Privacy Policy

1. Who we are

This policy explains how Supplier Share Holdings Pty Ltd (ACN 702 408 366) ("Supplier Share", "we", "us") handles personal information. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we apply the APPs to all personal information we hold.

2. What we collect

We collect:

• contact and account details: name, work email, phone number, role or job title, the organisation you belong to, and your team role;
• organisation details: organisation name, ABN or ACN, website and contact details (a sole trader's business name or ABN can be personal information);
• sign-in and security records: hashed passwords, authenticator enrolment, sign-in attempts, and the terms and privacy versions you accepted and when;
• organisation activity data: production and emissions figures, results and versions, and a record of what was shared with whom and when;
• records of invitations you send or receive.

3. What we don't collect

We don't collect raw location data such as GPS coordinates or farm boundaries. We don't use analytics or advertising cookies, and we don't sell personal information.

4. How we collect it

We collect personal information directly from you when you request access, accept an invitation, join a team, or use the service. Some comes from your organisation or from an organisation that invites you (for example, your name and email in an invitation). We also record how the service is used for security and audit purposes. A buyer may also enter data about a producer's farm, and the producer's contact details, before the producer joins. The buyer tells us they are authorised to do so. That data is labelled as entered by the buyer and is never treated as the producer's own data. When the producer joins, we tell them and they can review it, take it over or ask us to delete it.

5. Why we collect it

We use personal information to:

• assess access requests and create and manage accounts;
• run the data chain, including showing shared results to the organisations they were shared with;
• send service emails such as confirmations, invitations and password resets;
• keep the service secure, prevent misuse and keep an audit history;
• meet our legal obligations and resolve disputes.

6. Who we disclose it to

A producer's results are shown to a buyer only when that producer explicitly attaches them to that buyer. The buyer sees the producer's organisation name and the shared figures.

We also disclose personal information to service providers who host and run Supplier Share for us, under contracts that require them to protect it, and where the law requires it.

7. Overseas disclosure (APP 8)

We use service providers, including Vercel, Neon and Amazon Web Services, to host and run Supplier Share.

If we use an error-monitoring service, it receives only the type of error, the part of the service where it happened and the time. It does not receive your name, email address, figures or the content of your account.

These providers, or their staff or systems, may store or access personal information outside Australia, including in the United States, to provide hosting, support, security and maintenance. We take reasonable steps to make sure they handle it in line with the Australian Privacy Principles.

We don't send your data to an external calculation service unless you choose to use one. Where a producer uses an external calculation service, the data the producer sends to it is handled under that service's own terms.

8. Security (APP 11)

We take reasonable steps, including technical and organisational measures, to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These include encryption in transit, hashed passwords, authenticator codes, role-based access, rate limits and audit logging.

9. How long we keep it

We keep personal information only as long as we need it for the purposes above or as the law requires. When it is no longer needed, we destroy or de-identify it.

• We keep account contact details while the account is open and for 7 years after it closes, then de-identify them.
• If an invitation isn't accepted, we de-identify the invited email address 7 years after the invitation expires.
• We keep the security and audit log, including any names and email addresses in it, for 7 years. We then remove the description and any names, email addresses or other text from those entries, keeping only the type of event, when it happened and record identifiers.
• We keep results, their versions, share records and activity history until 7 years after the end of the financial year (ending 30 June) in which the share ended or was withdrawn, or the version was replaced, so we can show what was shared, with whom and when, and resolve disputes. We then delete or permanently de-identify them.
• If a producer deletes a result, we keep a minimal record of what was shared, with whom and when, so we can resolve disputes. The buyer sees that the result was deleted but no longer sees its figures. A buyer keeps any copy it has already downloaded.

10. Access and correction

You can ask for access to, or correction of, the personal information we hold about you by emailing contact@suppliershare.com.au (Supplier Share is operated by Supplier Share Holdings Pty Ltd, ACN 702 408 366). You can update most account details yourself under Account, and an Owner or Admin can download the organisation's data. We will respond within a reasonable time, usually 30 days.

11. Complaints

If you think we have breached the APPs, email contact@suppliershare.com.au, quoting Supplier Share Holdings Pty Ltd (ACN 702 408 366). We will acknowledge your complaint and aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

12. Cookies

Supplier Share uses only cookies that are strictly necessary to run the service. They are listed below. Deployed, their names start with __Host-.

13. Changes to this policy

Each version of this policy has a version number. If we change it, we will publish the new version here and ask you to accept it at your next sign-in.

14. Contact

Privacy questions: contact@suppliershare.com.au. Supplier Share is operated by Supplier Share Holdings Pty Ltd (ACN 702 408 366).