Privacy Policy

Who we are

You can contact us at:

• Email: privacy@twelfth.ai
• Privacy Officer: Michael Carter
• Postal address: Ground Floor, 470 St Kilda Road, Melbourne VIC 3004

What this Privacy Policy covers

This Privacy Policy explains how we collect, hold, use and disclose Personal Information about you when you:

• visit or use the Website;
• register for, access or use the Platform; or
• otherwise interact with us (for example, by email, phone or social media).

We handle Personal Information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

Data that a customer provides to us under a pilot agreement or services contract is handled in accordance with that agreement. Where any such data contains Personal Information, we handle it in accordance with the Privacy Act and this Privacy Policy.

What personal information we collect

We collect the following categories of Personal Information:

• Account information — your name, business name, ABN, email address, phone number, password (hashed), billing details, and the name and role of any authorised users.
• Profile information — information you provide about your business, role, industry and preferences.
• Customer data — trading, product, supplier, pricing and inventory data that you or your organisation provide to the Platform, whether by connecting a data source, uploading a file, entering it in the Platform or supplying it under a pilot agreement or services contract. This may include the names, contact details and purchase history of your customers, and the names and contact details of your staff and suppliers.
• Usage data — information about how you use the Platform, including pages viewed, features used, frequency of use, and time spent.
• Communications — the content of emails, support tickets, chat messages (including messages you send to the Platform’s assistant), video calls and other communications between you and us.
• Technical and device information — IP address, browser type, operating system, device identifiers and similar information.
• Cookies and similar technologies — see our Cookie Notice.

We try to avoid collecting “sensitive information” (as defined in the Privacy Act). If we ever need to collect sensitive information, we will ask for your consent first.

How we collect personal information

We collect Personal Information:

• Directly from you — when you sign up, complete forms, upload data, communicate with us or use the Platform.
• Automatically — when you interact with the Website, the Platform or one of our add-ins and integrations (for example, Twelfth for Excel), via cookies, log files, product analytics, error reporting and session-replay tools. In our add-ins these run by default for signed-in users and can be turned off in the add-in's settings; what you type is masked in any replay.
• From third parties — for example, from our sub-processors, payment providers, marketing partners, public sources, or referees.

Where we collect Personal Information about a third party (for example, your customers, staff or suppliers) through your use of the Platform, we rely on you to have provided any necessary notices and obtained any necessary consents.

How we store and hold personal information

We store information about you in computer systems and databases operated by either us or our external service providers.

We implement and maintain processes and security measures to protect personal information which we hold from misuse, interference or loss, and from unauthorised access, modification or disclosure. These processes and systems include:

• the use of identity and access management technologies to control access to systems on which information is processed and stored;
• requiring all employees to comply with internal information security policies and keep information secure; and
• monitoring and regularly reviewing our practice against our own policies and against industry best practice.

We will also take reasonable steps to destroy or de-identify personal information once we no longer require it for the purposes for which it was collected or for any secondary purpose permitted under the APPs.

Why we collect, hold, use and disclose your personal information

We collect, hold, use and disclose Personal Information for the following purposes:

• to operate, provide, maintain and improve the Platform;
• to analyse the data you or your organisation provide and generate forecasts, recommendations, reports and answers for you, including through AI features that use third-party model providers;
• to manage your account, including authentication, billing and customer support;
• to communicate with you about your account, the Platform and changes to our services;
• to send you marketing communications (with your consent or where otherwise permitted by law, and always with an opt-out — see “Direct marketing” below);
• to detect, prevent and address security incidents and fraud;
• to comply with our legal obligations and respond to lawful requests;
• to develop, test and improve our products and services; and
• to create Aggregated Data (see below).

Aggregated and de-identified data

A core feature of the Platform is the creation of Aggregated Data — data derived from combining Customer data and usage information across multiple users in a form that has been de-identified such that no individual user, business, or person can be re-identified whether alone or in combination with other reasonably available information.

We apply de-identification techniques consistent with current OAIC guidance, which may include aggregation thresholds, generalisation, suppression of small data points, and removal of direct and indirect identifiers.

Once data has been irreversibly de-identified and aggregated, it is no longer Personal Information for the purposes of the Privacy Act. We may use Aggregated Data for any lawful purpose, including analytics, benchmarking, product development and commercial reporting, and we may retain Aggregated Data indefinitely.

Disclosure to third parties

We may transfer or disclose your personal information to our related companies, and to external service providers so that they may perform services for us or on our behalf.

We may also disclose your personal information to others outside our group of companies where:

• we are required or authorised by law to do so;
• you have expressly consented to the disclosure, or the consent may be reasonably inferred from the circumstances; or
• we are otherwise permitted to disclose the information under the Privacy Act.

Further, we may disclose Personal Information to:

• Sub-processors — third-party service providers (such as hosting, analytics, email, payment and AI providers) that help us run the Platform. A current list of our sub-processors is available on request at privacy@twelfth.ai.
• Business partners — for example, integration partners and resellers, where you have asked us to share information with them.
• Legal disclosures — where required by law, regulation, court order or to protect our legal rights or those of others.
• In connection with a sale of business — to a purchaser or potential purchaser of all or part of our business or assets.

We do not sell Personal Information.

Overseas recipients and cross-border disclosure

Some of our sub-processors are located outside Australia, including in the United States. By using the Platform or providing Personal Information to us, you acknowledge that your Personal Information may be disclosed to recipients in those countries.

Where we disclose Personal Information overseas, we take such steps as are reasonable in the circumstances to ensure the overseas recipient handles the information in accordance with the APPs.

The current list of countries where our sub-processors operate is available on request at privacy@twelfth.ai.

Direct marketing

We may send you direct marketing communications about products, services and offers that we think may interest you. Where required, we will rely on your consent, and you can opt out at any time by:

• clicking the “unsubscribe” link in any email; or
• contacting us using the details above.

We comply with the Spam Act 2003 (Cth) in relation to commercial electronic messages.

Cookies and similar technologies

We use cookies and similar tracking technologies on the Website and Platform. For more information about the cookies we use and how to manage them, please see our Cookie Notice.

Data security

We take reasonable steps to protect Personal Information from misuse, interference, loss, unauthorised access, modification and disclosure. These steps include:

• encryption of data in transit (TLS) and at rest;
• access controls and the principle of least privilege;
• audit logging;
• regular backups; and
• personnel training and vendor risk management.

No system is completely secure. While we work hard to protect your information, we cannot guarantee absolute security.

How long we keep your information

We keep Personal Information for as long as we need it to provide the Platform, comply with our legal obligations, and resolve disputes.

In general, we keep account-related Personal Information for the life of your account and for up to 7 years after your account is closed for legal, tax and recordkeeping reasons.

Aggregated Data that has been irreversibly de-identified may be retained indefinitely.

Your rights

Under the Privacy Act, you have the right to:

• Access the Personal Information we hold about you;
• Correct Personal Information that is inaccurate, out of date, incomplete, irrelevant or misleading; and
• Complain about how we have handled your Personal Information.

To exercise any of these rights, please contact us using the details at the top of this policy. We will respond to access and correction requests within a reasonable time (usually within 30 days).

Deletion and erasure. Beyond what the Privacy Act requires, you may ask us to delete the Personal Information we hold about you. Email privacy@twelfth.ai with the subject line Deletion request and tell us which information you mean; you do not need to give a reason, and there is no charge. We will confirm receipt, tell you what we can and cannot delete, and complete the deletion within 30 days.

We cannot always delete everything. Where we are required by law to keep a record — tax and corporate records, for example — or where the information is needed to establish or defend a legal claim, we will keep only what is necessary, tell you which categories those are, and delete the rest. Information that has been irreversibly de-identified and aggregated (see “Aggregated and de-identified data”) is no longer Personal Information and is not returned or deleted.

Every request we receive — access, correction, deletion, objection or complaint — is logged with the date it arrived and the date we answered it, so we can show we met the 30-day commitment.

If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

Access to and correction of your personal information

You may access or request correction of the personal information that we hold about you by contacting us. There are some circumstances in which we are not required to give you access to your personal information.

There is no charge for requesting access to your personal information, but we may require you to meet our reasonable costs in providing you with access (such as costs for time spent collating large amounts of material).

We will respond to your requests to access or correct personal information in a reasonable time and will take all reasonable steps to ensure that the personal information we hold about you remains accurate, up to date, complete, relevant and not misleading.

Children

The Platform is intended for use by businesses and individuals aged 18 and over. We do not knowingly collect Personal Information from anyone under 18. If you believe we have collected information from a child, please contact us so we can delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The most current version will always be posted on the Website. Where the changes are material, we will notify you by email or through the Platform.

Contact us

If you have any questions about this Privacy Policy or how we handle Personal Information, please contact our Privacy Officer at privacy@twelfth.ai or by post at Ground Floor, 470 St Kilda Road, Melbourne VIC 3004.