Privacy Policy

1. Introduction

This privacy policy sets out how Paperbark Quality Collective Pty Ltd (ABN 51 691 335 832), trading as Paperbark and Paperbark NDIS (“we”, “us” or “our”), collects, uses, discloses and protects personal information. It applies to personal information we collect through our online tools (Tools) and our website at paperbarkndis.com.au (Website).

We provide software that helps NDIS service providers and other disability sector organisations generate policy, procedure and compliance documents. We are a software provider only, and are not an NDIS provider. Most of the information we handle is business information about organisations and their personnel; where that information identifies, or can reasonably identify, an individual, it is personal information and is covered by this privacy policy.

Many of our customers are sole traders or small businesses, so business information may identify, or reasonably identify, an individual. Where it does, we treat it as personal information under this privacy policy.

We offer different types of Tools, which handle information differently:

• certain free Tools operate in your browser without an account. For those Tools, the answers you enter are processed on your device and are not intended to be sent to or stored by us, except where expressly stated;
• our free Verification Toolkit requires an account, and the answers you enter and the Documents you generate are stored on our servers; and
• our paid toolkits, including our Certification, Solo Provider, SIL and Restrictive Practices toolkits (each a Paid Tool), require an account and a one-off payment through Stripe, and the answers you enter and the Documents you generate are stored on our servers.

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). By providing personal information to us, or by using the Tools or Website, you consent to us collecting, using and disclosing personal information in accordance with this privacy policy.

We may change this privacy policy from time to time by posting an updated copy on our Website, and we encourage you to review it regularly.

2. The personal information we collect

The personal information we collect may include:

• your name, role or job title, and business contact details (such as your business email address, phone number and address);
• your organisation’s name, address and ABN;
• account details, including your email address and password;
• where you use the Verification Toolkit or a Paid Tool, the answers and business information you enter about your organisation in order to generate a Document. This may include your organisation’s name, address and ABN, brand colour, the role titles of responsible personnel, information about how your service operates, and free-text answers;
• the Documents generated from your answers, and any backup or export files containing your answers that are generated or stored through your account;
• if you use our contact form, the feedback type you select, your message and, if you choose to provide it, your email address, which we use to reply to you;
• ratings, feedback comments and survey responses you choose to provide, and any name and company name you choose to provide for publication with a comment (see clause 4);
• where you take part in a program in which we provide free access to a Tool in exchange for feedback, your email address, the name of the Tool and the date of access;
• limited usage information showing that a free Tool has been used;
• purchase and payment information when you buy a Paid Tool, including your email address, your business name and ABN where needed for a tax invoice, and payment confirmation from Stripe (payment card details are collected and processed by our payment provider, Stripe, and are not stored by us); and
• technical and usage information, such as your IP address, device type, browser information, page-view statistics and other standard web-log information collected through cookies and, if we use them, analytics tools (see clause 4).

3. Information we do not collect

The Tools are designed to collect business information only. We do not ask for, and you must not enter into the Tools, or include in any free-text answer, feedback comment, survey response or contact form message:

• any information about NDIS participants or other individuals receiving supports or services;
• any health information, disability information or other sensitive informationas defined in the Privacy Act (such as information about a person’s health, disability, racial or ethnic origin, or religious beliefs); or
• personal information about any other individual.

If you enter any such information into a free-text field or otherwise provide it to us, you do so on your own responsibility and contrary to these arrangements and our terms and conditions. You are responsible for ensuring you have any consents required before providing information about any other individual to us.

4. How we collect personal information

We may collect personal information directly from you, or from third parties, including when you:

• use the Tools, including by entering information to generate a Document;
• register for an account or purchase a Paid Tool;
• provide feedback, a rating or a comment on a Tool, complete a feedback survey or take part in a feedback program;
• contact us or communicate with us by email or through our Website; or
• interact with our Website, including its content.

For certain free in-browser Tools, the answers you enter are processed on your device and may be saved in your browser’s local storage so you can continue using the Tool. For example, our gap analysis Tool may keep your progress in your browser for up to 30 days. Those answers are not intended to be sent to or stored by us, unless the relevant Tool expressly states otherwise. You can clear your browser’s local storage through your browser settings, although doing so may remove your saved progress. We may record limited usage information showing that a free Tool has been used.

We also receive limited information from our payment provider (Stripe) to confirm that a purchase has been completed.

After you use or download certain free Tools, you may be invited to provide feedback. If you provide feedback on a free Tool, we may collect the rating, any optional comment you choose to provide, the name of the Tool and the date of the feedback. This feedback is not linked to your account, IP address or the answers you entered into the Tool.

Leaving a comment is optional. If you leave a comment on a free Tool, you may be asked whether you consent to us publishing that comment on our Website. Giving that consent is also optional, and we will only publish your comment if you tick the relevant consent checkbox or otherwise clearly agree to publication. If you agree to publication, you may choose to provide your name and company name for publication with your comment, and we may publish those details with the comment. If you do not provide those details for publication, we will not add or infer them.

For some programs, such as where we provide free access to a Tool in exchange for feedback, we may collect your email address, the Tool name and the date of access. Unless we tell you otherwise and obtain any required consent, this information is used for that program and is not added to a marketing list.

If you have an account, you may be invited in your account to complete a short feedback survey after you generate a Document. If you use a Paid Tool, we may also send you a feedback email approximately one week after you finish a toolkit, linking to that survey in your account. Completing the survey is optional, and you may choose whether to provide comments. Your survey responses are connected to your account. If you provide comments, you may also be asked whether you consent to us publishing those comments on our Website. We will only publish those comments if you tick the relevant consent checkbox or otherwise clearly agree to publication.

We may collect technical and usage information (such as your IP address, device and browser information and page views) through cookies and similar tracking technologies when you use our Website. Cookies are small files stored on your device. If you do not wish information to be stored as a cookie, you can disable cookies in your web browser, although some features of the Website may not function properly as a result.

We may use Google Analytics to collect and process usage data. To find out more, see How Google uses information from sites or apps that use its services.

5. How we use your personal information

We collect and use personal information for the following purposes:

• to provide the Tools to you and to generate Documents based on the information you enter;
• to create and administer your account, and to process your purchases;
• to send you transactional and service communications, such as purchase confirmations, reminders (including reminders to download your data before deletion), security alerts and updates;
• to provide support and respond to your enquiries;
• to operate, maintain, improve and secure the Tools and our Website;
• to understand how users experience the Tools, to operate, maintain and improve our Tools, Website, products and services, and to respond to feedback where appropriate, using the ratings, feedback comments and survey responses you choose to provide;
• where you have expressly consented, to publish your comments, and any name and company name you have chosen to provide for publication, on our Website;
• to comply with our legal obligations, and to resolve disputes or enforce our agreements; and
• with your consent or where otherwise permitted by law, to send you marketing communications about our products and services. You can opt out of marketing communications at any time using the unsubscribe facility provided (in accordance with the Spam Act 2003 (Cth)). Some Tools or programs (such as the Verification Toolkit) may state that we will not use your email address for marketing. Where we say this, we will use that email address consistently with the statement given at the time of collection.

6. Disclosure of your personal information

We may disclose personal information to:

• our service providers and contractors who help us operate the Tools and our business, including Stripe (payment processing), Brevo (transactional email), our data hosting providers, Supabase and Vercel, and, where we use Google Analytics, Google (analytics);
• our professional advisers, such as our lawyers and accountants;
• the public, by publishing your comment on our Website, together with any name and company name you have chosen to provide for publication, but only where you have expressly consented;
• a government, regulatory or law enforcement body, where required or authorised by law; and
• a purchaser or prospective purchaser of our business or assets, in connection with any actual or proposed sale, merger or reorganisation of our business.

We do not sell your personal information.

7. Overseas disclosure

The account and customer information we store, including the information you enter into the Verification Toolkit or a Paid Tool, is stored on servers located in Australia (Sydney) with our hosting providers, Supabase and Vercel.

Supabase and Vercel are US-owned. Their personnel may access that information from outside Australia (including from the United States) where reasonably necessary to provide technical support or maintain their services. This means personal information may be accessed by, and disclosed to, overseas recipients even though it is stored in Australia.

Our payment provider (Stripe), our transactional email provider (Brevo) and, where we use Google Analytics, Google may also store or process information outside Australia, including in the United States and Europe.

Where we disclose personal information to overseas recipients, we will take reasonable steps to ensure that the recipient handles it in a manner consistent with the APPs, or that an exception under the Privacy Act applies.

8. How long we keep your personal information

Where you use certain free in-browser Tools, any answers saved in your browser’s local storage are held on your device rather than by us. We do not control the retention of that information in the same way as information stored on our servers, and you can clear it through your browser settings.

Where you use the Verification Toolkit or a Paid Tool, we store the information you enter and the Documents you generate. You can export a copy of that information, and delete it, at any time through your account.

We retain that information for up to 60 days from the date of your last activity, after which it is deleted. Before deletion, we will send you an email prompting you to download your information.

We otherwise retain personal information only for as long as reasonably necessary for the purposes set out in this privacy policy, or as required by law, after which we will take reasonable steps to destroy or de-identify it in accordance with the APPs.

Tax invoices and related purchase and payment records are retained for the period required by taxation and other laws (generally five years), regardless of the 60-day deletion described above or the closure of your account.

Account information and toolkit access records may be retained beyond the 60-day deletion period described above where reasonably necessary for our business, legal, accounting and tax purposes.

We retain feedback, ratings, comments and survey responses for as long as reasonably necessary for the purposes described in this privacy policy, including improving our Tools and, where you have consented to publication, displaying comments on our Website, unless you ask us to remove them and we are required, or reasonably able, to do so.

9. Security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our systems are password protected and we use a range of administrative and technical measures to protect them. However, no method of transmission or storage is completely secure, and we cannot guarantee the absolute security of your personal information.

10. Links

Our Website and the Tools may contain links to third party websites, including those of our service providers. Those links are provided for convenience only. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing personal information to them.

11. Accessing and correcting your personal information

You may request access to the personal information we hold about you, or ask us to correct it, by contacting us using the details below. We may need to verify your identity before responding. In some cases we may be unable to provide access, in which case we will explain why. We will deal with all requests within a reasonable time.

If you use the Verification Toolkit or a Paid Tool, you may also access, export and delete the information stored in your account through your account, where those features are available.

You may also contact us if you would like us to remove a comment that we have published with your consent. We will consider your request and remove the comment where we are required to do so or it is otherwise appropriate.

12. Complaints

If you wish to complain about how we have handled your personal information, please contact us using the details below, including your name and contact details. We will investigate your complaint and respond within a reasonable time.

If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

13. Children

The Tools and Website are intended for use by businesses and their personnel, and are not directed at children. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have collected personal information from a child, please contact us and we will take reasonable steps to delete it.

14. Changes to this privacy policy

We may update this privacy policy from time to time. The current version will always be available on our Website, and material changes will take effect when the updated policy is posted.

15. Contact us

For further information about this privacy policy or our privacy practices, or to access or correct your personal information or make a complaint, please contact us using the details below:

Name: Paperbark Privacy Officer
Email: support@paperbarkndis.com.au