Privacy Policy

1. About this Privacy Policy

AutoForce Digital Pty Ltd (ABN/ACN: [insert details]) (AutoForce, we, us or our) is committed to protecting personal information and handling it responsibly.

This Privacy Policy explains how we collect, hold, use, disclose, store and otherwise process personal information through our website at https://www.autoforce.io, our applications, software platforms, integrations and related products and services (collectively, the Services).

Our Services include ServiceCAM, SalesCAM, Service Key Drop Off & Pick Up, SMS Conversations, WebText, Reviews, Payments and other products or services we make available from time to time.

This Policy applies to:

Visitors to our website and people who contact us.
Our business customers, including automotive dealerships, repair businesses and other organisations that use our Services.
Employees, contractors, representatives and other authorised users of customer accounts.
Customers of our business customers, including vehicle owners and motorists whose personal information is processed through our Services.
People who receive communications, review requests, service updates, payment requests or other messages through our Services.
People who apply for employment, participate in our events or otherwise interact with us.

This Policy should be read alongside any applicable service agreement, customer contract, product-specific privacy notice or other privacy information we provide.

Where we process personal information on behalf of a business customer, that customer may also have its own privacy policy and obligations to the individuals concerned.

2. Our role and responsibilities

Our role depends on the circumstances in which we handle personal information.

When we act for our own business purposes, such as managing accounts, providing support, processing payments to us, marketing our Services and administering our website, we are responsible for handling that information in accordance with applicable privacy laws.

When we process information on behalf of a dealership or other business customer, we generally process that information to provide the Services and in accordance with the applicable customer agreement and the customer's documented instructions.

In these circumstances, the customer will generally be responsible for determining why the information is collected and how it is used in its own business. For example, a dealership may decide to upload a motorist's contact details, send a service reminder or request a customer review.

Our role and the customer's role depend on the applicable law and the particular processing activity. We do not assume that every responsibility rests exclusively with either party.

Business customers must ensure that they have an appropriate legal basis to collect, upload, disclose and use personal information through our Services, and that they provide any notices and obtain any consents required by law.

3. Personal information we collect

The types of personal information we collect depend on how you interact with us and which Services are used.

3.1 Website visitors and prospective customers

We may collect:

Name, business name, job title and professional contact details.
Email address, telephone number and business address.
Information submitted through contact forms, enquiry forms, demonstrations, registrations and downloads.
Communications with us, including enquiries, feedback and support requests.
IP address, approximate location derived from technical information, browser type, device information, operating system, referral source and website activity.
Cookie identifiers, analytics information and preferences, subject to applicable requirements.

3.2 Business customers and authorised users

We may collect:

Account registration and contact details.
Business and dealership information.
Login credentials, authentication records, access permissions and account activity.
Subscription, invoicing, billing and payment-related information.
Support requests, training records, feedback and communications.
Records of how authorised users interact with the Services, including relevant audit and security logs.

3.3 Information processed through dealership services

Depending on the Services used and the information supplied by our customers, we may process:

Names, telephone numbers, email addresses and other contact details.
Vehicle registration numbers, vehicle identification details, make, model and service history.
Repair orders, booking details, inspection records, quotations and service information.
Photographs, videos, audio recordings or other media relating to vehicles, inspections or service work.
Messages, message delivery records, communication preferences and communication histories.
Customer feedback, survey responses, review content and ratings.
Payment request details, transaction references and payment status.
Information needed to facilitate vehicle collection, key drop-off, key collection or other dealership workflows.

Media and other content may incidentally capture an identifiable person or reveal personal information. Customers should avoid uploading unnecessary personal or sensitive information.

3.4 Payments

Where our Services facilitate payments, we may process information such as payment amounts, transaction references, payment status, billing details and relevant transaction records.

Where a third-party payment provider processes card details or other payment credentials directly, those details may be collected and held by that provider rather than by AutoForce. The actual arrangements depend on the payment service used.

3.5 Information obtained from other sources

We may receive personal information from:

Our business customers, including information uploaded to our platforms.
Customer-authorised integrations with dealer management systems (DMS), customer relationship management systems (CRM) or other software.
Service providers that support our operations.
Business partners and referral sources.
Publicly available sources, where lawful and relevant.
Other people or organisations where permitted by law.

Where we collect personal information indirectly, we will take reasonable steps to provide the information required by applicable privacy law, including New Zealand's indirect collection notification requirements, unless an exception applies.

3.6 Information we do not seek to collect

We do not intentionally seek to collect sensitive personal information unless it is necessary for a legitimate purpose, permitted by law and handled in accordance with any applicable additional requirements.

We ask customers not to upload information unrelated to the relevant automotive or business workflow.

4. How we collect personal information

We may collect personal information:

Directly from you when you contact us, register an account, use our website or communicate with our team.
Automatically through our website, applications, cookies, logs, analytics and related technologies.
From our business customers when they upload information or use our Services to manage their own customers.
Through integrations authorised by our business customers.
From service providers, business partners and other sources where lawful.

Where information is provided by a business customer about another person, the business customer is responsible for ensuring that its collection and disclosure are lawful. AutoForce will also meet any privacy obligations that apply to its own activities.

5. Why we collect and use personal information

We may use personal information, as applicable, to:

Provide, operate, maintain and support the Services.
Create and administer customer accounts and user permissions.
Facilitate automotive service, inspection, sales and customer communication workflows.
Deliver or facilitate service videos, service updates, appointment information, quotations and other customer communications.
Send SMS messages, email notifications and other communications on behalf of our business customers.
Facilitate review requests, collect feedback and display or manage reviews as instructed by our customers.
Facilitate payment requests and payment-related workflows.
Respond to enquiries, troubleshoot problems and provide customer support.
Manage subscriptions, invoices, payments and contractual relationships.
Monitor system performance, diagnose errors and improve the functionality and reliability of the Services.
Protect our systems, detect fraud, prevent misuse and investigate security incidents.
Maintain business records, meet legal obligations and establish, exercise or defend legal claims.
Conduct business administration, reporting, analytics and service improvement.
Market our own products and services where permitted by law.
Evaluate prospective business relationships and manage recruitment where relevant.

We will use personal information only for purposes permitted by applicable law. Where required, we will obtain consent or provide an opportunity to object before using information for a new purpose.

6. SMS, email and other electronic communications

Our Services may enable business customers to communicate with their own customers through SMS, email, web-based messaging or other electronic channels.

These communications may include service reminders, appointment updates, inspection videos, quotations, payment requests, review requests and other messages relating to a customer's interaction with a dealership.

The relevant business customer generally determines the content, recipients and purpose of these communications. AutoForce provides the technology and processes the information necessary to deliver and record them.

Where a communication constitutes direct marketing or otherwise requires consent, the party responsible for sending it must ensure that the applicable legal requirements are met.

Recipients should contact the relevant dealership about the purpose of a dealership communication. They may also contact AutoForce about our handling of their information.

Where available, recipients can use the unsubscribe or opt-out instructions provided with a message. Opting out of marketing messages does not necessarily stop essential service, transactional, safety or legally required communications. We will respect applicable suppression requirements and will not use this distinction to circumvent a lawful opt-out.

7. Cookies, analytics and similar technologies

Our website and Services may use cookies, pixels, software development kits, logs and similar technologies to:

Operate and secure our website and platforms.
Remember preferences and maintain sessions.
Understand website traffic and usage.
Diagnose technical issues and improve performance.
Measure the effectiveness of marketing.
Support features provided by third parties.

These technologies may collect information about your browser, device, approximate location, pages visited, interactions and referral sources.

We may use third-party analytics and website providers, including Google Analytics or other services where configured. The information collected and the providers involved depend on our current website configuration.

You can manage cookies through your browser settings and, where provided, our cookie preference tool. Disabling certain cookies may affect website functionality.

Where required by law, we will obtain consent before using non-essential cookies or similar technologies.

8. Disclosure of personal information

We may disclose personal information, where necessary and lawful, to:

Business customers, including dealerships that use our Services to manage their customer relationships.
Hosting, cloud storage, software, analytics, communications and technical support providers.
SMS, email and telecommunications providers involved in delivering messages.
Payment processors and financial service providers.
Customer-authorised DMS, CRM and other integration partners.
Professional advisers, auditors, insurers and legal representatives.
Government agencies, regulators, courts, law enforcement authorities or other parties where required or authorised by law.
A purchaser, investor, successor or other relevant party in connection with a proposed or completed merger, restructuring, financing, sale of assets or transfer of our business, subject to applicable legal requirements.
Other parties where you have authorised the disclosure or where another lawful basis applies.

We require service providers that handle personal information on our behalf to protect it and use it consistently with their contractual obligations and applicable law.

We do not sell personal information in exchange for money. We may permit service providers to process information on our behalf for analytics, hosting, communications or other legitimate business purposes, subject to applicable law and the relevant arrangements.

9. Overseas storage and disclosure

AutoForce and its service providers may store or process personal information in Australia, New Zealand, the United States and other countries in which our service providers or their infrastructure operate.

The countries involved may change as our technology providers and business arrangements change.

Where personal information is disclosed or transferred overseas, we will take the steps required by applicable law. Depending on the circumstances, these may include assessing the recipient's privacy protections, entering into contractual safeguards, ensuring that comparable protections apply or obtaining any consent required by law.

For New Zealand information, we will comply with Information Privacy Principle 12 where applicable. For Australian information, we will comply with Australian Privacy Principle 8 and related requirements where applicable.

Using our Services does not, by itself, constitute consent to an overseas disclosure where the law requires additional steps or a specific form of consent.

10. Data security

We take reasonable steps appropriate to the nature of the information and the risks involved to protect personal information from loss, misuse, interference, unauthorised access, modification and disclosure.

Depending on the system and service involved, safeguards may include:

Encryption of information in transit and, where supported, at rest.
Access controls, authentication and permissions.
Secure hosting and infrastructure management.
System monitoring, logging and incident response procedures.
Backups and recovery arrangements.
Staff access restrictions and confidentiality obligations.
Security reviews and measures designed to reduce unauthorised access.
Appropriate contractual requirements for service providers.

No method of electronic storage or transmission is completely secure. We cannot guarantee absolute security, but we take reasonable steps to manage and reduce privacy and security risks.

Business customers are responsible for maintaining appropriate security for their own accounts, access credentials, devices and systems, and for limiting access to authorised personnel.

11. Data breaches and privacy incidents

We maintain procedures for identifying, assessing, containing and responding to suspected or actual privacy and security incidents.

Where an incident involves personal information, we will assess the nature of the incident, the information affected, the potential harm and any applicable legal notification requirements.

We will notify the relevant regulator and affected individuals where required by law, including under Australia's Notifiable Data Breaches scheme and New Zealand's notifiable privacy breach requirements.

Where AutoForce processes information on behalf of a business customer, we will notify that customer in accordance with our contractual arrangements and applicable legal obligations so that the customer can take any required action.

12. Retention and deletion

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide the Services, to meet contractual and legal obligations, to resolve disputes, to maintain appropriate business records and to protect our legitimate interests where permitted by law.

Retention periods depend on the type of information and the circumstances. Relevant factors include:

Whether a business customer account remains active.
The terms of the applicable customer agreement.
The nature of the service, communication or transaction.
Applicable accounting, tax, recordkeeping and other legal requirements.
Security, dispute resolution and legal claim considerations.
Whether the information can be deleted, returned or de-identified without compromising a legitimate obligation.

When information is no longer required, we take reasonable steps to delete or de-identify it securely, subject to applicable law and legitimate retention requirements.

Information held in backups, security logs or archived records may persist for a limited period under our ordinary retention and deletion processes.

Where we process information on behalf of a business customer, deletion or return of that information will be handled in accordance with the applicable service agreement, customer instructions and legal requirements.

We maintain or will maintain appropriate retention and deletion procedures for the information we hold.

13. Access to and correction of personal information

Subject to applicable law and any lawful exceptions, you may request access to personal information we hold about you and request correction of information that is inaccurate, incomplete or out of date.

We may need to verify your identity and clarify the information or records to which your request relates.

If the information was supplied to us by a dealership or another business customer, we may refer you to that organisation where appropriate. We will also consider our own obligations to respond to the request.

Where we are unable to make a requested correction, we will explain the position to the extent required by law. Where applicable, you may request that a statement of correction be associated with the information.

We will respond within the timeframes required by the applicable privacy law. If a request is complex or an extension is legally permitted, we will notify you as required.

14. Marketing preferences

We may use business contact information to provide information about AutoForce products, services, events and updates where permitted by law.

You can opt out of marketing emails by using the unsubscribe link or by contacting us. You can also contact us about marketing preferences relating to other channels.

We will process opt-out requests in accordance with applicable law and maintain suppression records where necessary to ensure that marketing communications do not resume improperly.

Opting out of marketing does not affect service-related communications that we are lawfully entitled or required to send.

15. Children and young people

Our Services are primarily designed for business customers and automotive service workflows, rather than for children.

We do not knowingly seek to collect personal information directly from children unless it is necessary for a legitimate purpose and permitted by law. If personal information about a child is processed through a business customer's use of the Services, the business customer must ensure that the collection, disclosure and use of that information comply with applicable law.

If you believe personal information has been collected or used inappropriately, please contact us so that we can assess the matter and take appropriate action.

16. Third-party websites and services

Our website and Services may contain links to, or integrations with, third-party websites and services.

Those third parties may have their own privacy policies, terms and data-handling practices. AutoForce is not responsible for the privacy practices of independent third parties, except to the extent that applicable law provides otherwise or we are responsible for their activities.

We encourage you to review the relevant third-party privacy information before providing personal information directly to them

17. Your privacy rights and complaints

Your rights depend on the applicable privacy law and the circumstances in which we hold your information.

You may contact us to:

Request access to personal information we hold about you.
Request correction of personal information.
Ask how your information was collected or how it is being used.
Raise a concern about our handling of personal information.
Make a privacy complaint.

Please provide sufficient details for us to identify the relevant information and understand your request. We may ask for additional information to verify your identity or clarify the matter.

We will acknowledge and investigate complaints as appropriate and respond within the timeframes required by law.

If you are not satisfied with our response, you may contact the relevant privacy regulator.

Australia

Office of the Australian Information Commissioner (OAIC)
Website: https://www.oaic.gov.au

New Zealand

Office of the Privacy Commissioner
Website: https://www.privacy.org.nz

You may also have rights under other applicable privacy laws.

18. Privacy contact

For privacy requests, questions or complaints, please contact:

Privacy Officer - AutoForce Digital Pty Ltd
Email: info@autoforce.io
Telephone: +61 7 5372 9001
New Zealand telephone: +64 27 564 7742
Website: https://www.autoforce.io

Please mark your communication "Privacy Request" or "Privacy Complaint" so that we can direct it appropriately.

19. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, business operations, technology providers or legal obligations.

The current version will be published on our website with its updated date. Where required by law, we will provide additional notice of material changes or obtain consent before undertaking processing that requires it.

A change to this Policy does not remove any rights you have under applicable law.

20. Applicable law

This Policy is intended to describe our privacy practices in a manner consistent with applicable Australian and New Zealand privacy laws.

The laws that apply to a particular activity may depend on the parties involved, the location of the individuals concerned, the nature of the information and the processing activity.

Nothing in this Policy is intended to exclude, restrict or modify any right or obligation that cannot lawfully be excluded, restricted or modified.