Draft for review. Highlighted text is a placeholder to be completed, and this document should be reviewed by an Australian and New Zealand qualified lawyer before it is published.
1. About this policy
This Privacy Policy explains how [BaseLeap legal entity name] (ABN [00 000 000 000]) (BaseLeap, we, us) collects, holds, uses and discloses personal information. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and, for people and businesses in New Zealand, the Privacy Act 2020 (NZ) and its Information Privacy Principles.
Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true.
2. Who this policy applies to, and our two roles
Information we handle for ourselves. This policy applies to personal information we collect for our own purposes about visitors to baseleap.io, people who contact us or ask for a demonstration, people who sign up for a trial, account holders and users of the BaseLeap platform, contacts at our customers, suppliers and partners, and people who apply to work with us.
Information we handle for our customers. Our customers use BaseLeap to run their businesses, and they store information in it about their own staff, workers, candidates, clients and contacts (Customer Data). For Customer Data, the customer decides what is collected and why, and we handle it on their behalf to provide the service, under our Customer Terms. If your information is held in BaseLeap by a business you work for or deal with, that business's privacy policy applies, and you should contact them first. We will help them respond to your request.
3. What we collect
Depending on how you deal with us, we may collect:
- Identity and contact details: your name, job title, business name, email address, phone number and business address.
- Account details: your log-in email, role and permissions, the licences assigned to you, your settings and preferences, and records of when you accepted our terms.
- Billing details: billing contacts, invoices, payment history and the details needed to take payment. Card details, if any, are handled by our payment provider and not stored by us.
- Usage and technical information: log-in times, IP address, browser and device type, pages and features used, error logs, and security and audit logs that record changes made to records.
- Communications: enquiries, support requests, emails, call notes, feedback and survey responses.
- Recruitment information: if you apply to work with us, your application, resume and referee details.
4. Sensitive information
We do not ask for sensitive information about you for our own purposes, such as health information, racial or ethnic origin, or criminal record, and we only collect it with your consent or where the law permits.
Our customers may choose to record sensitive information in Customer Data, for example medical clearances, injury and incident details, drug and alcohol results, or criminal history checks for their workers. We handle that information only on the customer's behalf and instructions, and the customer is responsible for having the consent the law requires.
5. How we collect it
We collect personal information directly from you, for example when you sign up, use the platform, fill in a form, email or call us, or attend an event. We also collect it from other sources, including:
- your employer or organisation, when an administrator invites you to their BaseLeap account;
- our customers, partners and resellers who refer you to us;
- publicly available sources, such as business registers and company websites; and
- our service providers, for example email delivery reports that tell us whether a message bounced.
If you do not give us information we ask for, we may not be able to provide the platform, support or the information you requested.
6. Why we collect, use and hold it
We use personal information to:
- set up and manage accounts, verify identity and control access;
- provide, maintain, secure and support the platform and our professional services;
- bill customers and manage our accounts;
- send service messages, such as invitations, password resets, approvals, security notices and changes to our terms;
- understand how the platform is used so we can fix problems and improve it;
- detect, investigate and prevent fraud, misuse and security incidents;
- tell you about our products, services and events, where the law allows (see section 11);
- consider job applications; and
- comply with our legal obligations and enforce our agreements.
We use and disclose personal information for these purposes, for related purposes you would reasonably expect, with your consent, or as required or authorised by law.
7. Automated decisions and artificial intelligence
We do not use your personal information in computer programs to make decisions about you that could significantly affect your rights or interests.
Our customers can configure automation in BaseLeap, such as workflows, approval routing, validation rules, certificate expiry reminders and compliance status indicators. These run on the customer's instructions and data. If a decision that affects you was made using a customer's configuration, please contact that business.
Customers can choose to connect AI assistants to their BaseLeap data through our read-only MCP server. When they do, information is shared with the AI provider they choose, under that provider's terms. We do not use Customer Data to train artificial intelligence models.
8. Who we disclose it to
We may disclose personal information to:
- service providers who help us run our business and the platform, under contracts that require them to protect it. Our current providers are:
- Supabase: database, authentication, file storage and server functions. Customer Data is stored in its Sydney, Australia region.
- Vercel: hosting and delivery of our website and web application.
- Resend: delivery of emails sent by the platform.
- Google: maps, address lookup and geocoding, and web fonts on our website.
- [Payment provider, once selected]: payment processing.
- our professional advisers, such as lawyers, accountants and auditors;
- our related bodies corporate;
- a purchaser or prospective purchaser of all or part of our business, under confidentiality obligations;
- anyone you or your organisation authorise, such as an integration your administrator enables; and
- government agencies, regulators, courts and law enforcement, where required or authorised by law.
We do not sell personal information.
9. Overseas disclosure
Customer Data and account data are stored primarily in Australia. Some of our service providers, or their support staff, are located in or process data in other countries, mainly the United States, and content delivery networks may cache website content in other locations. Where we disclose personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles and, for New Zealand information, with comparable safeguards to the Privacy Act 2020.
10. Cookies and browser storage
Our public website does not currently use analytics, advertising or tracking cookies. It loads fonts from Google Fonts, which means your browser sends your IP address to Google when it fetches them. Our contact form opens your own email program; it does not send your details to us until you send the email.
The BaseLeap application uses your browser's storage to keep you signed in, remember your preferences, and, for the field app, store work on your device so it can be used without signal until it synchronises. This storage is essential for the application to work. You can clear it in your browser settings, which will sign you out.
If we introduce analytics or similar technologies, we will update this policy first.
11. Marketing and how to opt out
We may send you information about BaseLeap where you have consented or where the law otherwise allows, in line with the Spam Act 2003 (Cth) and the Unsolicited Electronic Messages Act 2007 (NZ). Every marketing email has an unsubscribe link, and you can also ask us to stop at any time using the details in section 17. Service messages about your account, such as security notices and changes to our terms, are not marketing and will still be sent.
12. How we protect it
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification and disclosure. These include:
- encryption of data in transit;
- isolation of each customer's data, enforced by the database on every request;
- role-based access controls and restricted access for field technicians;
- private file storage with signed links that expire;
- audit logs of changes to key records; and
- access by our staff to a customer's account only to provide support or keep the platform secure.
No system is completely secure. Please keep your log-in details confidential and tell us at once if you think your account has been compromised.
If we experience a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, or, in New Zealand, notify the Privacy Commissioner and affected individuals of a notifiable privacy breach, as the law requires. Where the breach affects Customer Data, we will notify the customer so it can meet its own obligations.
13. How long we keep it
We keep personal information for as long as we need it for the purposes in this policy, including to meet legal, tax and accounting requirements and to resolve disputes. Customer Data is kept for as long as the customer's subscription continues and for the period set out in our Customer Terms after it ends. When information is no longer needed, we delete it or de-identify it. Backups are overwritten in the ordinary course.
14. Accessing and correcting your information
You can ask for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details in section 17. We will respond within 30 days, will not charge you for making a request, and may charge a reasonable fee for providing access in some cases. If we refuse a request, we will tell you why in writing and how to complain.
Users can update much of their own account information in the application. If your information is Customer Data held by a business that uses BaseLeap, please make your request to that business.
15. Questions and complaints
If you have a question or complaint about how we handle personal information, please contact our Privacy Officer using the details in section 17. We will acknowledge your complaint promptly and aim to respond within 30 days.
If you are not satisfied with our response, you can contact:
- in Australia, the Office of the Australian Information Commissioner at oaic.gov.au; or
- in New Zealand, the Office of the Privacy Commissioner at privacy.org.nz.
16. Children
BaseLeap is a business service and is not directed at people under 18. We do not knowingly collect personal information from children for our own purposes.
17. Contact us
Privacy Officer, [BaseLeap legal entity name]
Email: info@baseleap.io
Post: [postal address]
18. Changes to this policy
We may update this policy from time to time. The current version is always on this page, with the date it took effect. If a change is significant, we will tell account holders by email or in the application before it takes effect.