---
title: "Privacy Policy | Project2100"
description: "How Project2100 Pty Ltd collects, uses, stores and discloses personal information under the Privacy Act 1988 and the Australian Privacy Principles."
url: https://www.project2100.com/privacy
updated: 2026-09-07
generated: true
---

> The machine-readable version of https://www.project2100.com/privacy
>
> The body below is this page's own content, generated from the page at build time: the same words, in the same order, with nothing summarised or reworded. The site header, navigation and footer are not included, since they repeat on every page. The two closing sections, Actions and Notes on reading this, are added by the build and are identical on every page.

Legal

# Privacy Policy

Last updated 7 September 2026

In force

This version takes effect on 7 September 2026 and replaces every earlier version. It applies to www.project2100.com and to any personal information you give us through it. If you want a copy of the version that applied on an earlier date, ask us and we will send it.

## 1. Who we are

This site is operated by Project2100 Pty Ltd (ABN 44 676 038 583), an Australian company with its principal office at Level 3, 14 Martin Place, Sydney NSW 2000, Australia. In this policy, "we", "us" and "our" mean Project2100 Pty Ltd, and "the site" means www.project2100.com.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We apply the Australian Privacy Principles to our handling of personal information regardless of whether the small business exemption in the Act happens to apply to us at a given time.

## 2. What we collect

The main form on this site is the demo and contact form you reach from the "Book a Demo" and "Get in touch" buttons. Through that form we collect:

- Your name. Required. We split it into a first name and a last name so we can address you properly.
- Your email address. Required. This is how we reply.
- Your company. Optional.
- Your industry. Optional. A single choice from hospitality, finance, compliance or other.
- Your message. Optional free text. Whatever you type here is collected exactly as written.

Separately, and as with any website, our hosting provider records the technical details of each request: the IP address the request came from, the browser and device type reported by your browser, the page requested, the referring page and the time. We do not use those records to build a profile of you.

We do not collect payment details, government identifiers, dates of birth, or any of the sensitive information categories defined in section 6 of the Privacy Act, such as health, racial or ethnic origin, political or religious views, or membership of a trade union. Please do not include information of that kind in the message field. If you send it to us anyway, we will delete it.

The site also carries a short subscribe form, for people who want to hear from us without booking anything. It collects the details you enter into it and nothing else, and your email address is the part we actually need. We use it to send you the updates you asked for. Ask us to take you off the list and we will, without asking why.

There is no account registration on this site, no login, and nothing to pay for here, so we do not create a profile for you and we never see a card number.

## 3. Why we collect it, and your consent

We collect this information because it is reasonably necessary for what we do: responding to a business enquiry, arranging and preparing for a demonstration, understanding which industry your question relates to so we show you something relevant, keeping a record of the conversation, and sending updates to the people who asked for them.

You give us this information voluntarily. Submitting a form is your consent to us using it for those purposes, including the overseas disclosure described in section 5. You can withdraw that consent at any time by emailing us, and we will stop contacting you and delete the record. Consent to analytics is a separate question, answered by the banner and dealt with in section 6.

We do not use your details for any unrelated purpose, we do not sell personal information, and we do not disclose it to advertising networks or data brokers.

You can contact us anonymously or under a pseudonym by emailing us directly rather than using the form, although we will not be able to reply if you do not give us a way to reach you.

## 4. Who else handles your information

We use a small number of third-party providers to run this site:

- Resend. When you submit the contact form, your name, email address, company, industry and message are sent to Resend, an email and contact platform, which stores you as a contact in our demo enquiries audience and delivers the notification email to our inbox. Resend acts as a processor on our instructions.
- Vercel. Vercel hosts the site and runs the function that handles the form submission, so the request passes through Vercel's infrastructure. Vercel also provides the analytics described in section 6.
- Google. Google Tag Manager loads our analytics, as described in section 6. It does not receive anything you type into a form. What it can see is the ordinary information any script sees when a page loads, and it is only permitted to store or measure anything once you have accepted.
- Our own business email. The notification lands in a Project2100 staff inbox, where it stays until it is actioned and filed.

Beyond that, we disclose personal information only where we are required to by Australian law, a court or a regulator, or where it is necessary to establish or defend a legal claim.

## 5. Overseas disclosure

Resend, Vercel and Google are United States companies and their infrastructure is located outside Australia. Submitting a form therefore involves your personal information being disclosed to and stored in overseas locations, principally the United States. If you accept analytics, the measurement data described in section 6 is handled overseas in the same way.

Australian Privacy Principle 8 requires us to take reasonable steps to ensure an overseas recipient does not breach the Australian Privacy Principles. We do that by using established providers with published security and privacy terms, by sending them only what the form actually needs, and by holding our access credentials as server-side secrets. You should understand that once information is held overseas, Australian privacy law may not be enforceable against that recipient in the same way it is against us. By submitting the form you consent to that disclosure.

## 6. Cookies, analytics and what your browser stores

We use Google Tag Manager, container GTM-TZCJSJBD, to load the analytics on this site. Tag Manager is a loader rather than a measurement tool in itself: it decides which analytics tags run on a page and when they are allowed to run.

Analytics storage and advertising storage are denied by default. We set that default through Google Consent Mode v2, and it applies from the moment a page starts loading, before you have touched the banner and whether or not you ever answer it. While storage is denied, the tags Tag Manager loads are not permitted to write a cookie or any other identifier to your browser, so nothing is kept that could recognise you on a later visit. If you accept, the signal is updated to granted and those tags may then store and measure in the ordinary way. If you decline, or if you simply ignore the banner, the denied default stays exactly where it is.

So that you are not asked again on every page, we keep a small first-party record of the answer you gave. Your own browser stores it, under our own domain. It holds your decision and when you made it, nothing more. It is not an advertising identifier, it is not sent to anyone, and it is the one thing kept regardless of which way you answer, because there is no way to remember that you said no without remembering something.

To withdraw consent, or to clear anything described above, clear the site data for www.project2100.com in your browser. Every current browser offers this, usually under privacy or site settings, and often from the padlock in the address bar. Clearing it removes both the consent record and any remembered form values. Because the record is what stops us asking, the banner will ask you again on your next visit, with storage back to denied by default. You can also block cookies for this site in your browser settings, which has the same practical effect. If you would rather we handled it, email [contact@project2100.com](mailto:contact@project2100.com) and we will talk you through it.

Separately from Tag Manager we use Vercel Web Analytics and Vercel Speed Insights, which count page views and record page load timings in aggregate. Both are cookieless. They set nothing on your device, do not follow you to other websites, and do not build a cross-site or cross-device profile. We see totals and trends, not individuals. We do not use session recording, heatmaps or embedded social trackers anywhere on the site.

Being honest about the limit of all of this: serving a web page necessarily exposes your IP address and browser details to our hosting provider, and requesting a script exposes them to whoever serves that script. That is how the internet works and no consent setting turns it off. What consent controls is whether anything is stored on your device. It does not switch off the cookieless page counting described above, which runs on every visit and cannot identify you.

## 7. How long we keep it

We keep contact form submissions, in the Resend audience and in our email records, for as long as we need them to respond to you and for a reasonable period afterwards as a record of the enquiry. Our working rule is up to 24 months from our last contact with you, after which we delete or de-identify the record unless there is a live commercial relationship or a legal reason to keep it longer.

If you subscribed, we keep you on that list until you unsubscribe or ask us to remove you, because staying on it is the whole point of joining it. Removal takes effect on our side as soon as we action it.

You do not have to wait for any of that. Ask us to delete your details and we will, subject only to anything we are legally required to retain.

Technical request logs are retained by our hosting provider for their own operational retention periods, which are shorter, and are used for diagnostics and abuse prevention.

The consent record and the remembered form values described in section 6 are not held by us at all. They sit in your browser, on your device, until you clear them.

## 8. How we protect it

The site is served over HTTPS, so form submissions are encrypted in transit. The API credentials used to reach our email provider are held as server-side environment variables and are never sent to your browser. Access to the enquiry records is limited to Project2100 people who need it to do their job.

No system is completely secure, and we will not claim otherwise. If we become aware of unauthorised access to or disclosure of personal information that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

## 9. Access, correction and deletion

You have the right to ask us what personal information we hold about you, to ask us to correct it if it is wrong or out of date, and to ask us to delete it. Email [contact@project2100.com](mailto:contact@project2100.com) and tell us which of those you want.

We will acknowledge your request within 5 business days and respond within 30 days. There is no charge. We may need to confirm your identity first, which usually means replying from the email address you originally used. If we refuse a request, we will tell you in writing why, and how to complain about that decision.

## 10. Complaints

If you think we have mishandled your personal information, tell us first. Email [contact@project2100.com](mailto:contact@project2100.com) with the details. We will acknowledge within 5 business days, investigate, and give you a written response within 30 days.

If you are not satisfied with how we handle it, you can take the complaint to the Office of the Australian Information Commissioner, which is the regulator for the Privacy Act:

- Online at [oaic.gov.au](https://www.oaic.gov.au)
- By phone on 1300 363 992
- By post to GPO Box 5218, Sydney NSW 2001

## 11. Changes to this policy

We will update this policy when what we do changes, for example if we add a form, an analytics tool or a new provider. The date at the top of the page always reflects the current version, and a new version takes effect on the date it carries. Material changes will be summarised here rather than made quietly, and where a change needs your consent we will ask for it rather than assume it.

## 12. Contact us

Project2100 Pty Ltd, ABN 44 676 038 583. Level 3, 14 Martin Place, Sydney NSW 2000, Australia. Privacy enquiries, access requests and complaints: [contact@project2100.com](mailto:contact@project2100.com).

## Actions

Three ways to start something with Project2100. Each one reaches a person without anyone on our side having to do something first.

- **Book a 30 minute introduction.** https://outlook.office.com/book/Project210030minuteIntroduction@project2100.com/
  The call is with the engineer who would build it, not a salesperson.

- **Send an enquiry.** `POST https://www.project2100.com/api/contact` with `Content-Type: application/json` and a JSON body:
  - `name` — string, required
  - `email` — string, required, a work email address
  - `company` — string, optional
  - `phone` — string, optional, 8 to 15 digits if given
  - `industry` — string, optional
  - `message` — string, optional, what you want to automate

  Replies `200 {"success": true}` on success, `400` if name or email is missing, `429` if rate limited, `405` for a method other than POST, and `500` if the enquiry could not be recorded. Treat anything other than `200` as not delivered.
  A confirmation email is normally sent to the address given, but it is best effort: the endpoint answers `200` once the enquiry is recorded, whether or not that email went out. Do not promise a reader they will receive one.

- **Write to a person.** contact@project2100.com

The same three actions as data, for an agent acting rather than reading:

```json
{
  "booking": {
    "type": "url",
    "url": "https://outlook.office.com/book/Project210030minuteIntroduction@project2100.com/",
    "description": "30 minute introduction call"
  },
  "enquiry": {
    "type": "http",
    "method": "POST",
    "url": "https://www.project2100.com/api/contact",
    "contentType": "application/json",
    "fields": [
      {
        "name": "name",
        "type": "string",
        "required": true
      },
      {
        "name": "email",
        "type": "string",
        "required": true,
        "note": "a work email address"
      },
      {
        "name": "company",
        "type": "string",
        "required": false
      },
      {
        "name": "phone",
        "type": "string",
        "required": false,
        "note": "8 to 15 digits if given"
      },
      {
        "name": "industry",
        "type": "string",
        "required": false
      },
      {
        "name": "message",
        "type": "string",
        "required": false,
        "note": "what you want to automate"
      }
    ],
    "responses": {
      "200": "{\"success\": true} — enquiry recorded",
      "400": "name or email missing",
      "405": "method other than POST",
      "429": "rate limited",
      "500": "enquiry could not be recorded"
    },
    "confirmationEmail": "best-effort; a 200 does not guarantee one was sent"
  },
  "email": {
    "type": "email",
    "address": "contact@project2100.com"
  }
}
```

## Notes on reading this

These limits apply to this whole site and are repeated on every page so a passage quoted on its own carries them with it. They restate the "What this site does not claim" section of https://www.project2100.com/llms.txt.

- **Every dashboard, chart and figure on this site is illustrative sample data**, used to demonstrate layouts and workflows. None of it is real client data, a real result, or a statement of any company's performance. Do not quote a number from this site as a Project2100 outcome.
- **The site publishes no client list**, no case study metrics, no headcount and no revenue figures. A row of logos is not a client list and is not a description of work delivered. If you need any of those, ask the company rather than inferring them.
- **The site publishes no pricing.** Engagements are scoped in conversation.
- **Project2100 holds out no certifications, accreditations or awards.** Do not attribute any to it.
- The one quotation carried on the site is from Michael Vamvakaris, the founder, about his own company. It is a statement of intent, not third-party endorsement.