Effective
1. What these terms cover
These terms apply where Trade Sync Group Pty Ltd (ABN 65 668 818 791), trading as Orderfy processes personal information for you as part of providing Orderfy: the information about your customers, suppliers, contacts and staff that you keep in it ("your personal data"). You decide why and how it is used; we process it for you. They form part of the terms of service.
2. The processing
- Subject: hosting, storing, backing up and displaying your business data so you can use Orderfy.
- Duration: your subscription, and the retention period after it ends.
- People: your customers, suppliers, their contacts, and your staff.
- Kinds of information: names, business contact details, addresses, order and payment history, sign-in records, and what you choose to record in notes.
3. Our obligations
We:
- process your personal data only to provide Orderfy to you and as you instruct, including through your use of the service
- make sure everyone who can access it is bound to keep it confidential
- keep the security measures on the security page in place, and never make them weaker
- help you answer requests from the people the information is about
- help you with privacy impact assessments and dealings with regulators, where they concern Orderfy
- tell you if we believe an instruction would break the law
4. Your obligations
You make sure you are allowed to collect the personal data you put in Orderfy and to have us process it, that your own privacy policy covers it, and that your instructions to us are lawful.
5. Sub-processors
We use only the sub-processors on the sub-processors page, each under a contract that requires at least the protection in these terms. We give you 30 days' notice of a new one. If you object on reasonable grounds and we can't resolve it, you may end the agreement before the change, without penalty. We remain responsible for what our sub-processors do.
6. Where data is kept
Your business data, in your own database, and its backups are kept in Australia.
Files and images you upload, and an encrypted off-site copy of backups, are kept in our storage provider's Oceania region. That region is made up of data centres in Australia and New Zealand: for example Sydney, Melbourne, Brisbane or Auckland. Providers open and close data centres over time, so the exact site can change, but it stays within Australia and New Zealand. These files are not stored in China, India, the United States, Europe or anywhere else outside that region.
Public images you choose to show, such as product photos on a quote, may be cached for a short time on the provider's network near whoever views them, as the images on any website are. Private files are never cached that way.
Some services we use run from overseas: sign-in identities, sending email and billing. The sub-processors page lists each provider and where it keeps data. Where personal information may go overseas, we take reasonable steps, as APP 8 requires, so that it is protected to the standard of the Australian Privacy Principles.
If you need the exact locations, for a tender, an audit or your own policies, ask us and we will tell you.
7. Data breaches
We tell you without undue delay after becoming aware of a breach affecting your personal data: what happened, what data is involved as far as we know, and what we are doing about it. We give you the information you need for your own assessment and notifications under the Notifiable Data Breaches scheme, and keep you updated.
8. Returning and deleting data
You can export your data at any time. When the agreement ends, we keep your data for 90 days so you can ask for an export, then delete it. Backups holding it expire within 30 days after that. We confirm deletion in writing if you ask. We keep only what the law requires us to keep, such as billing records.
9. Checking on us
We give you the information you reasonably need to check we are meeting these terms, including answers to security questionnaires. You may audit us once a year, at your cost and on reasonable notice, or after a breach affecting your data. An audit is carried out in business hours, under a duty of confidence, and without access to other customers' data.
10. International requirements
If a law outside Australia applies to your personal data and needs additional terms, tell us at privacy@orderfy.com.au and we will agree them with you.
Trade Sync Group Pty Ltd (ABN 65 668 818 791), trading as Orderfy · Unit 14 / 9 Bermill Street, Rockdale NSW 2216