Privacy Policy
1. Introduction
Forged Flow Pty Ltd ("Forged Flow", "we", "us", or "our") is committed to protecting the privacy of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our virtual administration, bookkeeping, automation, and business support services ("Services").
We are bound by the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs") contained in that Act. This Privacy Policy sets out how we comply with our obligations under the Privacy Act.
By engaging our Services or providing us with your personal information, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy.
2. Information We Collect
2.1 Information You Provide
We collect personal information that you voluntarily provide to us, including:
- Contact information: Name, email address, phone number, and business address.
- Business information: Business name, ABN, industry type, number of employees, and business structure.
- Financial information: Bank account details, transaction records, invoices, receipts, and other financial documents necessary for bookkeeping and accounting services.
- Employee information: For clients using payroll services: employee names, addresses, tax file numbers, superannuation details, bank account details, employment contracts, and leave records.
- Customer information: Information about your customers that you provide for invoicing and job management purposes.
- Login credentials: Access credentials for your accounting software, job management software, and other business systems.
- Communication records: Emails, phone call records, and other communications between you and Forged Flow.
2.2 Information Collected Automatically
When you visit our website, we may automatically collect certain information, including:
- IP address and browser type
- Pages visited and time spent on our website
- Referring website or source
- Device information
2.3 Information from Third Parties
We may receive information about you from third-party sources, including:
- Your accounting software (e.g., Xero, MYOB) when you grant us access
- Your job management software (e.g., ServiceM8, Tradify) when you grant us access
- Your bank or financial institution through bank feed connections
- Payment processors (e.g., Stripe) for billing purposes
3. How We Use Your Information
We use the information we collect for the following purposes:
- Providing Services: To deliver bookkeeping, payroll, invoicing, BAS preparation, phone management, and other services you have engaged us to perform.
- Account management: To manage your account, process payments, and communicate with you about our Services.
- Service improvement: To understand how our Services are used and to improve and develop new features.
- Compliance: To comply with legal obligations, including tax reporting requirements and record-keeping obligations.
- Communication: To send you service-related communications, updates, and occasional marketing communications (with your consent).
- Security: To protect our Services and users from fraud, abuse, and security threats.
4. How We Share Your Information
We do not sell your personal information. We may share your information in the following circumstances:
4.1 Service Providers
We share information with third-party service providers who assist us in delivering our Services, including:
- Accounting software: Xero, MYOB, QuickBooks
- Job management software: ServiceM8, Tradify, Fergus
- Automation platforms: Zapier
- Phone system providers: OpenPhone, Dialpad
- Payment processors: Stripe
- Customer relationship management: HubSpot
- Cloud storage providers: For secure data storage and backup
These service providers are contractually obligated to protect your information and use it only for the purposes for which it was disclosed.
4.2 Professional Advisers
With your consent, we may share relevant information with your accountant, tax agent, or other professional advisers to facilitate the services they provide to you.
4.3 Legal Requirements
We may disclose your information if required to do so by law, regulation, legal process, or government request, or if we believe disclosure is necessary to protect the rights, property, or safety of Forged Flow, our clients, or others.
4.4 Business Transfers
If Forged Flow is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.
5. Data Storage and Security
5.1 Where We Store Your Information
Your information is primarily stored in Australia using secure cloud-based services. Some of our third-party service providers may store data in other countries (including the United States). Where this occurs, we take reasonable steps to ensure that the overseas recipients handle your personal information in accordance with the APPs.
5.2 Security Measures
We implement reasonable security measures to protect your personal information from unauthorised access, use, modification, or disclosure. These measures include:
- Secure password management systems
- Encryption of data in transit and at rest
- Access controls limiting who can access your information
- Regular security reviews and updates
- Two-factor authentication where available
While we take reasonable steps to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
5.3 Data Breach Response
In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.
6. Data Retention
We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including:
- For the duration of our business relationship with you
- For seven (7) years after the end of our business relationship, to comply with Australian tax record-keeping requirements
- As otherwise required by law
Upon termination of our services, we will provide you with a reasonable opportunity (not less than thirty (30) days) to retrieve your data. After this period, we will securely delete or de-identify your personal information, except where retention is required by law.
7. Your Rights
Under the Privacy Act, you have certain rights regarding your personal information:
7.1 Access
You have the right to request access to the personal information we hold about you. We will respond to your request within a reasonable timeframe (generally within 30 days). In some circumstances, we may refuse access or provide access in a different form, as permitted by law.
7.2 Correction
You have the right to request that we correct any personal information we hold about you that is inaccurate, incomplete, out-of-date, or misleading. We will take reasonable steps to correct the information within a reasonable timeframe.
7.3 Complaints
If you believe we have breached your privacy or mishandled your personal information, you may lodge a complaint with us. We will investigate your complaint and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
- Email: [email protected]
7.4 Marketing Communications
You may opt out of receiving marketing communications from us at any time by clicking the "unsubscribe" link in any marketing email or by contacting us directly. Please note that you may still receive transactional or service-related communications.
8. Sensitive Information
We generally do not collect sensitive information (such as health information, religious beliefs, or political opinions). However, in the course of providing payroll services, we may collect:
- Tax file numbers (as required for payroll processing)
- Membership of professional associations (if relevant to award interpretation)
We only collect sensitive information with your consent and where it is reasonably necessary for our functions or activities.
9. Cookies and Tracking Technologies
Our website may use cookies and similar tracking technologies to improve your experience and analyse website usage. Cookies are small text files stored on your device that help us recognise you and remember your preferences.
You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our website.
We may use third-party analytics services (such as Google Analytics) to collect and analyse information about website usage. These services may collect information about your online activities across different websites over time.
10. Third-Party Links
Our website and Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party websites you visit.
11. Children's Privacy
Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete that information.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated Privacy Policy on our website and, where appropriate, by email.
The "Last Updated" date at the top of this Privacy Policy indicates when it was last revised. We encourage you to review this Privacy Policy periodically.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us:
We will respond to your enquiry within a reasonable timeframe.