about the refusal. You may request that we attach a statement to the relevant information noting that you believe it to be inaccurate, out of date, incomplete, irrelevant or misleading - we will take reasonable steps to comply with such a request.

10.5We are not responsible for any losses or damages that may arise as a result of incorrect, outdated or incomplete information.

11.1You have the right to:

1. (1)request a copy of the personal data we hold about you;
2. (2)request a removal of the personal data we hold about you;
3. (3)request a correction to any inaccurate personal data corrected; and
4. (4)object to or restrict our using your personal data.

11.2You may also make a complaint if you have a concern about our handling of your personal data or a potential breach of the Privacy Act or the APPs.

11.3If you wish to exercise your rights under section 11.1 or 11.2, please contact our Privacy Officer via:

1. (1)Name: Jennie Reed
2. (2)Email: jennie@lyracybr.com

11.4We may request that you prove your identity by providing us with a copy of a valid form of identification in order for us to comply with our security obligations and to prevent unauthorised disclosure of data. We may also be unable to provide you with access to all the information we hold of you, and will provide you with a reason where full access may not be possible due to legal, regulatory, professional or other obligations.

11.5In the event that we refuse your request for access to your personal information, we will consider whether we can provide access indirectly through a mutually agreed intermediary.

11.6Lyra will consider any requests or complaints we may receive, and endeavour to provide you a timely response in writing - either within the time frame required by law (where applicable) or otherwise within a reasonable period, typically within 15 Business Days.

11.7If you find our response to be unsatisfactory, we will provide you with information about the further steps you can take.

11.8Lyra is committed to complying with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). In the event of an eligible data breach that is likely to result in serious harm to affected individuals, Lyra will:

1. (1)notify the Office of the Australian Information Commissioner as soon as practicable, and in any event within 20 Business Days of becoming aware of the breach; and
2. (2)notify affected individuals of the breach, the nature of the information involved, and the recommended steps they should take to protect themselves.

11.9We will maintain an internal data breach response plan and review it periodically to ensure it remains effective.