Privacy Policy
Last updated: 20 July 2026. This policy explains how The Critical Path handles personal information. It is a staging draft and requires confirmation of the legal operator, business address, service-provider locations and public privacy contact before production launch.
1. Who operates this service
The Critical Path is the website and publication brand. Operator legal name and business address: to be confirmed before launch. Privacy, access, correction, copyright and complaint enquiries can be submitted privately through our contact form, which routes to the website administrator.
2. Information we collect
Depending on how you use the service, we may collect your account username, email address, password hash and account settings; contributor profile information; stories, comments, images, credits, approvals and disclosures you submit; correspondence and complaint information; transaction and delivery information if you buy products; and technical information such as IP address, device/browser data, timestamps, security logs, cookies and site-usage events.
3. Why we collect and use it
We use information to create and secure accounts; authenticate users; receive, review, edit and publish Contributions; privately contact contributors; operate comments and moderation; attribute published work by username; investigate rights, safety and privacy concerns; process shop transactions; prevent fraud, spam and abuse; maintain backups and site performance; measure readership and advertising; comply with law; and establish, exercise or defend legal claims.
4. What becomes public
Account email addresses and administrative account details are not intended to be public. If we publish a Contribution, the public byline uses the account username. The submitted story, selected images, creator credits, disclosed region and information approved for publication may become public worldwide and may appear in RSS feeds, search results, archives and third-party sharing. Comments are public after moderation. Do not submit personal information you do not want considered for publication.
5. Collection notice and choices
Required account and form fields are needed to authenticate you, assess the submission, contact you, moderate content or provide the requested service. If you do not provide them, we may be unable to create an account, consider a story, publish a comment, fulfil an order or respond. Optional profile and location fields may be left blank. Avoid sensitive personal information unless it is necessary and you have been asked to provide it securely.
6. Who receives information
Information may be handled by authorised editors and administrators and by providers supporting hosting, WordPress functionality, email delivery, security, backups, analytics, forms, ecommerce and payments. Payment providers process payment details under their own policies; the site should not store full card numbers. We may disclose information where required by law, to investigate suspected wrongdoing or rights complaints, in a business transfer, or with your direction or consent.
7. Overseas processing
Website, email, analytics, security and ecommerce providers may process or back up information outside Australia. The countries depend on the final SiteGround data centre and enabled service configurations. These locations must be audited and listed where practicable before production launch.
8. Cookies and analytics
Essential cookies support login, security, comments, preferences and shopping functions. Analytics and advertising technologies may record page views, referrals, interactions, approximate location and campaign events. Non-essential analytics and advertising should be activated only with the appropriate consent controls for the visitor’s location. Browser controls can restrict cookies, although parts of the site may stop working.
9. Retention
We retain account records while accounts are active and for a reasonable period afterward; submissions, permissions, moderation and publication records for editorial history and rights management; transaction records for tax and accounting obligations; enquiries for investigation and follow-up; and security logs and backups for limited operational periods. Exact retention periods must be documented before launch. We delete or de-identify information when it is no longer reasonably required, subject to legal, fraud-prevention, backup and dispute needs.
10. Security
We use access controls, restricted administrative roles, HTTPS, software maintenance, backups and moderation procedures intended to protect information. No internet service is completely secure. Contributors must protect their passwords and notify us promptly of suspected account misuse.
11. Access, correction and deletion requests
You may request access to or correction of personal information we hold and may request account closure or deletion where applicable. Use the private contact form, select “Privacy request or complaint”, identify your account and describe the request. We may verify identity and may retain information where legally permitted or required.
12. Complaints and rights concerns
Submit a privacy complaint or urgent identification, copyright or safety concern through the contact form. We will record, assess and respond within a reasonable period. The final policy must name the responsible legal entity and external complaint avenues applicable to that entity before launch.
13. Children
Contributor accounts and submissions are intended for people aged 18 or over. Do not submit personal information about a child unless publication has been specifically approved and all necessary parent, guardian and organisational permissions have been obtained.
14. Policy changes
We may update this policy when practices, providers or legal requirements change. The latest version and effective date will remain available on this page.