Privacy Policy | Approvals Track

1. About this policy

Approvals Track Pty Ltd (ACN 010 529 898) provides a platform to manage approvals from exploration through closure. We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. "Sensitive information" includes information about racial or ethnic origin, health, criminal record, and political or religious beliefs.

This policy applies to our website, our platform and interactions with users.

2. Our role: platform provider and customer data

Approvals Track handles personal information in two ways:

Information we collect for our own purposes, such as website enquiries, account and billing details, and platform usage data. We are responsible for this information.
Information our customers and their users place in a case record, such as submissions, documents, correspondence and comments about approval processes. Our customers decide what is entered and why. We hold and process information and data on their behalf and in line with our agreement with them. Where you are an individual named in a case record, requests about that content may be referred to the relevant customer.

Government agencies using the platform may also be subject to their own privacy laws, such as the Information Privacy Act 2009 (Qld) or equivalent legislation in other jurisdictions.

3. The kinds of personal information we collect

Contact and identity details: name, position, organisation, email address, phone number
Account details: username, role and permissions, login credentials (passwords are stored in hashed form)
Case record content: names and contact details of project personnel, regulators, consultants, landholders, stakeholders and submitters; uploaded documents; comments, decisions, conditions and correspondence; audit trail entries recording who did what and when
Billing details: billing contact and invoicing information (payment card details are handled by our payment provider)
Technical and usage data: IP address, device and browser type, pages visited, features used, log data and cookie identifiers
Communications: enquiries, support requests, feedback and demo requests

Approval documents may sometimes include sensitive information, for example information about cultural heritage or native title matters that reveals ethnic origin, or health and safety incident details. We do not seek sensitive information for our own purposes. Where it is entered into a case record, it is handled only to provide the service, under the direction of our customer, and with the consent or authority they are responsible for obtaining.

4. How we collect personal information

directly from you, when you contact us, request a demo, create or use an account, or apply for a job
from our customers and their authorised users, when they create or contribute to a case record or invite you to the platform
automatically, through cookies, logs and analytics tools when you use our website or platform

5. Why we collect, hold, use and disclose personal information

to provide, operate, secure and support the platform and maintain case records and audit trails
to set up and manage accounts, permissions and invitations
to respond to enquiries, provide demos and give customer support
to invoice customers and manage our business relationships
to improve, test and develop our platform and website
to send you updates and marketing (see section 10)
to detect, prevent and investigate security incidents, fraud and misuse
to meet our legal obligations

We use or disclose personal information for the purpose we collected it, for a related purpose you would reasonably expect, with your consent, or where permitted or required by law (APP 6).

6. Who we disclose personal information to

Other participants in a case record. The platform is built for collaboration. Information you add to a shared case record may be visible to other authorised users, such as the proponent, regulators and their advisers, unless limited or restricted according to the permissions set by the customer.
Service providers who help us operate, including cloud hosting, email, analytics, payment processing, customer support tools and professional advisers. We require them to protect personal information and use it only for our purposes.
Government and law enforcement bodies, where required or authorised by law.
A purchaser or investor, if our business or assets are sold or restructured.

We do not sell personal information.

7. Overseas disclosure

Some of our service providers may store or access personal information outside Australia. Our primary platform data is hosted in Australia. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs (APP 8).

8. Cookies and analytics

Our website and platform use cookies and similar technologies to keep you signed in, remember preferences, and measure and improve performance. We use an analytics provider which may process data overseas. You can manage cookies in your browser settings, though some features may not work without them.

9. Anonymity and government identifiers

You may deal with us anonymously or by pseudonym when making a general enquiry, where practicable. We need to know who you are to provide you with an account or access to a case record. We do not use government-related identifiers (such as a driver licence number) as our own identifier for individuals.

10. Direct marketing

We may send you information about Approvals Track Pty Ltd where you have consented or would reasonably expect it, and we will provide a way to opt out of marketing information. You can unsubscribe at any time using the link in our messages or by contacting us. This is in line with APP 7 and the Spam Act 2003 (Cth).

11. Security and retention

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure (APP 11). These include role-based access controls, authentication, encryption in transit and at rest, audit logging, staff confidentiality obligations and supplier due diligence.

We keep personal information only as long as needed to provide the service, meet our agreements with customers and satisfy legal requirements. Case records are retained according to our customer's instructions and any statutory record-keeping requirements. When information is no longer needed, we take reasonable steps to destroy or de-identify it.

12. Data breaches

If we experience a data breach that is likely to result in serious harm, we will notify affected individuals (or the relevant customer) and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

13. Automated decision-making

Approvals Track Pty Ltd does not use automated systems to make decisions that significantly affect individuals' rights or interests. Approval decisions are made by third parties separate from Approvals Track. Approvals Track Pty Ltd holds no responsibility for any errors or omissions within the platform. Any decisions made by other parties based on information held by the Approvals Track platform are solely the responsibility of those parties.

14. Accessing and correcting your information

You can request access to the personal information we hold about you and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APPs 12 and 13). We will respond within 30 days. We may need to verify your identity, and we may refuse access in limited circumstances allowed by the Privacy Act, in which case we will give you our reasons in writing.

If your information is in a case record controlled by one of our customers, we may direct your request to them or work with them to respond.

15. Contact us and complaints

If you have a question or complaint about how we handle personal information, please contact our Privacy Officer:

Privacy Officer, Approvals Track
Email: ramith@approvalstrack.com
Post: 19/512 Oxley Road, Sherwood QLD 4075

We will acknowledge your complaint promptly, investigate it and reply in writing. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner:

Website: www.oaic.gov.au
Phone: 1300 363 992

16. Changes to this policy

We may update this policy from time to time. The current version is always available on our website, with the "last updated" date shown at the top. You can ask us for a copy in another format free of charge.