Privacy Policy.

1. Who we are and what this policy covers

1.1 We are Sentoro Technologies Pty Ltd ACN 700 852 688, ABN 81 700 852 688, an Australian company. Sentoro, we, us and our mean that company; You and your mean the person reading this policy, or the organisation you read it for.

1.2 This policy explains how we handle Personal Information: in the Privacy Act 1988 (Cth) sense, information or an opinion about an identified or reasonably identifiable individual, whether or not true and whether or not recorded in a material form. Where the EU GDPR or the UK GDPR applies, it also means "personal data" under those laws.

1.3 This is a single policy for the whole group. It covers three Sites and two Platforms:

1.4 It also covers what we do off the Sites: answering email to hello@sentorotech.com.au, onboarding and support, marketing, dealing with suppliers and advisers, and recruiting.

1.5 This policy does not cover:

(a) websites, apps and services run by other people, including any Third Party Service a Customer connects to a Platform (for example Xero, Stripe, DocRaptor or a supplier catalogue feed), which have their own privacy policies; or

(b) how a Customer handles Personal Information in its own business. If you are a customer, subcontractor, tenant or site contact of a business that uses Deployr, that business decides what it collects about you and why. See clause 2.

2. Our two different roles — please read this part

2.1 We handle Personal Information in two ways, and your rights differ in each.

(a) Information we decide about — we are the controller. Our own business information: website analytics, enquiries, marketing contacts, our Customers' account and billing details, the login and support records of Users and Seat holders, and job applications. We decide why we collect it and what we do with it, and this policy applies to it directly.

(b) Information a Customer puts into a Platform — we are the processor. Customer Data is all data, content, files and records a Customer or its Users input into, or generate through, a Platform. We hold it on the Customer's behalf and under the Customer's instructions, do not decide what goes in, and do not use it for our own purposes.

2.2 Why this matters most in Deployr. A single job record can contain the end customer's name, the site address, a contact mobile number, gate and alarm access instructions, a key safe code, photographs of the site, technician notes, and a signature on completion. The contractor is the organisation responsible for it under the Privacy Act; we are the service provider that stores and processes it.

2.3 What that means in practice. If you are the end customer of a business that uses Deployr and want to see, correct or delete what is held about you, contact that business first. We will help them respond, but are generally not permitted to alter or release their records on our own initiative. See clause 13.

2.4 We are still an APP entity. Being a processor does not put us outside the Privacy Act. We remain bound by the Australian Privacy Principles for the Personal Information we hold, including the obligation to keep it secure (APP 11) and to limit use and disclosure (APP 6), and by the Notifiable Data Breaches scheme.

2.4A The small business threshold, and why we do not rely on it. The Privacy Act exempts some businesses with an annual turnover of $3 million or less. We do not run this business on that exemption, for two reasons. First, we hold tax file numbers on our Customers' behalf, and they are separately regulated by the Privacy (Tax File Number) Rule 2015, which applies regardless of the turnover threshold. Second, we provide a service in connection with Personal Information, one of the circumstances in which the exemption does not apply. Where the exemption would otherwise be available, the mechanism we use to be bound anyway is an opt-in to coverage by the Australian Privacy Principles under section 6EA of the Privacy Act.

[OWNER TO CONFIRM: whether Sentoro is above or below the small business turnover threshold, and — if the exemption would otherwise apply — to make and register the s 6EA choice with the Information Commissioner before this policy is published. This clause must not claim an opt-in that has not been made.]

2.5 The DPA is the detail. The terms governing our processing of Customer Data — instructions, confidentiality, security measures, sub-processors, international transfers, breach notification, audit, and what happens at the end — are in the Sentoro Data Processing Addendum (data-processing-addendum.md), part of the Agreement. Where this policy and the DPA differ on Customer Data, the DPA governs the relationship with the Customer.

2.6 Kelvin is different in degree. Kelvin project data is mostly technical: refrigerants, loads, pipe runs, equipment selections and the equipment data a Customer's own users upload. It holds less Personal Information than Deployr, but still carries names, job titles, email addresses, client and project identifiers and site locations, and Kelvin reports are often addressed to a named person.

3. Open and transparent management of Personal Information (APP 1)

3.1 We take reasonable steps to handle Personal Information openly and transparently: maintaining this policy, keeping our practices and systems aligned with it, and training the people who work on our Platforms.

3.2 Getting this policy in another form. It is published free of charge at https://sentorotech.com.au/privacy. If you would like it in another form — a plain text file, a PDF, a large-print version, or read to you over the phone — email hello@sentorotech.com.au, addressed to The Privacy Officer. We will provide it in a reasonable form free of charge.

3.3 Anonymity and pseudonymity (APP 2). You can visit sentorotech.com.au without telling us who you are, and email us under a pseudonym, though we may not be able to help with an account or billing question unless we can verify who you are. Using a Platform requires a named account: audit trails, licensing, invoicing and compliance records attach to identified people, so anonymity and pseudonymity are not practicable there.

4. What Personal Information we collect

4.1 What we collect depends on how you deal with us.

4.2 Visitors to sentorotech.com.au

Our company website is built on Next.js and hosted on Vercel, with no accounts, forms, sign-up, payments or user-generated content.

An IP address can be Personal Information, and is personal data under the GDPR and UK GDPR. We do not use IP addresses from this site to identify individuals or build profiles. Our Cookie and Tracking Notice (cookie-notice.md) sets out the cookies and similar technologies used across the Sites, including the strictly necessary cookies the Platforms need to keep you signed in.

4.3 People who email hello@sentorotech.com.au

If you email us we receive your name, email address, anything you put in the message or an attachment, your signature block, and the email's technical headers. We keep the correspondence to answer you and to have a record of what was said.

4.4 Prospects and marketing contacts

If you ask for a demo, join a waitlist, subscribe to updates, hand us a card at an industry event, or apply for the Deployr Founding 10 or Kelvin Founding 25 programmes, we collect your name, business name, role, email address, business phone number if you give it, the trade or discipline you work in, and your dealings with us (what you asked about, what we sent, whether you opened it, whether you unsubscribed). We may also record publicly available business information about your organisation: website, industry and location.

4.5 Customers, and their Users and Seat holders

For the organisation that subscribes, and for each individual authorised to use a Platform:

4.6 Portal Users

A Portal User is a customer or subcontractor of a Deployr Customer given limited, free-of-charge portal access to Deployr — the Customer's own customers and subcontractors, not ours. The terms of portal access are in the Portal Terms (portal-terms.md).

We collect the name, email address, business name, position, contact details and permissions the Customer supplies or the Portal User enters, the portal login, last sign-in and access records, and every action the Portal User takes in the portal — quotes viewed, jobs accepted, documents uploaded, approvals given.

Quote acceptance records. Where a Portal User accepts a quote electronically, through the portal or a public quote page, we record the name given, a signature image, the date and time, the IP address and the browser user agent. Those five things are captured together and retained as evidence of acceptance.

The Customer invites you, not us. We hold Portal User information on the Customer's behalf under clause 2.1(b). If you want to stop having portal access, ask the business that invited you.

4.7 Job and site data inside Deployr

A Deployr job or site record maintained by a Customer commonly contains, about that Customer's own end customers and the people at their sites:

• names, business names, job titles and roles;
• site addresses, unit and tenancy numbers, and location notes;
• contact phone numbers, mobile numbers and email addresses;
• site access and security details — gate codes, key safe codes, alarm codes and disarm procedures, induction requirements, parking and loading instructions, after-hours contacts;
• asset and equipment registers, serial numbers and service histories tied to a location;
• job notes, technician field notes, time and attendance records against a job;
• photographs and video taken on site, which may show people, vehicles, registration plates and building interiors;
• signatures captured on completion, and the name of the person who signed;
• quotes, purchase orders, invoices and payment records; and
• compliance records, certificates, test results and safety documentation.

Site access and security details are not "sensitive information" as the Privacy Act defines that term, but they are practically the most sensitive things in the system, and we treat them accordingly.

Records the Customer holds about its own staff, technicians and subcontractors — including payroll and bank details — are a separate category, described in clause 4.11.

Offline copies on field devices. Deployr's field application works without signal. When a User downloads an offline pack, a copy of the job, customer, site, asset, price and document data that User needs is stored on the device, including the site access and security details listed above — gate codes, key safe codes and alarm codes.

Two things follow:

(a) The offline copy is not separately encrypted on the device. It depends on the device's own protection. Signing out of the field application deletes it, along with the field preferences stored with it.

(b) The Customer should enforce device protection. A Customer whose technicians carry site access codes on a phone should require a screen lock and full device encryption on every field device, and be able to wipe a lost or stolen device remotely. That control is the Customer's, not ours. See clause 11.3 and the AUP.

4.8 Kelvin project data

Kelvin holds project and calculation data: client and project names, site or facility locations, the name and contact details of the engineer or contact the work is done for, refrigerant and cycle inputs, equipment selections made against the equipment data the Customer's own users upload and maintain — we do not ship manufacturer catalogue data — energy and cost analyses, and the reports generated from all of that. Kelvin reports are server-rendered PDFs produced with the help of DocRaptor, and usually carry the name of the practitioner who prepared them and the client.

4.9 Job applicants

If you apply to work with us, we collect your application, CV, cover letter, work history, qualifications and licences, right-to-work information, interview notes, referee details and what your referees tell us. We keep unsuccessful applications for a reasonable period in case a similar role opens, unless you ask us not to. Open item: our recruitment privacy practices, including retention and any use of a recruitment platform, are not yet settled — see the Open items at the end of this policy.

4.10 Sensitive information

4.10.1 We do not seek sensitive information. Sensitive information under the Privacy Act includes health information and information about racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs, trade union or professional association membership, sexual orientation, criminal record, and biometric and genetic information. None of it is needed to run a trade operations platform or an engineering calculation platform, and none of our forms, fields or sign-up flows ask for it.

4.10.2 The realistic edge case. Deployr is used by people doing physical work on real sites, and three things can pick up sensitive information incidentally even though nobody intended it:

(a) Field notes — a technician writes "customer's wife has a heart condition, keep noise down in the morning", or "site contact is on light duties after surgery";

(b) Site photographs — a photo of a plant room catches a person in frame, or a photo taken to document a fault also shows a medical device, a mobility aid, a religious object or a union notice; and

(c) Incident and safety records — an injury report, a near-miss record, a first aid entry or a fitness-for-work note necessarily records health information about the person involved.

4.10.3 How this is handled.

(a) The information belongs to the Customer, not to us. It is Customer Data. The Customer decides what its people record, and is the organisation that must have a lawful basis for collecting it — which, for incident and safety records, will usually be its obligations under Work Health and Safety laws.

(b) Our Acceptable Use Policy and our onboarding guidance tell Customers not to record sensitive information in Deployr unless they need it for a genuine work purpose and they have the consent or legal authority the Privacy Act requires. Clause 3.3 of the AUP sets out the restricted data categories, and clause 3.4 sets out the rules for photographs and site imaging.

(c) We apply the same security controls to this material as to all other Customer Data, and we do not separate it out for any additional use.

(d) We do not use field notes, photographs or incident records to train or improve machine-learning models in identifiable form. See clause 6.6.

(e) If you believe sensitive information about you has been recorded in a Platform and should not have been, tell the business that recorded it, and tell us at hello@sentorotech.com.au. We will work with that business to have it dealt with.

4.10.4 Government identifiers (APP 9). We do not adopt a government-related identifier — a tax file number, Medicare number, driver licence number or the like — as our own identifier for an individual. Customers sometimes record trade licence numbers (for example an Australian Refrigerant Handling Licence, or an electrical or gas licence) against a User or a technician because the work requires it. Where that happens, the licence number is Customer Data used for that Customer's own compliance purposes, and it is not used by us to identify anyone.

4.10.5 Tax file numbers — a specific regime, and we hold them. Deployr's payroll features hold tax file numbers for a Customer's employees. Tax file numbers are not just Personal Information; they are additionally regulated by the Privacy (Tax File Number) Rule 2015, which applies to us regardless of the small business turnover threshold in the Privacy Act. See clause 2.4A.

(a) We hold tax file numbers only on a Customer's behalf, as Customer Data under clause 2.1(b).

(b) We use them only to operate Deployr's payroll features and the Xero payroll integration. We do not use them for any other purpose, we do not use them to identify or match individuals, and we do not adopt them as our own identifier for anyone.

(c) We do not disclose a tax file number except to the Customer's own Xero organisation, on that Customer's instruction, or where the law requires it.

(d) Tax file numbers are encrypted at rest in the way clause 11.1A describes, and are readable only by the organisation's administrators and the individual concerned.

(e) A Customer that records a tax file number is responsible for having collected it lawfully — in practice, through a TFN declaration made by its own employee.

4.11 Staff, payroll and subcontractor records inside Deployr

4.11.1 A Deployr Customer runs its own workforce in the product, so Deployr holds records about the Customer's own employees, technicians and subcontractors, entered by the Customer. All of it is Customer Data under clause 2.1(b).

4.11.2 Staff and technician records commonly contain name, date of birth, home address, phone number, personal and work email addresses, emergency contacts, employment type, payroll identifier, pay and charge rates, rosters, hours and timesheets, leave records, trade and driver licence numbers and scanned licence documents, qualifications and certifications, home base coordinates, and performance and disciplinary notes.

4.11.3 Staff tax and payroll details. For an employee whose payroll the Customer runs in Deployr, we hold on the Customer's behalf:

(a) tax file number and the contents of the employee's TFN declaration;

(b) residency status for tax purposes and study and training support loan status;

(c) superannuation fund and superannuation member number; and

(d) bank BSB and bank account number for the payment of wages.

Tax file numbers are subject to the additional rules in clause 4.10.5, and the four identifiers listed in clause 11.1A are encrypted at rest as that clause describes.

4.11.4 Subcontractor records commonly contain business details, ABN and ACN, contact names and details, trade licences, insurance policies and the policy documents, workers compensation declarations, agreed rates, bank BSB and account number for payment, and performance ratings and comments recorded by the Customer.

4.11.5 Subcontractor and company bank details are not encrypted at rest in the way payroll identifiers are. They are protected by access control, and copies persist inside stored onboarding-pack records. Clause 11.1A states this precisely.

4.12 Location — we do not track technicians

4.12.1 Deployr does not track technicians' locations. The application does not read GPS from any device: no location history, breadcrumb trail, geofence or vehicle telemetry, and we do not collect the data needed to build them.

4.12.2 Two kinds of location data do exist. Both are entered manually by the Customer, and both are current-state only rather than a history:

(a) site coordinates, so a site can be shown on the dispatch map; and

(b) a technician's home base coordinates, used to plan a route.

4.12.3 The concession that makes this credible. Job progress is recorded as a status change — travelling, on site, paused, completed — with a timestamp. That is a record of the work, not a position, but a status timestamp combined with the site's address can still indicate where a named person was and when, and that record is retained.

4.12.4 Kelvin records site or facility locations as project data. It reads no device location either.

5. How we collect Personal Information

5.1 Directly from you. When you email us, ask for a demo, sign up, subscribe, pay an invoice, raise a support ticket, attend onboarding, or type information into a Platform.

5.2 From your organisation. If your employer subscribes, it gives us your name, work email address and role to create your account, and may set your permissions, reset your access and see your activity in the audit trail.

5.3 From a Customer, about you. A business you deal with may enter your details in Deployr as an end customer, a site contact, a Portal User, an employee or a subcontractor. That information comes from the business, not from you.

Who gives you the APP 5 notice. Where we collect Personal Information about you from someone else, and you may not be aware we hold it, we rely on the contracting business to give you the notice APP 5 requires — an express obligation of the Customer under the AUP. Clause 13.8 sets out what we will do if you come to us first.

5.4 From Third Party Services. Where a Customer connects one, information flows between it and the Platform under the Customer's instruction:

Each Third Party Service has its own privacy policy and terms. Connecting one is the Customer's decision, and we are not responsible for what the service then does with the information. See MSA clause 8.

5.5 Automatically. Server logs, analytics, security logs, usage telemetry, audit trails and error reports are generated as you use the Sites and the Platforms.

5.6 From publicly available sources. For prospects and marketing contacts, we may use publicly available business information such as a company website, industry directory listing or public professional profile.

5.7 Collecting only what we need (APP 3). We collect Personal Information only where reasonably necessary for one or more of our functions or activities, and sensitive information only with consent and where reasonably necessary, or where an exception in the Privacy Act applies. Where reasonable and practicable, we collect it from you rather than from someone else.

5.8 Unsolicited information (APP 4). Where we receive Personal Information we did not ask for, we decide within a reasonable period whether we could have collected it under APP 3. If not, and it is not in a Commonwealth record and no law or court order requires us to keep it, we destroy or de-identify it as soon as practicable, provided that is lawful and reasonable.

6. Why we use Personal Information, and our lawful bases

6.1 Under APP 6 we use and disclose Personal Information for the primary purpose we collected it for, for a related secondary purpose you would reasonably expect (for sensitive information, a directly related purpose you would reasonably expect), with your consent, or where the Privacy Act otherwise permits or requires it.

6.2 Because Kelvin is sold globally, the table below also states the lawful basis we rely on under the EU GDPR and the UK GDPR. Where neither applies, clause 6.1 is the operative analysis.

6.3 Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests, rights and freedoms, and will provide the balancing reasoning on request. Where we rely on consent, you can withdraw it at any time — see clause 15.

6.4 We do not sell Personal Information, and we do not disclose it to anyone for their own direct marketing.

6.5 Product improvement

We look at how the Platforms are used so we can make them better. This runs on usage telemetry, error logs and performance data, not on the contents of a Customer's job records.

6.6 Machine learning and model training — our position

6.6.1 The position is this.

6.6.2 We do not use Customer Data in identifiable form to train or improve machine-learning models — not job records, end customers' details, site access instructions, field notes, photographs, project files or Engineering Outputs.

6.6.3 We do not use one Customer's data to build or improve anything for the benefit of that Customer's competitor.

6.6.4 What we may use. We may use aggregated and de-identified information — from which individuals and individual businesses are not reasonably identifiable and cannot reasonably be re-identified — to develop and improve features, benchmarks, defaults and models. De-identification happens before the data is used, and we do not attempt to re-identify it.

6.6.5 Feedback is different. If you tell us how to improve a Platform, we can use that freely. See MSA clause 11.

6.6.6 Third party AI services. Deployr includes AI-assisted features. When a User invokes one, the content needed to answer the request — which can include customer and site names, personnel names, job notes, and the contents of a document or file the User supplied — is sent to our AI provider, Anthropic, listed in the Sub-processor list (sub-processors.md). The provider processes that content to return a result to the User. It is not used to train the provider's models, and we do not send Customer Data to any AI or machine-learning provider for model training.

6.6.7 AI features are off unless you turn them on. AI assistance is opt-in, switched off for every organisation until an administrator of that organisation turns it on. While it is off, no content is sent to the AI provider. An administrator can switch it back off at any time, and the switch applies to the whole organisation rather than to one User.

6.6.8 AI output must be checked. AI-assisted features are assistive only. Their output is not advice, a professional opinion or a compliance determination, and must be reviewed by a competent person before it is relied on or sent to anyone else. Where the output touches an engineering matter, clause 14 of the MSA and engineering-disclaimer.md apply to it in full.

6.6.9 Verified on 18 September 2026. The AI provider, Anthropic, deletes inputs and outputs within 30 days, except content flagged under its usage policy (up to 2 years) and trust-and-safety classification scores (up to 7 years), and it is contractually prohibited from training on the content we send. Its storage is in the United States; its model inference is routed globally by default and is not pinned by us. A non-tabular file, such as a PDF supplier invoice or catalogue, is transmitted in full, up to 20 MB; a spreadsheet is not, because only the first few sample rows are sent and the rest is mapped locally. These features are Deployr only, and are off unless the Customer's administrator turns them on.

7. Automated decision-making

7.1 What the law requires. The Privacy and Other Legislation Amendment Act 2024 (Cth) requires privacy policies to disclose the use of computer programs to make, or to do a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect the rights or interests of an individual. That obligation applies from December 2026. The same Act introduced a statutory tort for serious invasions of privacy, in force from 10 June 2025.

7.2 Our position today. We do not use computer programs to make decisions that significantly affect an individual's rights or interests, and we do not carry out profiling producing legal or similarly significant effects within the meaning of Article 22 of the GDPR and the UK GDPR.

7.3 What our automation actually does. The Platforms are full of automated processing, but it is operational, not decisional about people:

7.4 If a Customer builds its own automated decisions. A Customer can use Deployr's data and API to run its own automated decision-making. That is the Customer's decision, made with its own data, and the Customer is responsible for disclosing it and complying with the law that applies.

7.5 Open item. Before December 2026 we must review every automated process in both Platforms against the new disclosure threshold and update this clause with the specific disclosures the amended Act requires — including the kinds of Personal Information used and the kinds of decisions made. That review has not yet been done.

8. Direct marketing and the Spam Act

8.1 We send marketing about Deployr and Kelvin to businesses and the people who run them, in compliance with APP 7 and the Spam Act 2003 (Cth).

8.2 Consent. We send commercial electronic messages only where you have given express consent or where consent can be reasonably inferred from an existing business relationship and your conspicuously published business address. We do not buy marketing lists and we do not use address-harvesting software.

8.3 Identification. Every commercial electronic message we send identifies Sentoro as the sender by name. Section 17 of the Spam Act also expects accurate sender contact details, and at the date of this draft the footer carries the sender's name only — not our ABN or a postal address, because no registered office address has been settled. Either the footer gains those details before we send marketing, or this clause claims less than it does now.

[SENDER FOOTER — OWNER TO ADD ABN 81 700 852 688 AND A POSTAL ADDRESS TO THE MARKETING EMAIL FOOTER BEFORE ANY COMMERCIAL ELECTRONIC MESSAGE IS SENT, OR AMEND THIS CLAUSE.]

8.4 Unsubscribe. Where we send a marketing email, it will carry a working unsubscribe link. The facility is built: per-recipient links, the one-click unsubscribe control your mail program offers (RFC 8058), and a deliberate refusal to act on a mere page request. The link stays functional for at least 30 days after the message is sent, unsubscribing costs you no more than the ordinary cost of sending a message, and we action it within five business days — usually immediately.

Being accurate about today. At the date of this draft no message is sent through the marketing path; everything the Platforms currently send is transactional. This clause describes what you will get if and when Sentoro's own marketing starts sending through that facility.

You can unsubscribe at any time by emailing hello@sentorotech.com.au with "unsubscribe" in the subject line, and we will action it the same way.

8.5 Opting out of marketing without losing service messages. Unsubscribing from marketing does not stop the messages we have to send you to run your account. The difference:

8.6 If you close your account, the service messages stop too, apart from anything we are legally required to send.

8.7 Telling us where you got it. If you want to know where we got your contact details, ask and we will tell you, unless that is impracticable or unreasonable. We will not charge you for asking.

8.8 Sensitive information is never used for direct marketing, and we do not use Customer Data to market to a Customer's end customers. If you are the end customer of a contractor who uses Deployr, you will not hear from us because of that.

8.9 Two different unsubscribes — whose list are you on? There are two separate suppression scopes, and they do not talk to each other:

The second scope is per organisation. Unsubscribing from one contractor does not unsubscribe you from another contractor who also uses Deployr: they are different senders. A Contractor's marketing may only be sent from that organisation's own verified sending domain. If a contractor keeps sending after you unsubscribe, that is a matter for them under the Spam Act and the AUP, though you can tell us at hello@sentorotech.com.au and we will follow it up.

9. Who we disclose Personal Information to

9.1 Sub-processors and service providers. Third parties host, run, secure and support the Sites and the Platforms. They may access Personal Information to do that work, and no more. The Sub-processor list (sub-processors.md) names each one, what it does and where it processes data. Where they process Customer Data, the terms the DPA requires bind them. The main ones, and what each receives:

9.2 Third Party Services the Customer connects. Where a Customer connects Xero, Stripe, DocRaptor or a supplier catalogue feed, information flows to it at the Customer's direction. See clause 5.4 and MSA clause 8.

9.3 Within the Customer's own organisation. A Customer's administrators can see the accounts, permissions, activity and audit trail of its Users and Portal Users.

9.4 Professional advisers. Our lawyers, accountants, auditors, insurers and bankers, where they need it and under a duty of confidence.

9.5 A sale or restructure of our business. If we sell or restructure all or part of our business, Personal Information may be disclosed to the buyer and its advisers for due diligence and the transfer. We will require the recipient to keep it confidential, use it only to assess and complete the transaction, and — if it completes — handle it consistently with this policy.

9.6 Law enforcement, regulators and courts. We may disclose Personal Information where we are required or authorised by law, by a court or tribunal order, or by a binding regulator request, and where an exception in APP 6.2 applies. Where we receive a request for Customer Data we will, unless legally prohibited, notify the Customer so it can respond or object, and we will push back on requests that are overbroad or not properly made. The DPA sets out the detail.

9.7 We keep a record. Where we disclose Personal Information other than in the ordinary operation of a Platform, we record what was disclosed, to whom, and why.

10. Sending information overseas (APP 8)

10.1 The honest position: yes, some processing happens outside Australia. Some of our providers, and some of the regions they run in, are not in Australia. Kelvin is sold globally and has users and data outside Australia by design.

10.2 Where the two Platforms are hosted — both in Australia. This is the fact that matters most, so it goes first:

10.2A The Design & Calcs link stays in Australia. Deployr's Design & Calcs workflow sends engineering requests to Kelvin, and completed selections flow back to the quote or job. Where a Customer uses that link, engineering request data — which can include the Customer's name and ABN, a site name, address and coordinates, job and asset details, and the name and email address of the requesting technician and the assigned engineer — moves between two Platforms that are both hosted in Sydney, Australia. Deployr and Kelvin are two products of the same company, so this is not a disclosure to a third party, and because both Platforms are hosted onshore it is not an overseas disclosure either.

10.2B Other overseas recipients. [VERIFIED 18 SEPTEMBER 2026] Both hosting regions are in Australia. Outside Australia, our providers process in:

(a) the United States — Vercel, Resend, DocRaptor and Stripe, Anthropic's storage, and Supabase's own company and support operations, whichever region a project is hosted in. Resend stores all message content, delivery logs and account records there whatever sending region is chosen, and DocRaptor does not publish its region at all, so we record the United States on the strength of its incorporation, governing law and transfer certifications;

(b) Ireland — Stripe also processes in the EU;

(c) Europe — the OpenStreetMap Foundation, which receives a site address when Deployr turns it into map coordinates. That request is made from the User's own browser; and

(d) any country Anthropic operates in — its documentation names the United States, Europe, Asia and Australia. Anthropic stores data at rest in the United States, but routes model inference globally by default, and we have not pinned it to one country. We have chosen to disclose that rather than describe a narrower position than the one we actually occupy. This affects Deployr only, and only where a Customer's administrator has turned AI-assisted features on; clause 6.6 sets out what is sent.

DocRaptor is our only PDF renderer. The authoritative, current list is the Sub-processor list (sub-processors.md), which states each sub-processor's role and processing locations, and it governs if it differs from this clause.

10.3 What APP 8.1 requires of us. Before we disclose Personal Information to an overseas recipient, we must take steps that are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles. And under section 16C of the Privacy Act, if that overseas recipient then does something with the information that would have breached the APPs had we done it, we are treated as having breached the APPs ourselves. In other words, we stay on the hook. The steps we take include:

(a) contracting with each overseas provider on terms that require APP-equivalent handling, security, confidentiality, breach notification and deletion or return at the end;

(b) choosing Australian processing regions where a provider offers one and it is practicable;

(c) assessing each provider before we engage it, and again when its role changes; and

(d) putting GDPR and UK GDPR transfer mechanisms in place where those laws apply — Standard Contractual Clauses for the EU, and the UK International Data Transfer Agreement or the UK Addendum to the SCCs for the UK, together with a transfer risk assessment.

10.4 Consent-based transfer under APP 8.2(b) — and what it would cost you. The Privacy Act allows an organisation to skip the APP 8.1 obligation if the individual consents to the overseas disclosure after being expressly informed that, if they consent, APP 8.1 will not apply. If you gave that consent, we would no longer be required to take reasonable steps to ensure the overseas recipient complies with the APPs, and would not be accountable under section 16C for what that recipient did with your information. Your practical ability to seek redress under the Privacy Act for the recipient's conduct would be significantly reduced.

10.5 So we do not run our business on APP 8.2(b) consent. We rely on the reasonable steps in clause 10.3 and remain accountable under section 16C. If we ever ask for consent under APP 8.2(b) for a specific disclosure, we will say so clearly, explain the consequence again at the time, and give you a real choice.

10.6 Data location for Customer Data. The current hosting regions are those stated in clause 10.2: Deployr in Sydney, Australia and Kelvin in Sydney, Australia. Whether we offer any commitment to keep Customer Data in a particular region is addressed in the DPA and the Order Form, not here. A Customer that needs one should raise it before it subscribes.

11. Security, and what happens if something goes wrong (APP 11)

11.1 What we do. We take reasonable steps to protect Personal Information from misuse, interference and loss, and from unauthorised access, modification and disclosure:

• data is encrypted in transit using TLS, and encrypted at rest at the storage layer by our infrastructure providers. A specific set of payroll identifiers is additionally encrypted at the column level — see clause 11.1A;
• access to production systems is restricted to the people who need it, authenticated individually, and protected by multi-factor authentication;
• access within the Platforms is controlled by role and permission, and significant actions are written to an audit trail;
• passwords are stored as salted hashes, never in plain text, and we never see or store full card numbers — Stripe handles payment instruments;
• API access uses scoped keys that can be revoked;
• we patch and update our software and dependencies, and monitor for known vulnerabilities;
• we take backups and test that they restore;
• we choose sub-processors with security practices appropriate to what they hold, and bind them contractually; and
• we destroy or de-identify Personal Information when we no longer need it (clause 12).

11.1A Encryption of payroll identifiers — the exact scope

11.1A.1 This clause states the scope precisely rather than generously.

11.1A.2 What is encrypted. Exactly four columns of Deployr employee payroll data are encrypted at rest at the column level:

(a) tax file number;

(b) bank BSB;

(c) bank account number; and

(d) superannuation member number.

The real values are held in a separate restricted store and only a mask is left in the ordinary payroll record. The encryption key is held in Supabase Vault, outside the database, so a database dump contains ciphertext and no key.

11.1A.3 Who can decrypt. Decryption honours the access rule that already applied to those fields: the organisation's administrators, and the technician themselves. Everyone else, including other staff in the same organisation, sees only the mask.

11.1A.4 What is not encrypted. Subcontractor and company bank details are not encrypted at rest at the column level. They are protected by access control only, as are the copies of bank details that persist inside stored onboarding-pack records.

11.1A.5 Nothing here should be read as a general claim that bank details are encrypted. The accurate summary is: employee payroll identifiers are encrypted at rest with a key held outside the database; subcontractor and company bank details are protected by access control, not encryption.

11.2 What we do not claim. We do not hold ISO 27001 certification, a SOC 2 report, or any other security certification, and we have not had an independent security audit. If that changes we will say so here, and name the standard and the auditor. No system is perfectly secure, and we cannot guarantee that Personal Information will never be accessed or disclosed without authorisation.

11.3 Your part. Keep your credentials to yourself, turn on multi-factor authentication, remove Users who leave, revoke API keys you are not using, and think before putting information into a job record that does not need to be there.

If your people work offline, this part is yours. The offline pack described in clause 4.7 is not separately encrypted on the device, so require a screen lock and full device encryption on every field device, keep the ability to wipe a lost or stolen device remotely, and tell your technicians to sign out when a device leaves their control.

11.4 Notifiable Data Breaches

11.4.1 The Notifiable Data Breaches scheme in Part IIIC of the Privacy Act applies to us.

11.4.2 If we suspect a data breach, we start an assessment straight away and complete it within 30 days, as the Act requires.

11.4.3 If the breach is an eligible data breach — unauthorised access to, unauthorised disclosure of, or loss of Personal Information, and a reasonable person would conclude it is likely to result in serious harm to any of the individuals involved, and we cannot prevent that harm through remedial action — then as soon as practicable we will:

(a) prepare a statement for the Office of the Australian Information Commissioner (OAIC) describing the breach, the kinds of information involved, and what affected individuals should do; and

(b) notify the affected individuals, or if that is not practicable, publish the statement and take reasonable steps to publicise it.

11.4.4 If the breach involves Customer Data, the Customer has the primary relationship to the affected individuals. We will notify the Customer without undue delay after becoming aware, give it the information it reasonably needs to meet its own obligations under the Privacy Act, the GDPR or the UK GDPR, and cooperate with its response. The DPA sets out the timeframes and the information we will provide. We will not notify a Customer's end customers directly without coordinating with the Customer, unless the law requires it.

11.4.5 Where the GDPR or UK GDPR applies, we will also meet the notification obligations under those laws, including notifying a supervisory authority within 72 hours where we are the controller and the breach is notifiable, and assisting a Customer controller to do the same.

11.4.6 If you think there has been a breach affecting you, tell us at hello@sentorotech.com.au.

12. How long we keep Personal Information

12.1 The principle. We keep Personal Information only as long as we need it for the purpose we collected it, or as long as the law requires, whichever is longer. When we no longer need it, we destroy or de-identify it, provided that is lawful and reasonable.

12.2 The legal minimums we do have to meet include the seven-year record-keeping obligations for financial records under the Corporations Act 2001 (Cth) and the record-keeping obligations under Australian tax law. Records relevant to a dispute, an investigation or a legal claim are kept until the matter and any appeal period is finished.

12.3 The specific periods — a schedule by category. [VERIFIED AGAINST BOTH PRODUCTS, 18 SEPTEMBER 2026] Each row below states what the products actually do, read from the code rather than chosen as a policy. Where a row says data is kept for the life of the account, that is because nothing deletes it on a schedule today, and we would rather say so than state a period we do not keep. Clause 12.1 and the statutory minimums in clause 12.2 continue to govern.

12.4 Customer Data after a subscription ends. This is set by the Agreement, not by this policy:

(a) During the Subscription Term, the Customer controls its own data and can export it.

(b) After the Subscription Term ends, the Customer has the export window set out in MSA clause 7 and MSA clause 10 to retrieve its Customer Data. Do not rely on our copy as your archive — export it.

(c) After that window closes, we delete or de-identify Customer Data under MSA clause 7 and the DPA, except where the law requires us to keep it, and except for data already aggregated and de-identified so that no individual or business is reasonably identifiable.

(d) Backups are on their own rotation cycle and are overwritten in the ordinary course. Data deleted from the live system may persist in an encrypted backup until that cycle completes, and remains protected and subject to deletion obligations until it does.

(e) If the Customer asks us to delete Customer Data earlier, we will, subject to our legal obligations and the DPA.

12.5 Our own business records — enquiries, marketing contacts, support history, account and billing records — are kept while they are useful and then destroyed or de-identified under clause 12.1.

13. Access and correction (APP 12 and APP 13)

13.1 Access. You can ask for access to the Personal Information we hold about you. Email hello@sentorotech.com.au, addressed to The Privacy Officer, and tell us what you want. We will need to be satisfied about who you are first.

13.2 Our response times.

13.3 Cost. We do not charge for making a request. We may charge a reasonable cost-based fee for giving access, and will tell you the amount before we incur it.

13.4 How we give access. In the way you ask for, if it is reasonable and practicable — a copy by email, an export file, or an inspection. If we cannot, we will work out another way with you.

13.5 When we may refuse access. The Privacy Act lets us refuse in defined circumstances, and we rely on them only where they genuinely apply. They include where giving access would:

(a) pose a serious threat to the life, health or safety of any individual, or to public health or public safety;

(b) have an unreasonable impact on the privacy of other people — a job record about you may also contain information about a technician, a subcontractor or another site contact;

(c) relate to existing or anticipated legal proceedings between us and you, and not be discoverable in those proceedings;

(d) be unlawful, or would prejudice an investigation of suspected unlawful activity or serious misconduct, or an enforcement body's activities; or

(e) reveal our commercially sensitive evaluative information in connection with a commercially sensitive decision-making process.

If we refuse, we will tell you in writing, give our reasons except where that would be unreasonable, explain how to complain, and where we can, give you the information another way — by redacting the parts that affect someone else, or through a mutually agreed intermediary.

13.6 Correction. If information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, ask us and we will correct it. Many things you can fix yourself in your account settings. If we have disclosed the incorrect information to someone else, you can ask us to tell them, and we will, unless that is impracticable or unlawful.

13.7 If we refuse to correct, we will tell you in writing with our reasons and how to complain, and if you ask, attach a statement to the record that you consider the information inaccurate, out of date, incomplete, irrelevant or misleading, and take reasonable steps to make it apparent to anyone who reads the record.

13.8 If your information is inside a Customer's data — please start with the Customer. If you are an end customer, a site contact, a Portal User or a subcontractor of a business that uses Deployr, we hold your information on that business's behalf. The business can see it, correct it and delete it. We usually cannot lawfully change or release it without that business's instruction, and going to them will be faster.

(a) Contact the business you dealt with first.

(b) If you do not know who holds your information, or the business will not respond, contact us at hello@sentorotech.com.au. We will tell you what we can, refer your request to the relevant Customer and ask them to respond, and if you are still stuck, explain your options — including the OAIC.

(c) If the Customer instructs us to correct or delete the information, we will do it.

13.9 If you work for a Customer, your employer's administrators can see and manage your account information and your activity. Requests about your employment records are best directed to your employer.

14. Children and young people

14.1 Deployr and Kelvin are business tools, sold to businesses rather than consumers and not directed at children. We do not knowingly collect Personal Information from children through the Sites.

14.1A The Kelvin education programme is restricted to adults. Kelvin offers a free Professional Seat to verified students and educators. That programme is limited to tertiary institutions — universities, TAFE and registered training organisations — and individual participants must be 18 or over. Secondary schools are not eligible, and we do not enrol school students. The terms are in the Education Programme Terms (education-programme-terms.md). The restriction is deliberate: it keeps the programme clear of the GDPR Article 8 consent rules for children and of the UK Age Appropriate Design Code.

14.2 Apprentices and trainees. In the trades, apprentices start young, and some Users of Deployr will be under 18. That is a legitimate and expected use of the product.

(a) Where a User is under 18, their employer — the Customer — creates the account, authorises the access and is responsible for the User's use of the Platform under MSA clause 6.

(b) We assess capacity to consent individually where consent is the basis for something. A young person aged 15 or over will usually have the capacity to consent to routine handling of their own information; below that, or where capacity is in doubt, a parent or guardian should be involved. Where a Customer creates an account for a young User in connection with their employment, the Customer should ensure any consent required has been obtained.

(c) We do not direct marketing at people we know to be under 18.

(d) If you are a parent or guardian with a concern about a young person's information in one of our Platforms, contact us at hello@sentorotech.com.au and we will work with you and the employer.

14.3 Where the GDPR or UK GDPR applies and we rely on consent for an information society service, the digital age of consent is 16 in the EU (lower in some member states, to a minimum of 13) and 13 in the UK. Our Platforms are contracted for by businesses, not individual children, so this should not arise.

15. If you are outside Australia — the EU, the UK, California, New Zealand and Canada

15.1 Kelvin is sold globally and Deployr may be used by organisations with people overseas. Where the EU GDPR or the UK GDPR applies, you have the rights below in addition to your rights under the Privacy Act. Clauses 15.7 to 15.10 deal with California, New Zealand, Canada and everywhere else.

15.2 How to exercise them. Email hello@sentorotech.com.au, addressed to The Privacy Officer. We respond within one month, extendable by up to two further months for complex or numerous requests, in which case we will tell you within the first month and explain why. We do not charge, unless a request is manifestly unfounded or excessive.

15.3 If we are the processor. Where your personal data sits inside Customer Data, the Customer is the controller: send your request there. If you send it to us, we will refer it and assist them to respond, as the DPA requires — we will not act on it unilaterally.

15.4 International transfers. See clause 10. Where we transfer personal data out of the EEA or the UK, we use Standard Contractual Clauses, or the UK International Data Transfer Agreement or the UK Addendum, with a transfer risk assessment. Australia has no EU adequacy decision, and we do not claim one.

15.5 European representative and data protection officer — we have appointed neither. Both questions become live only when there is a first customer in the European Union or the United Kingdom; Kelvin has none today. They are held with the Data Processing Addendum, and need European counsel rather than a guess.

[EU ARTICLE 27 REPRESENTATIVE — NOT APPOINTED. OWNER TO DECIDE WHETHER ONE IS REQUIRED AND, IF SO, APPOINT AND INSERT DETAILS.]

[UK ARTICLE 27 REPRESENTATIVE — NOT APPOINTED. OWNER TO DECIDE WHETHER ONE IS REQUIRED AND, IF SO, APPOINT AND INSERT DETAILS.]

[DATA PROTECTION OFFICER — NOT APPOINTED. OWNER TO CONFIRM WHETHER ARTICLE 37 REQUIRES ONE.]

That one is Article 37, not Article 27, and is a separate question from the representative above.

Until a representative is appointed, contact us directly at hello@sentorotech.com.au.

15.6 Australian law governs. This policy, and our handling of Personal Information, are governed by the laws of Queensland, Australia. The Australian Privacy Principles are our baseline everywhere. Where the GDPR or the UK GDPR gives you a right the APPs do not, we honour that right as well.

15.7 California residents (CCPA/CPRA)

15.7.1 If you are a California resident, this clause supplements the rest of this policy.

15.7.2 We do not sell your personal information, and we do not share it for cross-context behavioural advertising. There is no advertising network, no advertising pixel, no tag manager, no session replay and no behavioural advertising partner anywhere in our Sites or our Platforms.

[OWNER TO VERIFY BEFORE PUBLICATION: whether the CCPA "we have not sold or shared personal information in the preceding 12 months" statement can be made. The Kelvin source draft asserts it. It has not been checked against the last 12 months of actual practice for both Platforms and the company site, so it is not asserted here.]

15.7.3 What we collect, and why. The categories of personal information we collect, their sources, why we use them and who receives them are in clauses 4, 5, 6 and 9. In CCPA terms, we collect identifiers, commercial information, internet or network activity information limited to aggregate analytics and security logging, professional and employment-related information, and — inside Customer Data — geolocation at the level of a site address.

15.7.4 Your rights. Subject to verification of your identity, you may:

(a) know what personal information we have collected about you, the sources it came from, the business or commercial purposes we collected it for, and the categories of recipients;

(b) access a copy of it;

(c) correct it where it is inaccurate;

(d) delete it, subject to the exceptions the CCPA allows — including where we need it to complete a transaction, provide a service you asked for, for security and fraud prevention, or to comply with a legal obligation;

(e) limit the use and disclosure of sensitive personal information. We do not collect sensitive personal information for any of the purposes that trigger this right; and

(f) not be discriminated or retaliated against for exercising these rights. We do not offer financial incentives in exchange for personal information, and exercising a right will not change your price, your Plan or the service you receive.

15.7.5 How to make a request. Email hello@sentorotech.com.au, addressed to The Privacy Officer. We will verify who you are first, asking only for what is needed.

15.7.6 Authorised agents. An authorised agent may make a request for you. We will ask for verifiable written permission from you, and may ask you to confirm the agent's authority directly.

15.7.7 Appeals. If we deny your request, our decision will say why. You can appeal by replying to that decision, and a different person will review it and respond in writing.

15.7.8 Where we are a service provider — go to the Customer. All Customer Data is personal information we handle as a service provider under a Customer's instructions and for no purpose of our own. If your request concerns information inside a Customer's records, send it to that Customer. If you send it to us, we will refer it and help them respond. We will not act on it unilaterally.

15.8 New Zealand

15.8.1 Where the Privacy Act 2020 (NZ) applies, we handle Personal Information in accordance with the Information Privacy Principles in that Act.

15.8.2 You can ask for access and correction using the process in clause 13. If you are not satisfied, you can complain to the Office of the Privacy Commissioner (New Zealand) at https://www.privacy.org.nz.

15.9 Canada

15.9.1 Where the Personal Information Protection and Electronic Documents Act (PIPEDA), or a provincial law declared substantially similar to it, applies, we handle Personal Information in accordance with its principles.

15.9.2 You can ask for access and correction using the process in clause 13. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca, or the relevant provincial commissioner.

15.10 Everywhere else

15.10.1 Where the law that applies to you gives you broader rights than this policy describes, those rights apply and we will honour them. The Australian Privacy Principles are our baseline, not our ceiling.

15.10.2 If you think a local law gives you a right we have not described, tell us at hello@sentorotech.com.au and we will deal with the request on its merits rather than its label.

16. How to complain

16.1 Come to us first. If you think we have mishandled your Personal Information or breached the Australian Privacy Principles, tell us. Email hello@sentorotech.com.au, addressed to The Privacy Officer, and include:

(a) your name and how to contact you;

(b) what happened, and when;

(c) which information you think was involved; and

(d) what you would like us to do about it.

16.2 What we will do.

Our response will explain what we found, whether we think we got it wrong, what we are doing about it, and what you can do if you are not satisfied.

16.3 If you are not satisfied — the OAIC. You can complain to the Office of the Australian Information Commissioner. The OAIC can investigate, conciliate between you and us, and make determinations, including that we take action or pay compensation.

16.4 The OAIC normally expects you to complain to us first and allow a reasonable time — usually 30 days — to respond before it accepts a complaint, and a complaint to it must generally be in writing.

16.5 The OAIC's website is https://www.oaic.gov.au, and it publishes current contact details and online complaint forms there. We have not reproduced its phone or postal details here, because they change.

16.6 Regulators outside Australia. If the GDPR or the UK GDPR applies to you, you can also complain to the supervisory authority in the EU member state where you live, work or where the issue arose, or to the UK Information Commissioner's Office at https://ico.org.uk. For New Zealand and Canada, see clauses 15.8 and 15.9. California residents should see clause 15.7.

16.7 The statutory tort. Since 10 June 2025, Australian law has provided a statutory cause of action for serious invasions of privacy. Nothing in this policy limits any right you have under that or any other law.

17. Changes to this policy

17.1 We will update this policy as our business, our products, our sub-processors and the law change. Australian privacy law is being reformed in stages and further changes are expected.

17.2 The current version is always at https://sentorotech.com.au/privacy, with its version number and effective date at the top. Older versions are available on request.

17.3 How we tell you.

17.4 If a material change affects the processing of Customer Data, the notice and objection provisions of the DPA and MSA clause 13 apply in addition to this clause.

17.5 Continuing to use a Site or a Platform after a change takes effect means you accept the updated policy. If you do not accept a material change, your remedy is to stop using the Platform and, as a Customer, to exercise your rights under MSA clause 10.

18. How to contact us

The Privacy Officer Sentoro Technologies Pty Ltd ACN 700 852 688 · ABN 81 700 852 688

We do not publish a phone number. Email is the fastest way to reach us, and gives us both a record of what was said.

Related documents