Privacy Policy

Be Aspect Pty Ltd (ABN 22 628 096 140), trading as Comply & Go (“Comply & Go”, “we”, “us”, “our”), respects your privacy. This policy explains what personal information we collect, how we handle it, and the choices you have. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. About us and this policy

This policy applies to personal information we collect through our website, our platform, and our dealings with you. “Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

2. The information we collect

Depending on how you use Comply & Go, we may collect:

• Business and contact details — your name, business name, ABN, role, email address, phone number and address.
• Questionnaire responses — the information you provide about your business so we can prepare your compliance documents.
• Uploaded documents — files you provide to support your compliance framework. These may contain personal information about you and, in some cases, about other individuals connected with your business.
• Support communications — records of your enquiries and our correspondence with you.
• Payment metadata — limited transaction information such as the amount, date, subscription status and a payment reference. We do not collect or store your full payment card details (see clause 5).
• Website and analytics data — technical information such as your device and browser type, IP address, and how you use our website, collected through cookies and similar tools (see our Cookie Policy).

3. Sensitive information and identity material

Some compliance work involves identity information. Where the documents you provide include sensitive information (as defined in the Privacy Act) or government-related identifiers such as passport or licence numbers, we collect and handle that information only for the purpose of providing our services and as permitted by law, and generally only with your consent. We do not use or disclose government-related identifiers except as the Privacy Act allows.

Where you provide information about other individuals (for example, people connected with your business), you confirm that you are entitled to provide it to us for the purposes described in this policy.

4. How we collect information

We collect information directly from you when you make an enquiry, purchase a service, complete the questionnaire, upload documents or contact support. We also collect some information automatically through our website and analytics tools, and we receive limited payment metadata from our payment processor, Stripe.

5. Payments and Stripe

Payments are processed by Stripe. When you pay, your card details are collected and processed by Stripe under Stripe’s own terms and privacy policy. Comply & Go does not store your full payment card details. We receive only the limited payment metadata described in clause 2.

6. Why we collect and how we use your information

We use personal information to:

• prepare and deliver your compliance documents and perform quality assurance;
• provide the Comply & Go Care subscription, including ongoing maintenance and support (with monitoring, reviews and update alerts rolling out to members as they become available);
• process payments and manage your account and billing;
• provide customer support and respond to your enquiries;
• operate, maintain, secure and improve our website and platform;
• meet our legal and regulatory obligations; and
• communicate with you about your service, and (where permitted) about relevant updates. You can opt out of non-essential messages at any time.

7. When we disclose information

We do not sell your personal information. We may disclose it to:

• Service providers — including Stripe (payments), and our hosting, IT, email and analytics providers, who handle information on our behalf under appropriate obligations;
• Professional advisers — such as our lawyers or accountants, where reasonably required;
• Authorities and others — where required or authorised by law, or to protect our rights or the safety of others.

8. Overseas disclosure

Some of our trusted service providers store or process information outside Australia. Our service providers may process information in Australia, the United States and Singapore, and in other jurisdictions used by those providers from time to time. In particular, Stripe processes payment information overseas, which may include the United States. Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the APPs and subject to appropriate privacy protections.

9. Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, including access controls, encryption in transit, and trusted infrastructure providers. No system is completely secure, and we cannot guarantee absolute security, but we work to protect your information and to respond promptly if an issue arises.

10. Data breaches

If we experience a data breach that is likely to result in serious harm and to which the Notifiable Data Breaches scheme applies, we will assess it and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

11. How long we keep information

We generally retain customer records for seven years after the customer relationship ends, unless a longer period is required by law. When we no longer need personal information, we take reasonable steps to delete it or de-identify it. You remain responsible for retaining your own compliance records as required by the laws that apply to your business.

12. Cookies and analytics

We use cookies and similar technologies on our website. For details of the cookies we use and how to control them, see our Cookie Policy.

13. Automated processing

Our platform uses automated processes to help generate your compliance documents from the information you provide. Every Implementation package then undergoes specialist review, quality assurance and release approval before delivery. We will update this policy to describe any automated decision-making covered by the Privacy Act as those requirements take effect.

14. Accessing and correcting your information

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date or incomplete. Contact us using the details in clause 17. We will respond within a reasonable time. If we cannot give you access or make a correction, we will explain why.

15. Complaints

If you have a privacy concern, please contact us first using the details in clause 17 so we can try to resolve it. If you are not satisfied with our response, you can contact the OAIC at oaic.gov.au.

16. Changes to this policy

We may update this policy from time to time. The current version will always be available on our website, and we will show the date it was last updated.

17. Contact us

Privacy enquiries: Privacy Officer · Email hello@complyandgo.com.au.