Privacy Policy

1. Introduction

This privacy policy sets out how Paperbark Quality Collective Pty Ltd (ABN 51 691 335 832), trading as Paperbark (“we”, “us” or “our”), collects, uses, discloses and protects personal information. It applies to personal information we collect through our online tools (Tools) and our website at www.paperbarkndis.com.au (Website).

We provide software that helps NDIS service providers and other disability sector organisations generate policy, procedure and compliance documents. We are a software provider only, and are not an NDIS provider. Most of the information we handle is business information about organisations and their personnel; where that information identifies, or can reasonably identify, an individual, it is personal information and is covered by this privacy policy.

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). By providing personal information to us, or by using the Tools or Website, you consent to us collecting, using and disclosing personal information in accordance with this privacy policy.

We may change this privacy policy from time to time by posting an updated copy on our Website, and we encourage you to review it regularly.

2. The personal information we collect

The personal information we collect may include:

• your name, role or job title, and business contact details (such as your business email address, phone number and address);
• your organisation’s name, address and ABN;
• account details, including your email address and password;
• the answers and business information you enter into the Tools about your organisation in order to generate a Document;
• any feedback you choose to give us about a Tool, including your rating and any comment you write;
• purchase and payment information when you buy a Paid Tool (payment card details are collected and processed by our payment provider, Stripe, and are not stored by us); and
• technical and usage information, such as your IP address, device type, browser information, page-view statistics and other standard web-log information collected through cookies and analytics tools (see clause 4).

3. Information we do not collect

The Tools are designed to collect business information only. We do not ask for, and you must not enter into the Tools:

• any information about NDIS participants or other individuals receiving supports or services; or
• any health information, or other sensitive information as defined in the Privacy Act (such as information about a person’s health, disability, racial or ethnic origin, or religious beliefs).

If you enter any such information into a free-text field or otherwise provide it to us, you do so on your own responsibility and contrary to these arrangements and our terms and conditions. You are responsible for ensuring you have any consents required before providing information about any other individual to us.

4. How we collect personal information

We may collect personal information directly from you, or from third parties, including when you:

• use the Tools, including by entering information to generate a Document;
• register for an account or purchase a Paid Tool;
• give us feedback about a Tool;
• contact us or communicate with us by email or through our Website; or
• interact with our Website, including its content.

For certain free Tools, the answers you enter to generate a Document are processed within your own browser and are not transmitted to or stored by us. We also receive limited information from our payment provider (Stripe) to confirm that a purchase has been completed.

After you download a Document from a free Tool, we invite you to tell us whether the Tool was useful. If you choose to respond, we record your rating and any comment you write, along with the name of the Tool and the date. Giving feedback is optional. It is not linked to you or your account, and it does not include your IP address or any of the answers you entered into the Tool. Please do not include personal information about yourself or anyone else in a comment (see clause 3).

We may collect technical and usage information through cookies and similar tracking technologies when you use our Website. Cookies are small files stored on your device. If you do not wish information to be stored as a cookie, you can disable cookies in your web browser, although some features of the Website may not function properly as a result.

We may use Google Analytics to collect and process usage data. To find out more, see How Google uses information from sites or apps that use its services.

5. How we use your personal information

We collect and use personal information for the following purposes:

• to provide the Tools to you and to generate Documents based on the information you enter;
• to create and administer your account, and to process your purchases;
• to send you transactional and service communications, such as purchase confirmations, reminders (including reminders to download your data before deletion), security alerts and updates;
• to provide support and respond to your enquiries;
• to operate, maintain, improve and secure the Tools and our Website;
• to comply with our legal obligations, and to resolve disputes or enforce our agreements; and
• with your consent or where otherwise permitted by law, to send you marketing communications about our products and services. You can opt out of marketing communications at any time using the unsubscribe facility provided (in accordance with the Spam Act 2003 (Cth)).

6. Disclosure of your personal information

We may disclose personal information to:

• our service providers and contractors who help us operate the Tools and our business, including Stripe (payment processing), Brevo (transactional email) and our data hosting providers, Supabase and Vercel;
• our professional advisers, such as our lawyers and accountants;
• a government, regulatory or law enforcement body, where required or authorised by law; and
• a purchaser or prospective purchaser of our business or assets, in connection with any actual or proposed sale, merger or reorganisation of our business.

We do not sell your personal information.

7. Overseas disclosure

The account and customer information you enter into the Tools is stored on servers located in Australia (Sydney) with our hosting providers, Supabase and Vercel.

Supabase and Vercel are US-owned. Their personnel may access that information from outside Australia (including from the United States) where reasonably necessary to provide technical support or maintain their services. This means personal information may be accessed by, and disclosed to, overseas recipients even though it is stored in Australia.

Our payment provider (Stripe) and our transactional email provider (Brevo) may also store or process information outside Australia, including in the United States and Europe.

Where we disclose personal information to overseas recipients, we will take reasonable steps to ensure that the recipient handles it in a manner consistent with the APPs, or that an exception under the Privacy Act applies.

8. How long we keep your personal information

Where you use an account-based or Paid Tool, we store the information you enter and the Documents you generate. You can export a copy of that information, and delete it, at any time through your account.

We retain that information for up to 60 days from the date of your last activity, after which it is deleted. Before deletion, we will send you an email prompting you to download your information.

We otherwise retain personal information only for as long as reasonably necessary for the purposes set out in this privacy policy, or as required by law, after which we will take reasonable steps to destroy or de-identify it in accordance with the APPs.

Tax invoices and related purchase and payment records are retained for the period required by taxation and other laws (generally five years), regardless of the 60-day deletion described above or the closure of your account.

9. Security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our systems are password protected and we use a range of administrative and technical measures to protect them. However, no method of transmission or storage is completely secure, and we cannot guarantee the absolute security of your personal information.

10. Links

Our Website and the Tools may contain links to third party websites, including those of our service providers. Those links are provided for convenience only. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing personal information to them.

11. Accessing and correcting your personal information

You may request access to the personal information we hold about you, or ask us to correct it, by contacting us using the details below. We may need to verify your identity before responding. In some cases we may be unable to provide access, in which case we will explain why. We will deal with all requests within a reasonable time.

12. Complaints

If you wish to complain about how we have handled your personal information, please contact us using the details below, including your name and contact details. We will investigate your complaint and respond within a reasonable time.

If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

13. Children

The Tools and Website are intended for use by businesses and their personnel, and are not directed at children. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have collected personal information from a child, please contact us and we will take reasonable steps to delete it.

14. Changes to this privacy policy

We may update this privacy policy from time to time. The current version will always be available on our Website, and material changes will take effect when the updated policy is posted.

15. Contact us

For further information about this privacy policy or our privacy practices, or to access or correct your personal information or make a complaint, please contact us using the details below:

Name: Penny Halpin
Email: support@paperbarkndis.com.au