Privacy Policy

Your privacy, plainly explained

“Code Squirrel” is a trading name of The Trustee for Capital S Trust, ABN 71 286 302 771. We build custom software, mobile apps, websites and AI solutions for Australian businesses, from our home base in Brisbane, Queensland.

This policy explains how we collect, hold, use and disclose personal information, and how you can ask to see or correct the information we hold about you, or make a complaint. We are covered by the Privacy Act 1988 (Cth) and handle personal information in accordance with the Australian Privacy Principles (APPs).

We wrote this policy ourselves and keep it short on purpose. If anything here is unclear, email us and we’ll explain it in plain English.

The two hats we wear

Most of this policy is about personal information we collect for our business – our clients, the people we deal with, and visitors to our website.

Separately, we build and maintain software that our clients use to run their own businesses. Where our clients’ apps and systems hold personal information about their customers, staff or users, our client decides what happens to that data and we handle it only on our client’s instructions under our services agreement. That data is covered by our client’s own privacy policy and our contract with them, not by this policy. If you are an end user of software we built for a client, please contact that client about your data.

1. Who this policy covers

This policy covers personal information we handle about:

• our clients and the people who work with us on projects,
• people who visit our website, contact us, or book a consultation,
• job applicants and candidates,
• contractors and suppliers,
• our own team – to the extent the Privacy Act requires, noting some records about current and former employees may fall under the Act’s employee records provisions.

2. The personal information we collect

We collect only what we need. Depending on how you deal with us, that includes:

• Clients and project contacts: name, company, role, email, phone, project requirements and correspondence, and payment/billing details needed to invoice and be paid.
• Website visitors and enquiries: what you type into our forms (name, company, phone, email, message), live-chat transcripts, and information about how our website is used (see section 4, Cookies and similar technologies).
• Job applicants: application, résumé, referee details, and interview notes.
• Contractors and suppliers: contact details, ABN, and bank details for payment.
• Event and social media interactions: comments, photos or videos at events we attend or sponsor.

We don’t collect payment card numbers through our website, and we don’t sell your personal information to anyone.

3. Sensitive information

Sensitive information (like health information, or information about racial origin, religion or criminal record) has stricter rules under the Privacy Act. We don’t normally ask for it. If we do need it, we’ll collect it only with your consent and where it is reasonably necessary for a specific purpose, unless the law requires or allows us to collect it without your consent. Please don’t volunteer sensitive information about yourself or others in our contact forms.

4. How we collect personal information

We collect most of it directly from you – when you fill in a form, email or phone us, chat with us, attend an event, or work with us on a project. Sometimes we collect it from someone else, such as a referee you nominate.

Cookies and similar technologies. Our website and marketing tools use:

• Google Tag Manager / Google Analytics – to understand how the site is used,
• HubSpot – customer relationship and email management,
• Meta (Facebook/Instagram) Pixel and LinkedIn Insight Tag – to measure and improve advertising, including showing relevant ads to people who have visited our site,
• Crisp – the live-chat feature, which records chat content,
• Google reCAPTCHA – to block spam in our forms.

These tools may collect your IP address, browser and device information, and pages viewed, and their providers may process that information in the United States and other countries (see section 8). You can turn most of this off:

• clear or block cookies in your browser settings (some site features may stop working),
• opt out of Google Analytics with Google’s browser add-on (tools.google.com/dlpage/gaoptout),
• manage Google ads personalisation at myadsettings.google.com,
• manage Meta advertising at www.facebook.com/ads/settings and LinkedIn ads at www.linkedin.com/settings.

We don’t use tracking technologies to identify individual visitors by name.

5. Why we collect, use and disclose it

We collect, hold, use and disclose personal information to:

• provide, quote for, deliver, support and maintain our software, app, website and AI services,
• communicate with you about enquiries, projects and support,
• send you an occasional newsletter or event invitation, if you’ve asked for them or we reasonably think you’d like them (see below),
• recruit our team and pay our contractors and suppliers,
• meet our legal, tax and accounting obligations, and
• protect our rights, safety and systems, including responding to incidents.

We may also use or disclose your information for another purpose that is related to the primary purpose and that you would reasonably expect (directly related, for sensitive information), or where the law requires or allows us to.

Marketing. Marketing emails include an unsubscribe link, and you can ask us at any time to stop; we’ll stop, in line with the Spam Act 2003 (Cth). We keep records of your consent.

6. Who we share it with

We disclose personal information to the service providers that help us run the business – our email and productivity platform (Google Workspace), our CRM (HubSpot), our project tools (Jira and Confluence), payment processors, and our accountant and professional advisers – and to the systems described in section 8. We don’t sell your personal information.

Because part of our development team works offshore in the Philippines (section 8), project information including contact details and correspondence is shared with them so they can do the work.

We also disclose personal information where the law requires or authorises us to, such as to police under a valid warrant or to our insurers after a security incident.

7. How we hold and protect it

We hold personal information in Google Workspace (email, files, calendar), HubSpot (customer relationships and marketing), Jira and Confluence (project and delivery records), and our internal systems, which we host ourselves on our own equipment in a secure commercial data centre (NextDC) in Brisbane.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include individual named logins with single sign-on and multi-factor authentication on every system that supports it, access limited to the people who need it for their work, physical security at our data centre, secure development and deployment practices, and confidentiality obligations on our team and contractors.

If we suffer a data breach that is likely to result in serious harm, we respond under our data breach response plan and, where required by the Notifiable Data Breaches scheme, notify the affected individuals and the OAIC.

8. Sending information overseas

Yes, we do this, and we’d rather say it plainly:

• Where we store things: our internal systems are hosted on our own equipment in Brisbane. Personal information on our own systems stays in Australia.
• Our team in the Philippines: some members of our development, QA and support team work from the Philippines and access project information – names, contact details, correspondence and project content – as needed to deliver your project.
• Cloud and marketing services: Google Workspace, HubSpot, Atlassian (Jira and Confluence) and our advertising tools (Meta, LinkedIn, Crisp, Google) may store or process information in the United States and other countries.

Before we disclose personal information to an overseas recipient, we take reasonable steps to ensure the recipient does not act in a way that is inconsistent with the APPs, including written confidentiality and privacy obligations in our agreements with our Philippines team and our service providers.

9. How long we keep it, and when we destroy it

We keep personal information only for as long as we need it for the purposes described in this policy, or as long as we are required to keep it by law – for example, tax law requires us to keep financial records for seven years. When personal information is no longer needed for any purpose and no law requires us to keep it, we take reasonable steps to destroy it or de-identify it so it can no longer identify you.

10. Decisions made by computer programs

We’re an AI shop and we use AI inside our own business, so rather than bury this, here’s exactly how:

• Where computer programs are involved: AI tools help us triage and route inbound enquiries, support tickets, phone calls and live chats, and they help organise and surface information in our CRM. In practice that means an AI helps decide which team your enquiry goes to, roughly how urgent it looks, and what context our people see first.
• The personal information those programs use: what you’ve told us – your name and contact details, and the content of your enquiry, ticket, call or chat – together with your existing history with us in our CRM.
• What they don’t decide: decisions that could significantly affect you are made by people, not programs. Hiring and team decisions are made entirely by humans, and decisions like whether we take you on as a client are ours, not a machine’s.
• If you think an AI-assisted routing got it wrong – your enquiry went to the wrong queue, or was treated as less urgent than it should have been – email [email protected] and a person will pick it up. You can always ask us to explain how a decision about you was made and to reconsider it.

Where software we build for clients makes automated decisions about their users, those are the client’s business and covered by the client’s own privacy policy – see “The two hats we wear” above. Because this is what we build for a living, we also help our clients think through privacy and automated decision-making before their products go live.

11. Accessing and correcting your information

You can ask to see the personal information we hold about you, and ask us to correct it if you think it is inaccurate, out of date, incomplete, irrelevant or misleading. Email our Privacy Officer at [email protected]; we may need to confirm who you are first.

We’ll acknowledge your request within 7 business days and respond within 30 days. Asking costs nothing, and any charge for giving you access will not be excessive. If we refuse access or a correction, we’ll tell you why in writing (unless it would be unreasonable to do so) and how you can complain. If we won’t correct disputed information, we’ll note your correction on your file.

Where you’re an individual whose data sits in software we run for a client, make the request to that client – we action those requests on their instructions.

12. Making a privacy complaint

If you think we’ve breached the APPs, email our Privacy Officer at [email protected] and tell us what happened and what you’d like to happen. We’ll:

1. acknowledge your complaint within 7 business days,
2. investigate and respond within 30 days (we’ll tell you if we need more time and why), and
3. take steps to fix the problem and prevent a repeat if we got it wrong.

If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) – www.oaic.gov.au, 1300 363 992.

13. Children

We’re a business-to-business software company and our services and website are not directed at children under 18. We don’t knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we’ll investigate and delete it where we can. (Where an app we built for a client serves consumers or children, the client’s own policies apply.)

14. Contact us

Privacy Officer Code Squirrel (“Code Squirrel” is a trading name of The Trustee for Capital S Trust, ABN 71 286 302 771) [email protected] 1300 698 967 2/24 Vanessa Blvd, Springwood QLD 4127, Australia

15. Changes to this policy

We review this policy at least once a year and update it whenever the way we handle personal information changes. You can read it free of charge at www.codesquirrel.com.au/terms/privacy/, and ask us for a copy in another format (such as a printed or accessible copy) and we’ll provide one.