Privacy Policy

Who we are

PADISO Pty Ltd (ABN [to be inserted]) runs padiso.ai. We are a B2B services company based in Sydney, Australia. In this policy, "we", "us" and "our" mean PADISO Pty Ltd.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, we also meet those rules. See EU and UK visitors.

What this policy covers

This policy covers personal information we collect when you:

• visit padiso.ai or read our content;
• contact us, book a call or subscribe to a newsletter;
• work with us as a client, partner, supplier or candidate.

It does not cover data we process for clients inside their own systems. That is governed by the client's agreement with us. See Data handled by AI agents.

What we collect

Information you give us

• Contact details: name, work email, phone number, company and role.
• Business context: revenue band, topic and anything you write in a message or share on a call.
• Booking details: the time you choose and the details you enter when you book a call.
• Engagement records: contracts, invoices and correspondence when you work with us.
• Applications: a CV and related details if you apply for a role.

Information we collect automatically

• Device and browser type, pages viewed, referring site, approximate location from IP address, and time on page.
• Cookie data, as set out in our Cookie Policy. Analytics cookies are used only with your consent.

Information from others

• Referrals from people who introduce you to us.
• Public professional sources, such as company websites and professional networks.

We do not ask for sensitive information, such as health or political views. Please do not send it to us. You can deal with us without identifying yourself where that is practical, but we cannot provide services anonymously.

How we use it

• To reply to enquiries and arrange calls.
• To scope, deliver, bill and support our services.
• To send the newsletter you subscribed to. You can unsubscribe at any time.
• To run, secure and improve the website.
• To meet legal, tax and accounting obligations.
• To assess job applications.

We do not sell personal information. We do not use it for third party advertising.

Data handled by AI agents

Our work moves repeatable operations to AI agents that run on, or connect to, our clients' systems. Those agents may process personal information about a client's customers, staff or suppliers.

• The client is in control. We process that data only on the client's documented instructions, under a signed agreement and data processing terms.
• Least access. Each agent gets only the access its task needs. Access is approved by the client and can be revoked at any time.
• Governed and logged. Agents run under approval thresholds and spend limits. Their actions are recorded in an audit trail the client can review.
• No training on client data. We do not use client data to train AI models. We configure AI model providers so client data is not used to train their models.
• Return or deletion. At the end of an engagement we return or delete client data as the agreement requires.

If you are a customer or employee of one of our clients, contact that client first about your information. We will help them respond.

Automated decisions

We do not make decisions about website visitors that have legal or similarly significant effects using automated means alone. A person reviews every enquiry.

Where our agents support decisions inside a client's business, the client sets the rules and the approval thresholds, and decides when a person must review.

Who we share it with

We share personal information only where needed, with:

• Service providers who support our business. These fall into these categories: cloud hosting and storage, email and productivity tools, call scheduling, website analytics, customer relationship management, AI model providers, and accounting and payments.
• Professional advisers, such as lawyers, accountants and auditors.
• Authorities, where the law requires it.
• A buyer or investor, if our business is sold or restructured, under confidentiality terms.

Our service providers may only use the information to provide services to us. A current list of subprocessors is available on request.

Overseas transfers

Some of our service providers store or process data outside Australia, mainly in the United States, the European Union and the United Kingdom. Before we disclose personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs. For EU and UK data, we use approved transfer mechanisms such as Standard Contractual Clauses or the UK International Data Transfer Addendum.

How we protect it

• Encryption in transit and at rest.
• Multi-factor authentication and role-based access.
• Access logs and regular access reviews.
• Security terms in our supplier contracts.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme, and any other regulator the law requires.

How long we keep it

• Enquiries that do not proceed: up to 24 months after last contact.
• Client and supplier records: 7 years after the engagement ends, to meet tax and corporate law.
• Newsletter subscribers: until you unsubscribe.
• Job applications: up to 12 months, unless you ask us to delete them sooner.

When we no longer need information, we delete it or de-identify it.

Your rights in Australia

You can ask to access the personal information we hold about you, or to correct it. We will respond within 30 days. We may need to confirm your identity first. If we refuse a request, we will tell you why and how to complain.

EU and UK visitors

If you are in the European Economic Area or the United Kingdom, the GDPR or UK GDPR gives you the right to:

• access your personal data and receive a copy;
• correct inaccurate data;
• have your data erased;
• restrict or object to processing, including direct marketing;
• data portability;
• withdraw consent at any time, where we rely on consent.

Our legal bases. We rely on our legitimate interests to reply to enquiries and run the website, on contract to deliver services, on consent for analytics cookies and marketing where required, and on legal obligation for records we must keep.

You can complain to your local data protection authority. In the UK, that is the Information Commissioner's Office (ICO).

Marketing

We send marketing emails only to people who subscribed or who have an existing business relationship with us, as the Spam Act 2003 (Cth) and local laws allow. Every email has an unsubscribe link.

Children

Our website and services are for businesses. They are not directed at people under 18, and we do not knowingly collect their information.

Changes to this policy

We may update this policy. We will post the new version here with a new date. If a change is significant, we will tell clients and subscribers directly.

Contact and complaints

For privacy questions, requests or complaints, email [email protected] with "Privacy" in the subject line. We aim to resolve complaints within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.