Privacy Policy

1. Who we are

Taunton Tech Pty Ltd (ABN 65 637 035 093), trading as Sitewell, is an Australian company registered in Queensland. We operate the Sitewell school operations management platform ("Platform").

We are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles ("APPs"). This Privacy Policy explains how we handle personal information in accordance with those obligations.

In this policy, "we", "us", and "our" refer to Taunton Tech Pty Ltd. "You" refers to any individual whose personal information we hold — including Customer administrators, Users, and staff members who submit maintenance requests.

2. What personal information we collect

2.1 Account and user information

When a school registers for Sitewell or a user account is created, we may collect:

• Full name
• Email address
• Phone number
• Job title / role
• School name and address

2.2 Platform usage data

In the course of using the Platform, users may create records that contain personal information, including:

• Names of staff members who submit maintenance requests
• Contact details provided in staff request submissions (email, phone — optional)
• Names of contractors and their staff (licence numbers, contact details, Working With Children check status)
• Internal notes and comments entered by users

2.3 Technical and usage information

We may automatically collect limited technical information when you use the Platform:

• Authentication logs (login timestamps, session tokens managed by Supabase Auth)
• Browser type and device information (for compatibility purposes)
• Feature usage patterns to help us improve the Platform

We do not use third-party analytics services such as Google Analytics on the Platform.

2.4 Contact and enquiry information

If you contact us via the website enquiry form or by email, we collect your name, email, school name, and the content of your message.

3. How we collect personal information

We collect personal information:

• Directly from you — when you register, use the Platform, submit a maintenance request, or contact us;
• From your organisation — when a school administrator creates accounts for staff or enters data on behalf of the organisation;
• Automatically — through authentication and session management systems when you sign in.

Where practicable, we collect personal information directly from the individual it relates to. We will only collect personal information that is reasonably necessary for our functions and activities.

4. Why we collect and use personal information

We collect and use personal information to:

• Provide and operate the Sitewell Platform;
• Create and manage user accounts;
• Enable school operations management features including work orders, asset tracking, contractor management, and staff requests;
• Communicate with you about your account, billing, and support;
• Respond to enquiries and provide customer support;
• Improve and develop the Platform;
• Comply with our legal obligations;
• Detect and prevent fraud, security incidents, and misuse of the Platform.

We will not use your personal information for any purpose that is incompatible with the purposes set out above without your consent, except where permitted or required by law.

5. Disclosure of personal information

5.1 We do not sell your data

We do not sell, rent, or trade your personal information to third parties for marketing or any other commercial purposes.

5.2 Service providers

We share personal information with third-party service providers who help us operate the Platform. All providers are bound by appropriate confidentiality and data protection obligations and are authorised to use personal information only to the extent necessary to provide their services to us.

• Cloud infrastructure (database, authentication, file storage) — provided by Supabase Inc., a US-incorporated company. Importantly, all Customer data is stored exclusively in Sydney, Australia (AWS ap-southeast-2 region) under our configuration. Your data never leaves Australian soil for storage, regardless of Supabase's country of incorporation. Supabase's privacy policy is available at supabase.com/privacy.
• Web hosting — provided by Netlify Inc. (US). Netlify serves the Platform's static files globally via CDN but does not store your operational data. Netlify's privacy policy is available at netlify.com/privacy.
• Transactional email — we use a third-party email delivery service for account confirmations and notifications. Email content is transmitted through their systems but is not stored beyond delivery.

If you are a school IT manager or administrator with specific questions about our infrastructure, we are happy to provide further detail. Contact us at hello@sitewell.com.au.

5.3 Legal requirements

We may disclose personal information if required to do so by law, court order, or in response to a lawful request by a government authority. We will notify you of such a request where legally permitted to do so.

5.4 Business transfers

If Taunton Tech Pty Ltd is involved in a merger, acquisition, or sale of assets, personal information held by us may be transferred to the acquiring entity. We will notify affected customers before any such transfer takes effect.

6. Data storage and security

6.1 Australian data residency

All Customer data — including work orders, assets, staff requests, budget records, and user accounts — is stored on infrastructure located in Sydney, Australia (AWS ap-southeast-2 region, operated by Supabase Inc.).

While our cloud infrastructure provider is a US-incorporated company, our configuration ensures your data is physically stored and processed within Australia at all times. We do not transfer Customer operational data outside Australia for storage or processing without your explicit consent.

This means your school's data is subject to Australian law, including the Privacy Act 1988 and the Australian Privacy Principles, rather than foreign data access regimes.

6.2 Security measures

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security practices include:

• Encrypted data transmission (HTTPS/TLS) for all Platform communications;
• Supabase Row Level Security (RLS) policies ensuring users can only access data belonging to their own school;
• Authentication managed via Supabase Auth with password hashing;
• Role-based access controls within the Platform;
• Regular review of access permissions and security configurations.

While we implement strong security measures, no internet transmission or electronic storage system is completely secure. We encourage you to use strong, unique passwords and to notify us immediately of any suspected security incident.

6.3 Data breach notification

In the event of an eligible data breach as defined under the Privacy Act 1988, we will comply with our Notifiable Data Breaches (NDB) obligations, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

7. Data retention

We retain personal information for as long as necessary to provide the Service and for our legitimate business purposes, including:

• Active accounts: Data is retained for the duration of your Subscription;
• Post-cancellation: Customer data is retained for 30 days after Subscription termination, during which you may request a data export. After this period, data is deleted from active systems;
• Financial records: Records necessary for tax and accounting purposes are retained for 7 years in accordance with Australian law;
• Enquiry data: Contact form submissions are retained for up to 2 years.

Backups may retain data for a short period beyond these timeframes in the normal course of system operations.

8. Your rights and access

8.1 Access to your information

Under the Australian Privacy Principles, you have the right to request access to personal information we hold about you. To make an access request, contact us at hello@sitewell.com.au. We will respond within 30 days.

In some circumstances, we may decline to provide access — for example, where providing access would unreasonably impact the privacy of other individuals. If we decline, we will provide written reasons.

8.2 Correction of your information

If you believe personal information we hold about you is inaccurate, out of date, incomplete, or misleading, you may request correction. Many details can be updated directly within the Platform. For other corrections, contact us at hello@sitewell.com.au.

8.3 Deletion

You may request deletion of your personal information by contacting us. We will action deletion requests subject to our legal obligations to retain certain records and the operational requirements of any active Subscription.

8.4 Data portability

You may request an export of your school's data from the Platform at any time. Please contact us at hello@sitewell.com.au to arrange an export.

9. Cookies and tracking

The Sitewell Platform uses session cookies and local storage strictly for authentication purposes (to keep you logged in). We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies.

The public marketing website (sitewell.com.au) does not use tracking or analytics cookies. If this changes, we will update this policy and display appropriate cookie notices.

10. Children's privacy

The Sitewell Platform is designed for use by adult facilities and operations professionals and is not directed at children under 18. We do not knowingly collect personal information from children.

While the Platform operates within school environments, it is a facilities management tool and does not collect or process student personal information. School administrators are responsible for ensuring the Platform is used only by authorised adult staff.

If you believe we have inadvertently collected personal information relating to a child, please contact us immediately at hello@sitewell.com.au and we will take prompt action to delete it.

11. Links to other websites

The Platform or our website may contain links to third-party websites. This Privacy Policy does not apply to those websites. We encourage you to read the privacy policies of any third-party websites you visit. We are not responsible for the privacy practices of other websites.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by email or by displaying a notice within the Platform at least 14 days before the changes take effect.

The current version of this Privacy Policy is always available at sitewell.com.au/privacy.html. The effective date at the top of this page indicates when it was last updated.

13. Complaints and contact

13.1 Contact us first

If you have a concern about how we have handled your personal information, please contact us in the first instance:

Taunton Tech Pty Ltd trading as Sitewell
ABN 65 637 035 093
Email: hello@sitewell.com.au

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If your complaint is complex, we will keep you informed of our progress.

13.2 Office of the Australian Information Commissioner

If you are not satisfied with our response, or if you believe we have breached the Australian Privacy Principles, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001