Privacy policy

Who this covers

This policy explains how Cornerstone Building Surveyors Pty Ltd handles personal information: what we collect through this website, why we hold it, who else sees it, and what you can ask us to do with it.

Australian privacy law does not cover every small business. We are not going to hide behind that. We handle personal information in line with the Australian Privacy Principles, and this page is what you can hold us to.

Privacy questions, requests and complaints go to admin@cstonebs.com or (03) 9802 9459.

What we collect

The quote form

The quote request form at /quote is the only form on this website. It asks for:

• your name, phone number and email address;
• the suburb the work is at;
• what the project is;
• whether you are an owner-builder, and whether a planning permit is needed;
• whether you are the owner, or a builder, supplier or draftsperson sending it on someone's behalf;
• if you are sending it for someone else, that person's name and phone number;
• anything else you want to tell us, in your own words;
• one optional file, up to 8 MB.

The file is optional and most people attach drawings: a site plan, a set of architectural drawings, a marked-up aerial photo, or a supplier's standard engineering. If you have nothing to attach, send the form anyway.

The form also carries one hidden field that stays empty for a real person. It is there to catch spam robots, which fill it in.

Nothing else on this site collects information about you. There is no account, no login, no booking form, no newsletter, no comments and no search box.

Phone calls and emails

If you ring us or email us, we hold what you tell us along with the number or address you contacted us from. If you go on to engage us, we hold the project file: the plans, the documents lodged with the application, and the records of the inspections.

Website logs

Our host keeps standard web server logs for every page served: the visitor's IP address, the browser's user agent, the page requested, the referring page and the time. That is part of serving and protecting the site and it cannot be switched off. We do not use those logs ourselves, and the host keeps them for a limited period.

Website statistics

We use Netlify Web Analytics to see how the site is being used. It runs on the host's side, from the same server request logs. No script is added to the page you are reading and no cookie is set in your browser, so nothing follows you off this site.

The host processes IP addresses to work out how many different visitors there were. What we see is the totals only: pages viewed, visitor counts, the most-viewed pages, the sites people arrived from, addresses that returned a not-found error, and bandwidth used. We cannot see individual IP addresses and there is no profile of any visitor in it.

Why we collect it

We use what you send us to:

• work out whether the job needs a building permit at all;
• prepare a fixed-fee quote and send it to you;
• contact you about your enquiry;
• carry out the building surveying work if you engage us — assessing the plans, issuing the building permit, carrying out the inspections, and issuing the occupancy permit or certificate of final inspection at the end.

Sending the form does not engage us and does not appoint a building surveyor. Nothing starts until we confirm an engagement in writing — see our terms of use.

If a builder, supplier or draftsperson sends us a customer's name and phone number, we use those details only to contact that person about their project. If you are the one sending them, please ask that person first.

Building work has to be reported

Once we are engaged, information about your building work is given to the relevant council, including a copy of the building permit and the documents lodged with the application. The Victorian Building Authority can also require information from a building surveyor. That is what the Building Act 1993 and the Building Regulations 2018 require, and it is not something either of us can opt out of. We also have to keep permit records.

Who else sees it

• Netlify, Inc. — our website host. Netlify serves the site, stores each form submission and any file attached to it, and emails a copy of the submission to our office. Their privacy policy and list of sub-processors are on their site.
• Akismet, run by Automattic, Inc. — every submission passes through this spam filter before it reaches us. It is part of the form service.
• Our email provider — the copy of the submission lands in our mailbox and stays in our business records, so the mail service we use holds a copy too.
• The relevant council and the Victorian Building Authority — as set out above, once you engage us.
• Anyone else the law requires us to give it to.

That is the whole list. We do not sell personal information, we do not trade it, and we do not give it to anyone for marketing.

Your information is stored overseas

Netlify, Inc. and Automattic, Inc. are United States companies. Form submissions, any file you attach and the spam check all happen on systems in the United States. So when you send the form, your information is held overseas, and overseas systems are not covered by Australian law the way a local one would be.

Sending it overseas does not hand off our responsibility. If something goes wrong with information we have sent to a service we use, it is still ours to deal with, and you can still come to us about it.

Netlify holds it under a data processing agreement that limits them to running the service. It says they do not sell or share the data and do not use it for their own marketing.

If you would rather your details did not go through a United States service, ring us or email us instead of using the form. Either way gets you the same answer.

Drawings and files you send us

Attach only what is relevant to the enquiry. A file you upload is stored with the submission on the host's systems and emailed to us, the same as the rest of the form.

Uploaded files are not scanned for viruses. If a document carries information you would rather not send — a survey with someone else's details on it, for example — take that page out, or send the drawings a different way. Do not send us documents you would not want stored on a third party's system.

Keeping it safe

• every page and every form submission travels over an encrypted connection, and browsers are told never to fall back to an unencrypted one;
• the strict content security policy stops third-party code running on the site;
• we do not collect card numbers, bank details or identity documents through this website;
• submissions are seen by the people who need to see them to answer you, and no one else.

No system is perfectly secure and no transmission over the internet ever is. We say that because it is true, not to shift the risk onto you: if something goes wrong at our end it is ours to fix. If we think personal information has been exposed, we will work out what happened and tell the people affected where the exposure is likely to cause them serious harm.

How long we keep it

Enquiries that do not turn into work. We do not keep quote submissions indefinitely. Once an enquiry is closed out we remove it from the host rather than letting submissions build up. A copy of every submission is also emailed to us, so removing it at the host does not remove every copy — the mailbox is cleared out as well.

Permit records. Once we are engaged, the project file becomes a permit record and we keep it for as long as the Building Act 1993 and the Building Regulations 2018 require. Those records cannot be deleted on request.

Asking for a copy, a correction or deletion

Email admin@cstonebs.com and tell us which you want:

• a copy of the personal information we hold about you;
• a correction, if something we hold is wrong, out of date or misleading;
• deletion of an enquiry you sent us.

We reply within 30 days. There is no charge for asking, and no charge for making a correction. If we cannot do what you have asked — deleting a permit record, for example — we will tell you why in writing.

Complaints

Tell us first. Email admin@cstonebs.com with "Privacy complaint" in the subject line, or ring (03) 9802 9459 and we will take it down in writing. We look into it and reply within 30 days.

If you have not heard back in that time, or you are not happy with the answer, you can raise it with the Office of the Australian Information Commissioner at oaic.gov.au. Complaints to the OAIC have to be in writing. The OAIC deals with organisations covered by the Privacy Act, so whether it takes on a complaint about a small business is a matter for them.

Changes to this policy

We read this page over at least once a year and update it when what we do changes. Changes take effect when they are published here. We do not send out notifications, so the date below is the one to check.

Version 1.0 — last updated 24 August 2026.

Also here: our terms of use, and how to contact us.