Operandio Privacy Policy

(Updated February 2026)

Who this policy applies to.  This Privacy Policy applies to Operandio Pty Ltd (ABN 67 632 779 885) and Operandio US, LLC (together, “Operandio”, “we”, “us”, “our”). It covers how we collect, use and protect personal information provided by customers and visitors through the Operandio website and platform (collectively, the “Operandio Services”).

Applicable law.  We comply with the Privacy Act 1988 (Cth) and Australian Privacy Principles, the Privacy Act 2020 (NZ), the California Consumer Privacy Act 2018 (CCPA) and applicable US state privacy laws and equivalent legislation in other jurisdictions in which we operate.

1. Information We Collect

Account and registration information

When you register for an Operandio account, we collect your name, company name, email address and billing address. Payment card details are collected and processed by our third-party payment processor and are not stored on Operandio’s systems.

Platform usage data

We collect information about how you and your Authorised Users interact with the Platform, including log-in activity, features accessed and actions taken within the service. This information is used to operate, maintain and improve the Platform and does not on its own identify individual end users.

Technical and device data

We automatically collect technical information when you visit our website or access the Platform, including IP address, browser type, operating system and referring pages. IP addresses may be associated with account records where necessary to detect fraud, resolve support issues or comply with legal obligations.

Customer data

Data uploaded to the Platform by you or your Authorised Users is your data, not ours. We process it only as directed by you and in accordance with the Software Supply Agreement. We have no direct relationship with the individuals whose personal information may be contained in your Data.

Communications

If you contact us directly, we retain records of that correspondence, including the content of messages and any contact information you provide.

AI-powered features

Where AI-powered features are activated on the Platform, data submitted to those features may be processed by third-party AI providers, including providers located outside your home jurisdiction. Processing arrangements and applicable safeguards are detailed in the Operandio AI Terms of Use, which must be accepted before AI features are activated.

2. How We Use Your Information

We use the information we collect to:

• provision and operate the Operandio Services;
• process payments and manage your account;
• provide technical support and respond to your enquiries;
• send service-related communications, including billing notices, security alerts and product updates;
• monitor and improve the performance, security and functionality of the Platform;
• comply with our legal obligations; and
• enforce our agreements.

We do not use your Data or your Authorised Users’ personal information for advertising, marketing to third parties or profiling for purposes unrelated to the delivery of the Operandio Services.

3. Disclosure of Information

We will not sell, rent or share your personal information with third parties except as described in this policy.

Service providers and sub-processors

We may share information with third-party service providers who assist us in delivering the Operandio Services, including cloud hosting providers, payment processors and customer support tools. These providers are contractually required to handle personal information in accordance with this policy and applicable law.

A current list of sub-processors is available on request by contacting corporate@operandio.com. We will notify customers by email at least 14 days before engaging a new sub-processor.

Legal and regulatory requirements

We may disclose personal information where required to do so by law, court order or government authority or where we reasonably believe disclosure is necessary to protect the rights, property or safety of Operandio, our customers or others.

Business transfers

If Operandio is involved in a merger, acquisition or sale of assets, personal information held by us may form part of the transferred assets. We will notify account holders by email and by notice on our website before any such transfer results in a material change to how your personal information is used.

With your consent

We may disclose personal information for other purposes with your prior written consent.

4. Cookies and Tracking

We use cookies and similar technologies to operate and improve the Operandio Services. We do not use advertising networks, third-party ad cookies or social media tracking pixels on the Platform or website.

Session cookies

Session cookies maintain your login state while you are using the Platform. They are transmitted over HTTPS only and expire when you close your browser.

Persistent cookies

Persistent cookies remember your display preferences and understand how you were referred to our website. They can be removed through your browser settings.

Analytics

We use aggregated, anonymised analytics to understand usage trends and improve the Platform. This data does not identify individual users and is not shared with third parties for commercial purposes.

Managing cookies

You can configure your browser to refuse or delete cookies. Refusing session cookies will prevent you from logging in to the Platform.

5. Data Security

We implement and maintain technical and organisational security measures designed to protect personal information from unauthorised access, disclosure, alteration and loss. Sensitive data transmitted to the Platform is encrypted using TLS (transport layer security).

The Platform is primarily hosted on Amazon Web Services (AWS) infrastructure. Primary data hosting regions and any additional data centres are detailed in our sub-processor list, available on request.

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security. If you have concerns about the security of your account or data, contact us at corporate@operandio.com.

In the event of a data breach, we will notify affected customers and take remedial action in accordance with clause 14 of the General Terms and Conditions of Use and our obligations under the Notifiable Data Breaches scheme (Privacy Act 1988 (Cth)) and equivalent legislation in other jurisdictions.

6. Data Retention and Deletion

We retain personal information for as long as your account is active or as needed to provide the Operandio Services. We also retain information as necessary to comply with our legal obligations, resolve disputes and enforce our agreements.

Customer data

Your Data is handled in accordance with clause 9 of the General Terms and Conditions of Use. Following expiry or termination of your subscription, your Data remains accessible on a read-only basis for a 30-day export window. At the end of that period, we will permanently delete your Data, including backup copies. We will provide written confirmation of deletion within 10 Business Days of the Export Window closing.

Account information

Account and registration information is retained for the duration of your relationship with Operandio and for 3 years following the end of your relationship with Operandio or longer where required to comply with specific legal obligations. Where you request deletion of your account, we will process that request within 30 days and confirm completion.

7. Your Rights

Subject to applicable law, you have the right to access, correct, update or request deletion of your personal information. To exercise any of these rights, contact us at corporate@operandio.com. We will respond within 30 days.

Customer data requests

If you are an employee or contractor of an Operandio customer and wish to access, correct or delete personal information held about you, please contact the Operandio customer directly. Operandio processes that information on the customer’s behalf and the customer is the data controller. Where a customer requests us to delete personal information, we will do so within 30 Business Days.

California residents (CCPA)

California residents have the right to know what personal information we collect, request deletion of their personal information, opt out of any sale of personal information (Operandio does not sell personal information) and not be discriminated against for exercising these rights. To exercise CCPA rights, contact corporate@operandio.com.

Australian and New Zealand residents

Individuals in Australia and New Zealand may make a complaint about how we handle personal information by contacting corporate@operandio.com. If you are not satisfied with our response, you may refer the matter to the Office of the Australian Information Commissioner (OAIC) or the New Zealand Privacy Commissioner, as applicable.

8. Communications

We will send you service-related communications, including account confirmation, billing notices, security alerts, maintenance announcements and product updates. These are necessary for the operation of your account and cannot be opted out of while your account is active.

If you have subscribed to our newsletter or marketing communications, you may unsubscribe at any time by following the unsubscribe link in any such communication or by contacting corporate@operandio.com.

9. Testimonials

We may display customer testimonials on our website with your prior written consent. If you wish to update or remove a published testimonial, contact corporate@operandio.com.

10. Third Party Links and Services

The Operandio website and Platform may contain links to third-party websites and integrate with third-party services. This policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through or alongside the Operandio Services.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify account holders by email to the primary address on your account and by placing a prominent notice on our website, at least 30 days before the change takes effect.

12. Contact

For questions, requests or complaints relating to this Privacy Policy or how we handle personal information: