Privacy Policy

01About this policy & scope

This policy applies to the WattleDB website at wattledb.com.au, the WattleDB console and platform, and any related services, communications and events (together, the “Services”). By using the Services or providing us with your personal information, you acknowledge the practices described in this policy.

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not, as defined in the Privacy Act.

Personal vs. customer data

This policy concerns personal information that we collect as the entity responsible for it. It is different from the customer data that you, as a WattleDB customer, store in databases you provision on our platform. Where you upload personal information about your own end users into your WattleDB databases, you are the entity responsible for that information and we handle it on your behalf as a service provider under our Terms of Service and Data Processing Addendum.

02Information we collect

The kinds of personal information we collect depend on how you interact with us:

Information you give us

• Account & enquiries, your email address, and any content you include when you contact us.
• Account & identity, your name, email address, password (stored only in hashed form), organisation name, and role.
• Billing & payment, billing name, billing address, ABN (where applicable), and payment method details. Card and bank-account details are collected and processed by our third-party payment provider; we do not store full card numbers or bank credentials on our systems.
• Support & communications, records of your correspondence with us, including support tickets and emails.

Information we collect automatically

• Technical & usage data, such as the pages you view, the actions you take in the console, API request metadata, browser type and approximate device information, and log data required to operate and secure the Services.
• Aggregate analytics, first-party, server-side pageview counts. As described in section 5, these do not use cookies and we do not store your IP address for analytics.

We generally do not collect sensitive information (as defined in the Privacy Act, e.g. health, racial or ethnic origin, or biometric information) about you. If you choose to store sensitive information within your own databases, you do so under the arrangements described in section 1.

03How we collect it

We collect personal information directly from you when you create an account, subscribe to a plan, contact us, or otherwise use the Services. We also collect technical information automatically through your use of the Services. Where it is reasonable and practicable, we collect personal information directly from you rather than from third parties.

04Why we collect & use it

We collect, hold and use your personal information for the following purposes:

• to create, operate, secure and support your account and the Services;
• to provision, manage and maintain the databases and infrastructure you request;
• to process subscriptions, payments, invoices and refunds;
• to communicate with you about the Services, including service, security and billing notices;
• to respond to your enquiries and provide customer support;
• to understand and improve the Services through aggregate analytics;
• to detect, prevent and respond to fraud, abuse, security incidents and technical issues;
• to comply with our legal obligations and to establish, exercise or defend legal claims; and
• with your consent, to send you marketing communications (see section 12).

Where we collect personal information for a particular purpose, we will not use or disclose it for an unrelated purpose unless you would reasonably expect us to, you have consented, or we are otherwise permitted or required to do so by law.

05Cookies & analytics

WattleDB is built to minimise tracking. Our marketing website does not set advertising or third-party tracking cookies, and we do not use third-party analytics services such as Google Analytics. Website visitor statistics are counted server-side and in aggregate, without setting cookies. We derive an approximate country from your IP address using an offline lookup performed on our own servers, after which the IP address is discarded and never stored. We also record aggregate, non-identifying signals such as the referring website's domain and time spent on a page (via a cookieless measurement that stores no identifiers). All of this stays on Australian infrastructure, in keeping with our Australian-hosting and data-minimisation commitments.

The WattleDB console uses strictly necessary cookies (or equivalent local storage) required to keep you securely signed in and to operate core functionality. These are essential to provide the Service you have requested.

06When we disclose information

We do not sell your personal information. We disclose personal information only as reasonably necessary to provide the Services, and only to recipients who are bound by appropriate confidentiality and security obligations. These may include:

• Infrastructure providers, Australian-based data-centre and hosting providers that operate the servers and storage on which the Services run;
• Payment providers, our payment and banking partner(s) that process invoice payments and refunds;
• Communications providers, the email service we use to send transactional and account messages;
• Fraud prevention, Kount (an Equifax company, United States) receives device and browser characteristics and your IP address when you view an invoice or enter card details, as part of our payment provider's fraud checks. It does not receive your database contents, your backups or your object storage;
• Address lookup, an Australian address-autocomplete service receives the billing address you type, together with a session identifier, so it can suggest matching Australian addresses. It does not receive your name, your email address or your IP address;
• Professional advisers, such as accountants, auditors and lawyers, where reasonably required; and
• Government, regulators or law enforcement, where we are required or authorised by Australian law to do so, or where we are compelled under a law or lawful order that applies to us, including a request made under an international agreement to which Australia is a party. Where we are lawfully able to tell you about such a request, we will; some Australian laws prohibit us from doing so.

In the unlikely event of a business sale, merger or restructure, personal information may be disclosed to a prospective purchaser, subject to appropriate confidentiality protections.

07Overseas data & Australian ownership

Australian ownership is central to WattleDB. Customer databases, backups and the personal information described in this policy are hosted on Australian-owned infrastructure located in Australia (primary hosting in Sydney, with backup in Melbourne). Your databases, your backups and your object storage never leave Australia, and we do not use United States–owned cloud providers for hosting. We do not, in the ordinary course of operating the Services, transfer or store your personal information or customer data outside Australia, with two limited exceptions on our billing and certificate paths. Those exceptions involve personal information about the account holder rather than the contents of your database, and we identify them below rather than leave them unnamed.

Hosting in Australia limits, but does not remove, the ability of a government to compel access to data. Australian law can require us to disclose information and, in some cases, prohibit us from telling you. Australia is also party to international agreements under which foreign authorities can seek data from Australian providers, subject to the thresholds and safeguards those agreements set. We do not claim to put your data beyond lawful access, and no provider operating in any country can honestly do so. What Australian ownership changes is that no foreign parent company sits in the chain to be compelled as a matter of course.

Overseas recipients we currently engage. This policy commits us to identify the relevant country where a limited overseas disclosure is necessary. As at the effective date of this policy, those recipients are:

• Kount, an Equifax company (United States), receives device and browser characteristics and your IP address when you view an invoice or enter card details. It is bundled inside our payment provider's fraud-check script and runs only on those pages. It does not receive your database contents, your backups or your object storage, and it has no access to any WattleDB database.
• Let's Encrypt, operated by the Internet Security Research Group (United States), issues the TLS certificates that secure our hostnames. It receives domain and hostname information only, and no personal information. As with every publicly trusted certificate, those hostnames are published permanently to public Certificate Transparency logs.

We take reasonable steps in accordance with APP 8 in relation to these recipients. If any further disclosure of personal information to an overseas recipient becomes necessary (for example, a support tool used by our team), we will take reasonable steps in accordance with APP 8 to ensure the recipient handles the information consistently with the APPs, and we will update the list above to identify the relevant country where practicable.

08How we protect information

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11). These steps include encryption of data in transit (TLS) on all connections, including to backup storage, hashed storage of passwords, access controls, network and application security controls, activity logging, and regular backups held within Australian-owned data-centre facilities.

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security, and you are responsible for keeping your account credentials confidential.

09Data retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, to provide the Services, and to meet our legal, accounting and reporting obligations (for example, tax and financial records are generally retained for at least five years). When personal information is no longer required and we are not required by law to retain it, we take reasonable steps to destroy it or de-identify it. Customer data stored on the platform is retained and deleted in accordance with your instructions and our Terms of Service.

10Access & correction

You have the right to request access to the personal information we hold about you and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APPs 12 and 13). You can access and update much of your account information directly in the console. To make a formal access or correction request, contact us using the details in section 16.

We will respond within a reasonable period (and, for access requests, generally within 30 days). We do not usually charge for making a request, though a reasonable cost may apply to providing access in some circumstances. If we decline a request, we will tell you why in writing and how you can complain.

11Data breach notification

We comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. If we become aware of an eligible data breach that is likely to result in serious harm to affected individuals, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with our legal obligations. Where you are a customer and the breach affects data you control, we will also notify you promptly so you can meet your own obligations.

12Direct marketing

We may send you marketing communications about WattleDB where you have consented or where it is otherwise permitted by law. Every commercial electronic message we send will identify us and include a functional unsubscribe facility, consistent with the Spam Act 2003 (Cth). You can opt out at any time by using the unsubscribe link or by contacting us. We will action opt-out requests promptly. Service, security and billing communications are not marketing and will continue while you hold an account.

13Complaints & the OAIC

If you have a concern about how we have handled your personal information, please contact our Privacy Officer first using the details in section 16, and we will endeavour to resolve it. We aim to acknowledge complaints within 5 business days and to provide a substantive response within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner:

14Children's privacy

The Services are intended for businesses and developers and are not directed at children. We do not knowingly collect personal information from individuals under 16 years of age. If you believe a child has provided us with personal information, please contact us and we will take reasonable steps to delete it.

15Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The current version is always available at wattledb.com.au/privacy.html, and we will note the effective date at the top. Where changes are material, we will take reasonable steps to notify you, for example by email or an in-console notice. Your continued use of the Services after an update takes effect constitutes acceptance of the updated policy.

16How to contact us

For any privacy question, request or complaint, please contact our Privacy Officer: