Privacy Policy

This policy applies to National Propellant Laboratory Pty Ltd (ABN 20 663 264 775), trading as NPL Australia ("NPL", "we", "us", "our"). It covers personal information we collect, hold, use and disclose in the course of operating our chemical-supply, custom-synthesis, contract-manufacturing, and partner-program activities.

NPL is bound by the Privacy Act 1988 (Cth) and complies with the Australian Privacy Principles (APPs) set out in Schedule 1 to that Act. Where program work is conducted under Defence security or export-control regimes, additional obligations under the Defence Trade Controls Act 2012 (Cth) and applicable contract clauses also apply.

Personal information

Information or an opinion about an identified individual, or one reasonably identifiable, whether the information is true and whether recorded in material form, as defined in s. 6(1) of the Privacy Act.

Sensitive information

The subset of personal information defined as sensitive in the Privacy Act (e.g. health information, biometric information). NPL does not routinely collect sensitive information.

APPs

The Australian Privacy Principles, set out in Schedule 1 of the Privacy Act.

Partner Portal

NPL's authenticated extranet for approved primes, defence-research partners, and qualified industry customers.

We collect only the information needed to operate our supply and engagement processes. The categories below are exhaustive:

• Identification & contact data, name, role/title, employer, business email, business phone, business postal address.
• Program data, the description of the molecule, scale, timeline, and end-application provided when you request a quote or supply.
• Partner-portal access data, username, hashed password, authentication factors, login timestamps, and audit-log entries.
• Transactional data, purchase orders, invoices, payment references, and shipping records.
• Website server logs, IP address, user-agent, requested URL, timestamp; retained for security & abuse-monitoring only.

NPL does not use third-party advertising trackers, behavioural-analytics scripts, or social-media pixels on this website.

Personal information is collected directly from you, typically when you submit our contact form, email us, place a purchase order, or apply for partner-portal access. We do not buy or rent contact lists.

Where information is collected indirectly (for example, from a prime's procurement contact about a downstream supplier representative), we will tell you about the collection at the next reasonable opportunity, in line with APP 5.

We use personal information for the primary purpose for which it was collected, fulfilling supply, custom-synthesis, contract-manufacturing and partner-portal services, and for the following directly-related secondary purposes:

• Issuing quotes, contracts, invoices, COAs, and shipping documentation.
• Managing partner-portal authentication, audit, and access reviews.
• Administering customer relationships, including periodic relevant updates.
• Meeting our regulatory obligations under the Privacy Act, the Defence Trade Controls Act, the Tax Administration Act, and other applicable law.
• Responding to lawful requests from law-enforcement, courts, or regulators.

We do not use personal information for direct marketing without consent, and you can opt out of any non-transactional communication at any time.

NPL discloses personal information only where necessary, and only to:

• Service providers bound by confidentiality, couriers, payment processors, accounting providers, IT/cloud infrastructure providers, and external auditors.
• Customers and primes in the limited form required to ship product or fulfil a contract (e.g. consignee details on a courier note).
• Government & regulators where required by law, including the OAIC, ATO, ABF, and Defence Export Controls Branch.

NPL does not sell personal information, and does not disclose information for any purpose unrelated to the supply or program for which it was collected, except with consent or as required by law.

Some of our IT infrastructure is hosted in Australia and the United States. Where personal information is disclosed to an overseas recipient (e.g. a US-located cloud provider acting as a processor on our behalf), we take reasonable steps under APP 8 to ensure the recipient handles the information consistently with the APPs.

Personal information is held on our customer-relationship and order-management systems (cloud), our regulated-document repository (cloud, Australian region), and, for partner-portal data, our authentication system.

We protect personal information by means proportionate to the sensitivity of the information, including: access controls, encryption in transit and at rest, multi-factor authentication for staff access, audit logging, and periodic security review. Program-related information held under defence-security obligations is additionally protected per the relevant contract and the Defence Industry Security Program (DISP).

We retain personal information only as long as needed for the purpose for which it was collected, or as required by law:

• Quote & order records, retained 7 years to satisfy taxation and contractual record-keeping obligations.
• Lot & batch records, retained 7 years for product traceability.
• Partner-portal audit logs, retained 24 months.
• Server logs, retained 90 days for security monitoring, then deleted.

When personal information is no longer required and we are not legally obliged to keep it, we destroy or de-identify it in line with APP 11.

Under APP 12 and APP 13, you may request access to the personal information we hold about you, and ask that it be corrected if inaccurate or out-of-date. Send requests to privacy@nplaustralia.com.au. We will respond within 30 days.

We will provide access free of charge except where the request is unusually complex or the records are archival, in which case a reasonable cost-recovery fee may apply (notified before any work begins).

If you believe NPL has handled your personal information in breach of this policy or the APPs, please contact us first at privacy@nplaustralia.com.au. We acknowledge complaints within 5 business days and aim to resolve them within 30 days.

If you are not satisfied with our response, you may make a complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We may update this policy from time to time. The current revision is identified in the document metadata above (LG-PRV · Revision B · Effective 01 Jan 2026). Material changes will be flagged on this page for at least 30 days before they take effect.

Revision history

For all privacy enquiries, access requests, correction requests, and complaints, contact NPL's Privacy Officer: