Effective
1. About this policy
This policy explains how Orderfy handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Orderfy is operated by Trade Sync Group Pty Ltd (ABN 65 668 818 791), trading as Orderfy ("Orderfy", "we", "us"), of Unit 14 / 9 Bermill Street, Rockdale NSW 2216. Questions and requests go to privacy@orderfy.com.au or .
2. Two roles
Your business data. For the customers, suppliers, contacts, staff and records your business keeps in Orderfy, we act for your business, as its processor. We handle that information only to provide the service and as your business instructs, and your business's own privacy policy applies to the people in it.
Your account with us. For the people who contact us, sign in, pay the bills or talk to support, we decide how the information is handled, and this policy applies.
3. What we collect
- When you contact us: your name, business name, work email, phone number and message.
- When you use Orderfy: your name and work email, the identity you sign in with, when and from which IP address you sign in, and what you change (in your business's activity log).
- Billing: billing contact details and invoices. Card details go straight to our payment provider, named on the sub-processors page. We never see or store them.
- Support: what you tell us when you ask for help, and our notes about what we did.
- Connected systems: the credentials for systems you connect to Orderfy, stored encrypted (see "Connected systems and your keys").
- This website: nothing, unless you contact us. It sets no cookies and runs no analytics.
We collect personal information from you directly, or from the business that gave you access to Orderfy. We don't collect sensitive information, and ask that you don't send it to us.
4. How we use it
We use personal information to provide, secure and support the service, to answer requests, to bill, and to meet our legal obligations, such as keeping tax records. We count how the service is used (orders, seats, storage) to run it and to apply plan limits, but never read your records to do so.
We don't sell personal information, use it for advertising, or train artificial intelligence on your data. We don't use your business data for any purpose other than providing Orderfy to you.
If we send you news about Orderfy, every message has a way to stop them.
5. Who we share it with
We share personal information only with the suppliers that help us run Orderfy, listed on the sub-processors page, under contracts that require them to protect it; with professional advisers; and where the law requires it. If the Orderfy business is sold, information may pass to the buyer, under this policy.
6. Support access to your account
Orderfy's support team can access your Orderfy account, and the business data in it, to provide support and to keep the service running. That includes helping when you ask us to, and also looking into an account from time to time without being asked: when we're investigating a fault or an alert, checking the health of the service, or making sure a change or a fix has worked.
- Only authorised Orderfy staff can do this, and only through a support session that is limited in time and records who opened it and why.
- Sessions only look, unless a change is needed to fix a problem. Any change appears in your activity log as "System admin".
- Every session, and every page viewed in it, is recorded in our internal audit trail. Viewing isn't listed in your own activity log.
- Records your business keeps as HR records stay hidden from support unless your settings allow it.
- If your agreement with us restricts support access, we follow it.
7. Connected systems and your keys
When you connect another system to Orderfy, such as Xero, or Cin7 Core to bring your data across, Orderfy stores the credentials it needs (sign-in tokens, or an account ID and API key), encrypted. We use them only to do what you asked: to keep Xero in step, or to read your data from Cin7. Orderfy never changes anything in Cin7.
Our support team may use those credentials to help with an import or to look into a problem with a connection. We never show a stored key again, and you can disconnect at any time, which deletes it. Once an import is finished, we recommend you also revoke its key in the other system.
8. Where it is kept
Your business data, in your own database, and its backups are kept in Australia.
Files and images you upload, and an encrypted off-site copy of backups, are kept in our storage provider's Oceania region. That region is made up of data centres in Australia and New Zealand: for example Sydney, Melbourne, Brisbane or Auckland. Providers open and close data centres over time, so the exact site can change, but it stays within Australia and New Zealand. These files are not stored in China, India, the United States, Europe or anywhere else outside that region.
Public images you choose to show, such as product photos on a quote, may be cached for a short time on the provider's network near whoever views them, as the images on any website are. Private files are never cached that way.
Some services we use run from overseas: sign-in identities, sending email and billing. The sub-processors page lists each provider and where it keeps data. Where personal information may go overseas, we take reasonable steps, as APP 8 requires, so that it is protected to the standard of the Australian Privacy Principles.
If you need the exact locations, for a tender, an audit or your own policies, ask us and we will tell you.
9. How we protect it
Each business has its own database. Every request is checked against a signed identity, data is encrypted in transit and at rest, backups are encrypted and tested, and staff access is limited and logged. The security page has the detail.
10. How long we keep it
- Enquiries: while we are dealing with them, then up to 2 years.
- Your business's activity log: 7 years, the time businesses must keep financial records.
- Your business data: while you're a customer. After your account ends we keep it for 90 days, so you can ask for an export, then delete it. Backups holding it expire within 30 days after that.
- Billing records: as long as tax law requires, at least 5 years.
- System logs: 30 days. Security audit logs: at least 1 year.
- Keys for connected systems: until you disconnect, or your account is deleted.
11. Access and correction
You can ask for access to, or correction of, personal information we hold about you, at privacy@orderfy.com.au. We answer within 30 days, and there is no charge for asking. If the information is in a business's records in Orderfy (you're its customer or employee, say), ask that business. We help it answer.
You can deal with us without identifying yourself where that is practical, for example when asking a general question.
12. Complaints
Tell us first, at privacy@orderfy.com.au, and we will respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
13. Data breaches
If a data breach affects your business's data, we tell your business without undue delay and give it what it needs for its own assessment under the Notifiable Data Breaches scheme. We assess our own suspected breaches within 30 days, and notify the OAIC and the people affected when the law requires it.
14. Changes to this policy
We publish any change here. We tell customers about a material change by email at least 30 days before it takes effect.
Trade Sync Group Pty Ltd (ABN 65 668 818 791), trading as Orderfy · Unit 14 / 9 Bermill Street, Rockdale NSW 2216