Privacy Policy

1. About this policy

Inventient Pty Ltd (ACN 699 522 499) (Inventient, we, us, our) designs and builds websites, web applications, mobile applications and purpose-built business systems, and provides related systems administration and support services.

We respect your privacy and are committed to handling personal information openly and responsibly. This policy explains what personal information we collect, why we collect it, how we use and disclose it, how we keep it secure, and how you can access it, correct it or make a complaint.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where the Privacy Act does not strictly apply to us, we nonetheless aim to meet the standards it sets.

By using our website, engaging our services, or otherwise providing us with personal information, you agree to your personal information being handled as described in this policy.

2. Who and what this policy covers

This policy applies to personal information we collect about:

• visitors to our website at inventient.com.au and any related subdomains;
• clients and prospective clients, and their staff and representatives;
• suppliers, contractors and business partners;
• job applicants and people who contact us for any other reason.

Information we handle for our clients. In the course of building and supporting systems for our clients, we sometimes access or store personal information that belongs to their customers, staff or users. In those cases the client decides what information is collected and why, and we act only on the client's instructions under our agreement with them. That information is governed by the client's own privacy policy, not this one. Section 9 explains how we treat it.

3. What personal information we collect

The personal information we collect depends on how you interact with us. It may include:

Category

Examples

Contact details

Name, business name, job title, email address, phone number, postal or business address

Engagement information

Enquiry details, project requirements, correspondence, meeting notes, support requests

Billing information

ABN, billing contact, purchase order references, invoice and payment history. We do not store full credit card numbers — card payments are processed by our payment providers

Account and access information

Usernames, access credentials and permissions for systems we build or administer for you

Technical information

IP address, browser type and version, device and operating system, referring pages, pages viewed, dates and times of access

Recruitment information

Résumés, work history, qualifications, references and any other details provided in a job application

We do not generally collect sensitive information (such as health information, or information about your race, religion or political views). If we ever need to, we will ask for your consent first, unless the law permits otherwise.

You can deal with us anonymously or under a pseudonym where it is lawful and practicable — for example, when making a general enquiry. In most cases, though, we will need your contact details to respond to you or to provide our services.

4. How we collect personal information

Wherever it is reasonable and practicable, we collect personal information directly from you — for example when you:

• complete a contact, quote or enquiry form on our website;
• email, call or message us;
• meet with us to discuss a project;
• enter into an agreement with us or provide details for invoicing;
• use or administer a system we have built or that we support;
• apply for a role with us.

We may also collect personal information from third parties, including publicly available sources such as company websites, business registers and professional networking sites; from your employer or colleagues where they provide your details as a contact for a project; and from referees you nominate in a job application.

Some information is collected automatically when you browse our website, as described in section 6.

5. Why we collect, use and disclose personal information

We collect, hold, use and disclose personal information for the following purposes:

• responding to enquiries and preparing proposals, quotes and statements of work;
• delivering our design, development, hosting, systems administration and support services;
• managing our relationship with you, including project communication and account management;
• invoicing, processing payments and managing debt recovery;
• operating, securing, maintaining and improving our website and the systems we build;
• meeting our legal, accounting, insurance and record-keeping obligations;
• sending service updates and, where permitted, marketing communications about our services;
• assessing job applications and managing recruitment;
• resolving disputes and enforcing our agreements.

Where we use personal information for a purpose other than the one it was collected for, we will only do so if that purpose is related to the original one and you would reasonably expect it, if you have consented, or if the law requires or permits it.

6. Cookies, analytics and website tracking

Our website uses cookies and similar technologies. A cookie is a small text file placed on your device that allows a site to recognise your browser and remember certain information.

We use cookies to keep the site working properly (for example, remembering your preferences and maintaining security), and to understand how visitors use the site so we can improve it. We may use third-party analytics services for this purpose; those services may set their own cookies and collect information such as your IP address, the pages you visit and how long you spend on them.

Most of this information is aggregated and does not identify you personally. Where it does identify you, we treat it as personal information under this policy.

You can set your browser to refuse cookies or to alert you when a cookie is being set. Some parts of our website may not work correctly if you disable cookies.

Our website may contain links to third-party sites. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

7. Who we disclose personal information to

We do not sell personal information. We may disclose it to:

• Our people and contractors — employees and subcontractors who need it to deliver our services, and who are bound by confidentiality obligations.
• Service providers we rely on to run our business, including cloud hosting and infrastructure providers, email and productivity platforms, source control and development tooling, accounting and invoicing software, payment processors, analytics providers, and backup and security services.
• Your organisation — where you are a representative of a client or supplier, we may disclose your information to others within that organisation as needed to deliver the engagement.
• Professional advisers such as our accountants, auditors, insurers and lawyers.
• Regulators, law enforcement and courts, where required or authorised by law.
• A purchaser or successor, if we sell or restructure all or part of our business.

We take reasonable steps to ensure third parties handle personal information consistently with the APPs and with this policy.

8. Overseas storage and disclosure

We prefer to host data in Australia wherever practical. However, some of the cloud and software providers we use store or process data overseas, including in the United States, the European Union and other countries where those providers operate data centres.

Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure it is handled in a way consistent with the Australian Privacy Principles — for example, by choosing reputable providers with appropriate contractual and security commitments.

If you would like to know where a particular system or dataset is hosted, contact us using the details in section 17.

9. Data we handle on behalf of our clients

When we design, build, host or support a system for a client, we may have access to personal information held in that system. In that role:

• the client remains responsible for that information and for its own privacy obligations;
• we access it only as needed to deliver the agreed services, or as the client directs;
• we do not use it for our own purposes, and we do not disclose it except as instructed by the client or as required by law;
• we apply access controls so that only the team members working on that engagement can reach it;
• we use de-identified or synthetic data in development and testing environments wherever practical;
• at the end of an engagement we return or securely destroy the data, subject to any backups and any records we must retain by law.

If you are a customer or user of one of our clients and have a question about your personal information, please contact that organisation directly. If you contact us instead, we will refer your request to them.

10. How we keep personal information secure

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:

• encryption of data in transit (TLS) and, where supported, at rest;
• multi-factor authentication on business systems and administrative accounts;
• role-based access controls and the principle of least privilege;
• credential and secret management, with credentials never shared in plain text;
• regular patching of servers, dependencies and platforms;
• monitored backups and tested restore procedures;
• confidentiality obligations for our staff and subcontractors.

No method of transmission or storage is completely secure. While we work hard to protect the information we hold, we cannot guarantee absolute security.

11. How long we keep personal information

We keep personal information only for as long as we need it for the purposes set out in this policy, or for as long as the law requires. Financial and tax records, for example, are generally kept for at least seven years.

When personal information is no longer needed and we are not required to retain it, we destroy it or de-identify it. Residual copies may persist in backups for a limited period until those backups are cycled out.

12. Accessing and correcting your information

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

To make a request, contact us using the details in section 17. We may need to verify your identity before we act. We will respond within a reasonable period, usually within 30 days.

Access is normally free, although we may charge a reasonable fee for the time and cost involved in retrieving and supplying extensive records. We will tell you about any fee before we proceed.

In limited circumstances we may refuse access or correction — for example, where doing so would unreasonably affect another person's privacy, or where the law permits or requires refusal. If we refuse, we will explain why in writing and let you know how to complain.

13. Marketing communications

We may send you information about our services, updates and occasional news, where you have consented or where you would reasonably expect it — for example, because you are an existing client.

Every marketing email includes an unsubscribe link, and you can opt out at any time by using that link or by emailing us. We will action opt-out requests promptly.

Opting out of marketing does not stop operational messages about work we are doing for you, such as project updates, invoices, security notices or scheduled maintenance.

14. Data breaches

We maintain a data breach response plan. If we suspect a breach involving personal information, we will contain it, assess the risk and take remedial action as quickly as possible.

Where a breach is likely to result in serious harm to affected individuals and the Notifiable Data Breaches scheme applies, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) as required.

Where a breach affects information we hold on behalf of a client, we will notify the client promptly and work with them on their response.

15. Complaints

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please tell us. Email us at hello@inventient.com.au with "Privacy complaint" in the subject line, and set out what happened and how you would like it resolved.

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If we need longer, we will let you know why and keep you updated.

If you are not satisfied with our response, you can refer the matter to the Office of the Australian Information Commissioner:

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

16. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our services or the law. The current version is always published at inventient.com.au, with the effective date shown at the top.

We encourage you to review it periodically. Where changes are significant, we will take reasonable steps to notify clients directly.

17. Contact us

For any question or request about privacy, including access, correction or complaints, contact our Privacy Officer:

Inventient Pty Ltd ACN 699 522 499 · ABN [insert new ABN] 635 Queens Road, Melbourne VIC 3004, Australia Email: hello@inventient.com.au Web: inventient.com.au