Privacy Policy

Who we are

You can contact us at:

• Email: [email protected]
• Privacy Officer: Murtaza Nawab

What this Privacy Policy covers

This Privacy Policy explains how we collect, hold, use and disclose Personal Information about you when you:

• visit or use the Website;
• register for, access or use the Platform; or
• otherwise interact with us (for example, by email, phone or social media).

We handle Personal Information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

Data that a customer provides to us under a pilot agreement or services contract is handled in accordance with that agreement. Where any such data contains Personal Information, we handle it in accordance with the Privacy Act and this Privacy Policy.

What personal information we collect

We collect the following categories of Personal Information:

• Account information — your name, business name, ABN, email address, phone number, password (hashed), billing details, and the name and role of any authorised users.
• Profile information — information you provide about your business, role, industry and preferences.
• Usage data — information about how you use the Platform, including pages viewed, features used, frequency of use, and time spent.
• Communications — the content of emails, support tickets, chat messages, video calls and other communications between you and us.
• Technical and device information — IP address, browser type, operating system, device identifiers and similar information.
• Cookies and similar technologies — see our Cookie Notice.

We try to avoid collecting “sensitive information” (as defined in the Privacy Act). If we ever need to collect sensitive information, we will ask for your consent first.

How we collect personal information

We collect Personal Information:

• Directly from you — when you sign up, complete forms, communicate with us or use the Platform.
• Automatically — when you interact with the Website or Platform (via cookies, log files and analytics tools).
• From third parties — for example, from our sub-processors, payment providers, marketing partners, public sources, or referees.

Where we collect Personal Information about a third party (for example, your personnel or your suppliers) through your use of the Platform, we rely on you to have provided any necessary notices and obtained any necessary consents.

How we store and hold personal information

We store information about you in computer systems and databases operated by either us or our external service providers.

We implement and maintain processes and security measures to protect personal information which we hold from misuse, interference or loss, and from unauthorised access, modification or disclosure. These processes and systems include:

• the use of identity and access management technologies to control access to systems on which information is processed and stored;
• requiring all employees to comply with internal information security policies and keep information secure; and
• monitoring and regularly reviewing our practice against our own policies and against industry best practice.

We will also take reasonable steps to destroy or de-identify personal information once we no longer require it for the purposes for which it was collected or for any secondary purpose permitted under the APPs.

Why we collect, hold, use and disclose your personal information

We collect, hold, use and disclose Personal Information for the following purposes:

• to operate, provide, maintain and improve the Platform;
• to manage your account, including authentication, billing and customer support;
• to communicate with you about your account, the Platform and changes to our services;
• to send you marketing communications (with your consent or where otherwise permitted by law, and always with an opt-out — see “Direct marketing” below);
• to detect, prevent and address security incidents and fraud;
• to comply with our legal obligations and respond to lawful requests;
• to develop, test and improve our products and services; and
• to create Aggregated Data (see below).

Aggregated and de-identified data

We may create Aggregated Data — data derived from combining information across multiple users in a form that has been de-identified such that no individual user, business, or person can be re-identified whether alone or in combination with other reasonably available information.

We apply de-identification techniques consistent with current OAIC guidance, which may include aggregation thresholds, generalisation, suppression of small data points, and removal of direct and indirect identifiers.

Once data has been irreversibly de-identified and aggregated, it is no longer Personal Information for the purposes of the Privacy Act. We may use Aggregated Data for any lawful purpose, including analytics, benchmarking, product development and commercial reporting, and we may retain Aggregated Data indefinitely.

Disclosure to third parties

We may transfer or disclose your personal information to our related companies, and to external service providers so that they may perform services for us or on our behalf.

We may also disclose your personal information to others outside our group of companies where:

• we are required or authorised by law to do so;
• you have expressly consented to the disclosure, or the consent may be reasonably inferred from the circumstances; or
• we are otherwise permitted to disclose the information under the Privacy Act.

Further, we may disclose Personal Information to:

• Sub-processors — third-party service providers (such as hosting, analytics, email and AI providers) that help us run the Platform. A current list of our sub-processors is available on request at [email protected].
• Business partners — for example, integration partners and resellers, where you have asked us to share information with them.
• Legal disclosures — where required by law, regulation, court order or to protect our legal rights or those of others.
• In connection with a sale of business — to a purchaser or potential purchaser of all or part of our business or assets.

We do not sell Personal Information.

Overseas recipients and cross-border disclosure

Some of our sub-processors are located outside Australia, including in the United States. By using the Platform or providing Personal Information to us, you acknowledge that your Personal Information may be disclosed to recipients in those countries.

Where we disclose Personal Information overseas, we take such steps as are reasonable in the circumstances to ensure the overseas recipient handles the information in accordance with the APPs.

Direct marketing

We may send you direct marketing communications about products, services and offers that we think may interest you. Where required, we will rely on your consent, and you can opt out at any time by:

• clicking the “unsubscribe” link in any email; or
• contacting us using the details above.

We comply with the Spam Act 2003 (Cth) in relation to commercial electronic messages.

Cookies and similar technologies

We use cookies and similar tracking technologies on the Website and Platform. For more information about the cookies we use and how to manage them, please see our Cookie Notice.

Data security

We take reasonable steps to protect Personal Information from misuse, interference, loss, unauthorised access, modification and disclosure. These steps include:

• encryption of data in transit (TLS) and at rest;
• access controls and the principle of least privilege;
• audit logging;
• regular backups; and
• personnel training and vendor risk management.

No system is completely secure. While we work hard to protect your information, we cannot guarantee absolute security.

How long we keep your information

We keep Personal Information for as long as we need it to provide the Platform, comply with our legal obligations, and resolve disputes.

In general, we keep account-related Personal Information for the life of your account and for up to 7 years after your account is closed for legal, tax and recordkeeping reasons.

Aggregated Data that has been irreversibly de-identified may be retained indefinitely.

Your rights

Under the Privacy Act, you have the right to:

• Access the Personal Information we hold about you;
• Correct Personal Information that is inaccurate, out of date, incomplete, irrelevant or misleading; and
• Complain about how we have handled your Personal Information.

To exercise any of these rights, please contact us using the details at the top of this policy. We will respond to access and correction requests within a reasonable time (usually within 30 days).

If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

Access to and correction of your personal information

You may access or request correction of the personal information that we hold about you by contacting us. There are some circumstances in which we are not required to give you access to your personal information.

There is no charge for requesting access to your personal information, but we may require you to meet our reasonable costs in providing you with access (such as costs for time spent collating large amounts of material).

We will respond to your requests to access or correct personal information in a reasonable time and will take all reasonable steps to ensure that the personal information we hold about you remains accurate, up to date, complete, relevant and not misleading.

Children

The Platform is intended for use by businesses and individuals aged 18 and over. We do not knowingly collect Personal Information from anyone under 18. If you believe we have collected information from a child, please contact us so we can delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The most current version will always be posted on the Website. Where the changes are material, we will notify you by email or through the Platform.

Contact us

If you have any questions about this Privacy Policy or how we handle Personal Information, please contact our Privacy Officer at [email protected].