This
Privacy Policy describes how Harvest Digital Planning Pty Ltd
(“Harvest”, “we”, “us” or “our”) (ABN: 12 148 958 927) collects,
protects, discloses, stores and uses your personal information through
its provision of online software applications and other digital products
(the “Software”) and services (together, the “Services”).
Our
Software is operated by an external operator (the “Operator”) who
licences the Software from Harvest and may, from time to time, collect
information for various reasons outlined in their Privacy Policy,
Privacy Statement, or any other applicable Agreement. You should check
these documents and ensure you are comfortable with how the Operator
will collect and handle your personal information.
This Privacy Policy has been prepared to take into account the following privacy laws:
- Australia
- Privacy Act 1988 (Cth) (“Privacy Act") and the Australian Privacy
Principles (“APPs"). See Appendix 1 for Privacy Act and APP specific
provisions.
- Canada - The Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA).
- European Union - General Data Protection Regulation 2016/679 (“GDPR”). See Appendix 2 for GDPR specific provisions.
- New Zealand - Privacy Act 1993.
If
the Operator is a government entity or located in another jurisdiction,
we may also contractually agree to comply with additional privacy laws.
What information is collected?
Personal Information
Customers:
In
providing its Services, the type of personal information collected by
Harvest may include (but may not be limited to) the following types of
information, when this information is shared:
- Your name
- Email address
- Phone number
- The organisation you work for
- Your job title
- Your preferences and opinions with respect to the Services
- Details
of the Services requested by you and provided to you and Harvest’s
response to you, including with respect to any support requests
- Any feedback you provide to Harvest, including in any feedback surveys
- Your IP address
- Other unique ID numbers
- Any other personal information requested by Harvest and/or provided to Harvest by you or by a third party.
Users of our Services:
The
Operator may collect a range of personal information from you when you
use our Services (whether as a staff admin user for the Operator or as a
visitor to the Operator’s website), depending on their specific
requirements and needs. Personal information may be collected in a range
of ways including through a registration process or through various
activities and interactions on the site.
The type of personal
information collected will vary between Operators and may include (but
may not be limited to) the following types of information, when this
information is shared:
- Your name
- Email address
- Username
- Profile picture
- Phone number
- Your IP address
- User-agent string
- Other unique ID numbers
- Social network account IDs
- Physical address, postcode, or other locational attributes
- Demographic information such as age, gender, etc.
- Information about your preferences
- Your
recorded thoughts, ideas, opinions, etc. as expressed by you. This may
include sensitive information if you provide political opinions.
You will need to check the Privacy Policy of the Operator to confirm what personal information is collected.
Where
an Operator collects your personal information, this personal
information may also be collected and accessed by Harvest in fulfilling
our duties and responsibilities to the Operator and to internally
analyse and improve our Services and Software.
Cookie Policy
Our
websites use cookies to record and log data. We use both session-based
and persistent cookies, dependent upon how you use or interact with our
websites.
Cookies are small data files sent by us to your
computer, or from your computer or mobile device to us each time you
visit our website. They are unique to you or your web browser.
Session-based cookies last only while your browser is open and are
automatically deleted when you close your browser. Persistent cookies
last until you or your browser delete them, or until they expire.
When
you use one of our websites, we may use technologies such as cookies to
store information about your visit. If you have provided us with
personal information, cookies may be associated with this information.
We
use this information to better understand how people use our websites,
to improve our products, to ensure that we give you the best experience
we can, to detect fraud or abuse and to help our customers learn about
which engagements and content most matter to their communities.
If
you do not wish to have cookies enabled, or wish to be notified of
their use, most modern browsers will allow you to adjust this in the
settings. Please note that disabling the use of cookies on our software
may result in restricted/impacted functionality, and you may not be able
to take full advantage of the service.
We use the following categories of cookies on our sites:
Necessary cookies
These
cookies are essential to enable you to browse around our websites and
use its features. Without these cookies, functionality related to
certain tools and accessing secure areas of the site could not be
provided.
Preferences cookies
Also known as
“functionality cookies,” these cookies allow a website to remember the
choices you have made in the past, like what language you prefer or what
your username and password is so that you can automatically log in next
time.
Statistical cookies
Also known as
“performance cookies,” these cookies collect information about how you
use a website, like which pages you visited and which links you clicked
on. The purpose of this information is to help understand how users are
engaging with the website and to improve website functions.
Operators
may also use cookies on our Software. Operators are responsible for
notifying you of the cookies they use and how you can control which
cookies are enabled.
Links
This Privacy Policy does not
apply to third party websites or digital services which may be linked to
content published by either Harvest or the Operator. We recommend you
read the privacy statement of the relevant service when you access these
third party sites.
How do we use your information?
Customers:
Harvest may use information it collects (personal or otherwise) in order to:
- provide our Services to you
- allow you to access our Software
- send you updates and information where you have consented or would reasonably expect to receive them
- respond to your enquiries
- to request your feedback
- maintain our licenced Software
- for internal record keeping, administrative, invoicing and billing purposes
- detect and rectify fraud or other behavior that violates any terms of use
- comply with our contractual or legal obligations and resolve any disputes that we may have
- conduct de-identified research, analytics and business development
- improve our Services, Software and our website
- if otherwise required or authorised by law
Users of our Services:
Harvest may access and use the information collected by the Operator (personal or otherwise) in order to:
- allow you to access our Software
- respond to your enquiries
- maintain our licenced Software
- detect and rectify fraud or other behaviour that violates any terms of use
- respond to service requests from the Operator
- comply with our contractual or legal obligations and resolve any disputes that we may have
- monitor sites to ensure adequate safety and security
- conduct de-identified research, analytics and business development
- improve our Software and services
- if otherwise required or authorised by law
How do we protect your information?
Harvest
takes the privacy of your information very seriously, and we use
industry standard practices to keep your data safe and secure.
How do we disclose your personal information?
Customers:
In providing the Services, our Software and our website Harvest may disclose your personal information to:
- our third party helpdesk management provider for customer support tickets
- our third party email management system to send email updates and notifications
- our employees, contractors and/or related entities
- our existing or potential agents or business partners
- anyone to whom our business or assets (or any part of them) are, or may (in good faith) be, transferred
- credit
reporting agencies, courts, tribunals and regulatory authorities, in
the event you fail to pay for goods or services we have provided to you
- courts,
tribunals, regulatory authorities and law enforcement officers, as
required by law, in connection with any actual or prospective legal
proceedings, or in order to establish, exercise or defend our legal
rights
- any other third parties as required or permitted by law, such as where we receive a subpoena
Users of our Services:
In providing the Services and our website, Harvest may disclose your personal information to:
- our third party email management system to send email updates and notifications
- our third party authentication and authorisation provider for our Software, if enabled
- other
third party service providers for the management of security, fraud
detection, internal logs, basemaps and geocoding services, content
moderators, graphic providers, web mapping tools and software which
allows for the functionality of a browser
- Social media sites when you choose to share content or authenticate your user account through them
- any other third parties as required or permitted by law, such as where we receive a subpoena
Contact us
To contact us about our Privacy Policy, compliance with any
applicable privacy laws, or to modify or delete your personal data, please email our Privacy Officer at: info@harvestdp.com
The Privacy Officer will review all
messages received and respond to each message upon due consideration. We
may require further information to respond to your message, or may
refer you to the Operator when appropriate.
Changes to this Policy
We
reserve the right to modify this policy from time to time, at our sole
discretion. If we make a material change to the Privacy Policy we will
notify you and the modified policy shall be effective once we notify you
of the change. If we do not make any material amendments then we will
post the modified policy on our website and it shall be effective once
posted. We recommend that you regularly check our website to make sure
you are aware of our most up-to-date policy.
Appendix 1 – The Privacy Act and the APPs
The
Privacy Act and the APPs set out the core requirements for the
protection of personal information in Australia. Please read the Privacy
Policy above and this Appendix carefully and contact us at the details
at the end of the Privacy Policy if you have any questions
How do I access, change or delete my personal information?
In
some cases you may be able to access and correct your personal
information by logging into your account (if the Software provides this
functionality), where you can update your personal details.
You
may also request a copy of, changes to, or deletion of, the personal information we
hold, and we will act on this request within a reasonable period of time
unless we are legally permitted to refuse to do so, in which case we
will provide you with details of our refusal in writing.
Before acting on your request we may be contractually required to provide notification to or seek the consent of the Operator.
Harvest will endeavour to respond to your request or inquiry within 30 days.
How do I make a complaint?
If
you wish to make a complaint, please contact us using the details in
the contact section above and provide us with full details of the
complaint. We will promptly investigate your complaint and respond to
you, in writing, setting out the outcome of our investigation and the
steps we will take in response to your complaint. If you are not
satisfied with our response you also have the right to contact the
Office of the Australian Information Commissioner.
Will my personal information be transferred overseas?
Where
we disclose your personal information to third parties in our Privacy
Policy, these third parties may store, transfer or access personal
information outside of Australia, including but not limited to the
United States of America and the Philippines.
We will only
disclose your personal information to countries with laws which protect
your personal information in a way which is substantially similar to the
Australian Privacy Principles or we will take such steps as are
reasonable in the circumstances to ensure the third party protects your
personal information in accordance with the Australian Privacy
Principles.
Appendix 2 – The GDPR
Under the GDPR
individuals located in the EU have extra rights which apply to their
personal information. Personal information under the GDPR is often
referred to as personal data and is defined as information relating to
an identified or identifiable natural person (individual). This Appendix
sets out the additional rights we give to individuals located in the EU
when we sign a GDPR compliant data processing agreement with an
Operator, including how we process personal information lawfully,
transparently and fairly. Please read the Privacy Policy above and this
Appendix carefully and contact us at the details at the end of the
Privacy Policy if you have any questions.
What personal information is relevant?
This
Appendix applies to the personal information set out in the Privacy
Policy above where we sign a GDPR compliant data processing agreement
with an Operator. This includes any sensitive information also listed in
the Privacy Policy above which is known as ‘special categories of data’
under the GDPR.
Our commitment to you
Your personal information will:
- be processed lawfully, fairly and in a transparent manner by us;
- only
be collected for the specific purposes we have identified in the
‘collection and use of personal information’ clause above and personal
information will not be further processed in a manner that is
incompatible with the purposes we have identified;
- be collected
in a way that is adequate, relevant and limited to what is necessary in
relation to the purpose for which the personal information is processed;
- be kept up to date, where it is possible and within our
control to do so (please let us know if you would like us to rectify any
of your personal information);
- be kept in a form which permits
us to identify you, but only for so long as necessary for the purposes
for which the personal information was collected or required by an
applicable controller; and
- be processed securely and in a way
that protects against unauthorised or unlawful processing and against
accidental loss, destruction or damage.
How do we process personal information?
If
the GDPR applies and we act as a controller, we must have a legal basis
to process your personal information. We will process your personal
information in accordance with the following legal bases:
- Legitimate
interests: We will process your personal information for our legitimate
interests to allow you to access and use our website, to send you
marketing content we think may be of interest to you, to contact you if
you leave your contact details with us or if you otherwise initiate
contact with us, to review and improve our Services and for our internal
business purposes.
- Performing a contract: We will rely on
performing a contract to process your personal information where we are
preparing to enter into a contract with you or we are carrying out our
obligations under a contract with you, including where you have entered
into a contract with us for our Services or the licensing of our
Software.
- Legal obligation: We will rely on a legal obligation
to process your personal information where we are subject to a legal
obligation, including to respond to any illegal activity and for
taxation purposes.
- Consent: If we need to rely on consent, we
will ask for consent to process any of your personal information for
that specific purpose before we process your personal information for
that purpose.
Upon written request, we may provide you with
a list of the third parties we use to process your personal information
and the locations of those third parties.
Data retention
If the GDPR applies or we have signed a GDPR compliant data processing agreement, and we act as a processor:
We
will only retain your personal information in accordance with the
controller’s instructions and we will delete or return your personal
information to the controller in accordance with the terms of the
applicable data processing agreement.
If the GDPR applies and we act as a controller:
We
will only retain your personal information for as long as necessary to
fulfil the purposes we collected it for, including for the purposes of
satisfying any legal, accounting, or reporting requirements.
To
determine the appropriate retention period for personal information, we
consider the amount, nature, and sensitivity of the personal
information, the potential risk of harm from unauthorised use or
disclosure of your personal information, the purposes for which we
process your personal information, whether we can achieve those purposes
through other means and the applicable legal requirements.
In
some circumstances you can ask us to delete your data: see ‘access,
erasure and data portability’ below for further information.
In
some circumstances we may anonymise your personal information (so that
it can no longer be associated with you) for analytics, research or
statistical purposes in which case we may use this anonymised
information indefinitely without further notice to you.
Data transfers
The
countries to which we send data for the purposes listed above may not
have the same data protection laws as the country in which you initially
provided the information. If we transfer your personal information to
third parties in other countries:
- we will perform those
transfers in accordance with the requirements of the GDPR (for example,
by using the Standard Contractual Clauses as a safeguard); and
- we will protect the transferred personal information in accordance with the Privacy Policy, as supplemented by this Appendix.
Countries to which we may transfer personal data include Australia, the Philippines and the United States of America.
Extra rights for EU individuals
Objecting to processing:
You
have the right to object to processing of your personal information
that is based on our legitimate interests or public interest. If this is
done, we must provide compelling legitimate grounds for the processing
which overrides your interests, rights and freedoms, in order to proceed
with the processing of your personal information.
Restricting processing:
You have the right to request that we restrict the processing of your personal information if:
- you are concerned about the accuracy of your personal information
- you believe your personal information has been unlawfully processed
- you need us to maintain the personal information solely for the purpose of a legal claim
- we are in the process of considering your objection in relation to processing on the basis of legitimate interests
Access, erasure and data portability:
You
may have the right to request details of the personal information we
hold about you, or to request that we erase the personal information we
hold about you, or that we transfer this information to a third party.
Rectification:
If
you believe that any information we hold about you is inaccurate, out
of date, incomplete, irrelevant or misleading, please contact us using
the details below. We will take reasonable steps to promptly correct any
information found to be inaccurate, incomplete, misleading or out of
date.
Note that if we are acting as a processor of your personal
information, before acting on a rights request we will need to seek the
instructions of the relevant Operator.
If the GDPR applies and we
act as a controller of your personal information, we will endeavour to
respond to your request or inquiry within 30 days.
How do I make a complaint?
If
you wish to make a complaint, please contact us using the details in
the contact section above and provide us with full details of the
complaint. We will promptly investigate your complaint and respond to
you, in writing, setting out the outcome of our investigation and the
steps we will take in response to your complaint. If you are not
satisfied with our response you also have the right to contact the
relevant EU supervisory authority.
