Privacy Policy

Brand In Black Pty Ltd (ABN 12 688 388 990) of Level 1/21 Best St, Devonport TAS 7310. Privacy enquiries may be directed to jesse@brandinblack.au or 0447 689 766.

This Policy applies to personal information handled by Brand in Black in connection with its design, web, print, software development, application, hosting, subscription, digital and related services.

Some Brand in Black services are provided to business clients who enter or upload information about their own staff, customers or other individuals. In those circumstances, Brand in Black may process that information on behalf of the business client as part of providing the relevant service.

Depending on the service, we may collect or hold:

• names, email addresses, telephone numbers, business and contact details;
• account, authentication and user-profile information;
• communications, enquiries, quotes, orders, invoices and payment-related records;
• proof approvals, accepted Terms versions, timestamps and technical approval records;
• IP addresses, device, browser, log and security information;
• content, documents and files supplied through our services;
• property, appraisal, transaction or business information entered into client platforms;
• financial information and identification information where a particular client service requires it;
• website, application and service usage information; and
• other personal information reasonably necessary to provide a requested service.
• We do not seek sensitive information unless it is reasonably necessary for an agreed service and lawful to collect. Clients and users should not provide sensitive information unless the relevant service is intended to handle it or Brand in Black has agreed to receive it.

We may collect personal information directly from an individual, from our business clients and their Authorised Users, through websites, applications, forms, communications and transactions, and automatically through technical logs, cookies and similar technologies.

We may handle personal information to:

• provide, host, maintain, secure and support our services;
• prepare quotes, communicate with clients and administer accounts and billing;
• authenticate users and record approvals or acceptance of terms;
• develop, test, improve and troubleshoot websites, software, applications and workflows;
• provide support, respond to enquiries and manage service incidents;
• comply with legal, tax, accounting, security and regulatory obligations;
• protect our systems, clients and users from fraud, misuse and security threats; and
• carry out marketing and analytics where lawful and appropriate.

Some services allow our business clients and their authorised users to enter, upload, store and manage information through websites, applications or platforms hosted or operated by Brand in Black. Depending on the service, this may include names, contact details, addresses, property information, financial information, identification information, transaction information and other information entered by the client or its users.

In these circumstances, Brand in Black generally processes the information for the purpose of providing, hosting, maintaining, securing and supporting the relevant service. The business client is responsible for ensuring it has an appropriate legal basis to collect and provide personal information through the service and for giving any privacy notices or obtaining any consents required for its own collection and use.

Brand in Black may use artificial intelligence tools to assist with software and code development, HTML, automation, image generation, content preparation, workflow efficiency and other supporting functions.

Where personal information is processed using an AI service, we take reasonable steps to limit the information to what is reasonably necessary for the relevant purpose and to manage it consistently with this Policy and applicable law.

We do not intentionally provide sensitive information to an AI provider unless this is reasonably necessary for an agreed service and appropriate privacy arrangements have been considered.

Brand in Black does not currently use AI alone to make decisions that materially affect clients or individuals. Where AI-generated material forms part of a client deliverable, appropriate human review is applied before it is provided or acted upon.

If Brand in Black later arranges for a computer program to use personal information to make a decision that could reasonably be expected to significantly affect an individual's rights or interests, this Policy will be updated to include the information required by applicable privacy law.

We use third-party providers to operate our business and deliver services. Depending on the service, a provider may collect, store, access or otherwise process personal information on our behalf. Providers currently used or available, by category:

• Hosting and infrastructure: Supabase; Vercel; Cloudflare; Sanity; GitHub; Synergy Wholesale
• Payments and finance: Stripe; Xero; Hubdoc
• Email and communications: SMTP2GO; Gmail / Google Workspace; Google Drive
• File storage: Dropbox
• Forms and data collection: Typeform
• Automation and integrations: Make.com; VaultRE; Bitly; Clerk
• AI services: Anthropic (Claude); OpenAI
• Design and production: Adobe Creative Cloud
• E-commerce: Shopify
• Project tools: monday.com
• WordPress plugins and services: Easy Property Listings
• Marketing and analytics: Meta (Facebook / Instagram); Google Analytics
• The particular providers involved will depend on the service. We may add, remove or replace providers as our services change. The current list is our Sub-Processor Register at brandinblack.au/sub-processors.

Some of our third-party providers operate globally or may process or make information accessible outside Australia. Where personal information is likely to be disclosed to an overseas recipient, we will take steps required by applicable privacy law and will maintain information about relevant countries or regions in our Sub-Processor Register where practicable.

Because provider architecture and data locations can change, the Sub-Processor Register should be read with this Policy for current provider and location information. Routing information through overseas infrastructure does not necessarily mean there has been a disclosure to an overseas recipient.

We take reasonable technical and organisational steps appropriate to the nature of the information held to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include access controls, authentication, encryption in transit, provider security controls, logging, software updates and other safeguards appropriate to the service.

No electronic transmission, hosting platform or storage system can be guaranteed to be completely secure.

Brand in Black maintains a data breach response process. If a suspected security incident occurs, we will take reasonable steps to contain and assess it and will comply with applicable notification obligations, including the Notifiable Data Breaches scheme where it applies.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide an ongoing service, or to meet legal, accounting, tax, dispute-management or legitimate record-keeping requirements.

Approval and contractual acceptance records and relevant business or tax records may be retained for up to 7 years where appropriate. Enquiry and quote information that does not lead to an ongoing relationship should be reviewed periodically and deleted or de-identified when no longer reasonably required.

Information stored within a client-hosted application or service will generally be retained while the client continues to use that service. When the service ends, information will be deleted or returned in accordance with the applicable service arrangements, subject to legal, security, backup-cycle and legitimate record-keeping requirements.

An individual may request access to personal information we hold about them or ask us to correct inaccurate information by contacting jesse@brandinblack.au. We may need to verify identity before responding and may refuse or limit access where permitted by law.

If you have a privacy concern or complaint, contact jesse@brandinblack.au. We will review the issue and aim to respond within a reasonable period. If you are not satisfied and the Privacy Act applies, you may be able to complain to the Office of the Australian Information Commissioner.

Our websites and services may use cookies, analytics and similar technologies to operate services, understand usage, improve performance and support marketing. Providers may include Google Analytics and Meta services where enabled. Where required, appropriate notices or consent mechanisms will be used.

We may update this Policy to reflect changes to our services, technology, providers or legal obligations. The current version and effective date will be published with the Policy, and previous versions stay available under their version numbers.