Privacy Policy

This Privacy Policy explains how STA collects, holds, uses and discloses personal information in connection with the EmissionsTracker platform, its modules and related support, sales and website activities.

1. Who we are

Sustainable Transport Advisory Pty Ltd ABN 75 657 423 222 is referred to in this Privacy Policy as STA. Our contact details are [email protected], Newport, Vic 3015, Australia.

2. What this policy applies to

• the EmissionsTracker base platform;
• the EmissionsTracker, WasteMetrics Pro, EcoMarines and MarineSurveyor Pro modules;
• our website, online checkout, customer account administration, billing and support activities; and
• communications between STA, subscription Owners, administrators, authorised users and prospective customers.

3. The kinds of personal information we may collect

• identity and contact details such as names, job titles, organisation names, business addresses, telephone numbers and email addresses;
• account and subscription details such as subscription Owner details, administrators, user names, account IDs, module selections, licence counts and configuration information;
• billing and transaction information such as invoices, payment status, billing contacts and limited payment-related records needed to administer subscriptions;
• support and communications data such as emails, tickets, attachments, meeting notes and troubleshooting information;
• technical and usage information such as IP address, browser type, device identifiers, login history, audit logs, error logs and platform activity records; and
• any personal information contained in customer data uploaded into the platform by the Customer or its users.

4. How we collect personal information

• directly from you when you contact us, request a demonstration, create an account, place an order, purchase a module or licence, request support or otherwise deal with us;
• from the subscription Owner or an administrator who creates or manages user accounts for your organisation;
• automatically through the operation, security and administration of the platform; and
• from publicly available sources or professional contacts where reasonably necessary for sales and business development.

5. Why we collect, use and disclose personal information

• to create, manage and secure accounts and subscriptions;
• to provide the platform, modules, support and customer service;
• to process orders, billing, renewals, licence changes and account administration;
• to maintain, monitor, protect and improve the performance, reliability and security of the platform;
• to communicate with Customers and users about service matters, incidents, maintenance, renewals and product updates;
• to comply with legal obligations, resolve disputes, enforce our agreements and protect our lawful interests; and
• to conduct limited marketing and relationship management activities where permitted by law.

6. Disclosure of personal information

STA may disclose personal information to:

(a) our hosting and infrastructure provider, DigitalOcean, for the purpose of hosting and operating the Platform;

(b) Stripe, for the purpose of processing payments, subscriptions, renewals, chargebacks, refunds where applicable, fraud screening and payment administration;

(c) our professional advisers, including lawyers, accountants, auditors and insurers;

(d) regulators, courts, law enforcement bodies or government agencies where required or authorised by law; and

(e) any person or entity to whom disclosure is reasonably necessary in connection with a sale, merger, restructure or transfer of all or part of STA’s business or assets.

7. Data hosting and overseas disclosure

STA Hosting and storage

The Platform is hosted using DigitalOcean cloud infrastructure in Australia. STA currently stores Platform data in DigitalOcean’s Australia data centre region, presently located in Sydney, New South Wales, unless otherwise notified by STA. STA takes reasonable steps to store and protect personal information using technical and organisational safeguards designed to reduce the risk of misuse, interference, loss, unauthorised access, modification or disclosure.
STA seeks to store Platform data in Australia where practicable. However, some personal information may be disclosed to or processed by overseas recipients in connection with payment processing and related services. In particular, Stripe and its affiliates may process, store or transfer personal information outside Australia, including in the United States and other jurisdictions in which Stripe or its service providers operate. By using the Platform and making payments through it, you acknowledge that your personal information may be disclosed to overseas recipients for these purposes. STA will take reasonable steps to ensure that any such disclosure is handled in accordance with applicable privacy laws.

8. Security

• STA uses reasonable administrative, technical and physical safeguards designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
• Access to platform data is limited to persons with a business need to know and is subject to role-based access controls where available.
• Customers are responsible for managing user access, maintaining password security and ensuring that only authorised users are given access to their subscription.

9. Data breach response

If STA becomes aware of a data breach affecting personal information, STA will investigate and respond in accordance with applicable law and its internal incident response procedures. Where required, STA will notify affected individuals and the Office of the Australian Information Commissioner.

10. Retention and deletion

How long we keep information In plain English, this means STA only keeps information for as long as it reasonably needs it for business, legal, security and support purposes. Unless a longer period is required or permitted by law:

• (a) customer account and subscription data is generally retained for the life of the customer relationship and for up to 90 days after the relevant subscription ends;
• (b) backup data may be retained for up to 180 days before being overwritten or deleted in the ordinary course;
• (c) payment, invoicing and tax records may be retained for up to 7 years;
• (d) support records may be retained for up to 2 years after closure; and
• (e) security and access logs may be retained for up to 12 months. STA may retain information for longer where required for legal, regulatory, dispute resolution, fraud prevention or enforcement purposes.

The following standard retention approach applies unless a longer period is required by law or a different period is agreed in writing:

11. Access and correction

You may request access to personal information that STA holds about you, or ask us to correct information that is inaccurate, incomplete or out of date, by contacting us at [email protected]. STA may need to verify identity and may refuse a request where permitted by law.

12. Complaints

If you have a privacy complaint, please contact STA at [email protected] with full details. STA will review the complaint and respond within a reasonable time. If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner.

13. Direct marketing

STA may send business-related updates, service announcements or marketing communications where permitted by law. You may opt out of non-essential marketing communications at any time using the unsubscribe option or by contacting STA.

14. Changes to this policy

STA may update this Privacy Policy from time to time. The current version should be published on the STA website or otherwise made available to Customers. Material changes take effect when published unless a later date is stated.

15. Changes to this policy

Payments and payment processing
STA uses Stripe as its third-party payment processor for online subscription purchases, renewals and related payment transactions. When you make a payment through the Platform, payment card details and certain related payment information, such as cardholder name, billing address, email address, transaction amount, transaction date, payment status, and fraud-prevention information, may be collected and processed by Stripe on STA’s behalf. STA does not store full payment card numbers or CVV/CVC security codes on its own systems. Payment information processed by Stripe is subject to Stripe’s own terms, privacy practices and security controls.

16. Contact us