Privacy Policy

Kookaburra Operating System, ABN 81 480 225 391, operating as KookaburraOS (“KookaburraOS”, “we”, “us” or “our”), provides a cloud-based business operating platform for small businesses.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information when people use:

• the KookaburraOS website;
• the KookaburraOS software platform and related applications;
• public inquiry forms, booking forms and widgets;
• customer portals and online storefronts;
• APIs and connected services;
• our support, sales and administrative services; and
• any other service that refers to this Privacy Policy.

We intend to handle personal information consistently with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable Australian privacy laws.

This policy applies to personal information concerning:

• prospective and existing KookaburraOS customers;
• business owners and account administrators;
• employees, contractors and other authorised users;
• website visitors;
• individuals who contact KookaburraOS;
• customers and prospective customers of businesses using KookaburraOS;
• suppliers, professional advisers and business partners; and
• people whose information is provided through an enabled integration.

KookaburraOS is principally intended for business use and is not directed to children.

KookaburraOS handles personal information in two principal capacities.

The information we collect depends on how a person interacts with KookaburraOS and which features are enabled.

Some KookaburraOS customers may operate in industries where information entered into the platform could constitute sensitive information under Australian law.

We ask subscribing businesses not to collect or enter sensitive information unless:

• it is reasonably necessary for their lawful business activities;
• they have obtained any consent required by law;
• they have provided appropriate privacy notices;
• use of the relevant KookaburraOS feature is appropriate for that information; and
• any industry-specific legal and security requirements have been considered.

We will collect sensitive information directly for our own purposes only where consent has been obtained or another lawful basis applies.

We may collect personal information:

• directly from the individual;
• when an account is registered;
• when a form is completed;
• when someone communicates with us;
• from an employer or business that creates an account for an authorised user;
• from a subscribing business using KookaburraOS;
• through an enabled integration;
• through payment and authentication providers;
• through cookies, logs and analytics technologies; and
• from publicly available sources where lawful and appropriate.

Where it is lawful and practical, a person may interact with us anonymously or using a pseudonym. Identification will generally be required to create an account, process a subscription, access business data or exercise account-related rights.

We may use personal information to:

• provide, operate and maintain KookaburraOS;
• create and authenticate accounts;
• establish user permissions;
• process inquiries, bookings, quotes, invoices, orders and other workflows;
• operate enabled integrations;
• process subscriptions and payments;
• provide technical and customer support;
• send service, security and administrative communications;
• detect and prevent fraud, misuse and security threats;
• maintain logs and audit records;
• troubleshoot and improve reliability;
• understand feature usage;
• develop and improve the platform;
• comply with legal, regulatory and contractual obligations;
• investigate complaints and disputes;
• enforce our Terms of Service;
• protect our users, KookaburraOS and other people;
• send marketing communications where permitted; and
• conduct business planning, reporting and analysis.

Where practicable, we use aggregated or de-identified information for analytics, planning and product improvement.

We do not sell personal information to data brokers.

We may disclose personal information:

• to the subscribing business that controls the relevant account;
• to account owners, administrators and authorised users;
• to hosting, infrastructure and security providers;
• to authentication providers;
• to payment providers;
• to email, SMS and communications providers;
• to analytics and error-monitoring providers;
• to providers of integrations selected by the tenant;
• to professional advisers, auditors and insurers;
• to contractors assisting with support or platform operations;
• where required or authorised by law;
• to courts, regulators or law-enforcement authorities;
• to protect the rights, safety or security of KookaburraOS or another person; or
• in connection with a proposed or completed sale, merger, financing or restructuring of the business.

Service providers are permitted to handle personal information only for the relevant services they provide, subject to their contractual and legal obligations.

KookaburraOS uses cloud infrastructure and technology service providers that may process personal information outside Australia.

Personal information may be processed in:

• Australia;
• the United States; and
• other countries in which our cloud, security, communications, payment or integration providers operate.

Some global network services may process limited technical information in multiple locations to provide security, content delivery and reliability.

Where Australian privacy law applies, we take reasonable steps appropriate to the circumstances to ensure overseas recipients handle personal information consistently with applicable privacy requirements.

A current list of material service-provider locations may be requested by contacting us.

We use technical and organisational safeguards appropriate to the nature of the information and the risks involved.

These safeguards may include:

• encryption in transit;
• access controls;
• authentication controls;
• role-based permissions;
• tenant-data separation;
• logging and monitoring;
• backups and recovery procedures;
• vulnerability and dependency management;
• security reviews;
• restricted administrative access; and
• incident-response procedures.

No internet transmission or storage system is completely secure. Users are responsible for protecting their passwords, devices, login methods and authorised-user access.

A user who suspects unauthorised access should contact us immediately.

We retain personal information only for as long as reasonably necessary for:

• providing the Services;
• maintaining an account;
• fulfilling the purpose for which the information was collected;
• maintaining security and audit records;
• meeting legal, tax, accounting and regulatory obligations;
• resolving disputes; and
• enforcing agreements.

Customer Data is retained in accordance with the tenant’s instructions, account status, product settings and applicable legal obligations.

Following termination of a tenant account, Customer Data may remain recoverable for up to 30 days, unless:

• the tenant requests earlier deletion;
• a longer period is required by law;
• the information is required for a dispute or security investigation; or
• the information remains temporarily in protected backups.

Information retained in backups will be isolated from ordinary use and removed or overwritten in accordance with our backup-retention cycle.

We may retain aggregated or irreversibly de-identified information.

KookaburraOS may use cookies and similar technologies for:

• authentication;
• maintaining sessions;
• remembering preferences;
• security and fraud prevention;
• measuring website performance;
• diagnosing errors; and
• understanding feature usage.

Some cookies are necessary for the website or platform to operate. Users may control non-essential cookies through available consent settings or browser controls.

Disabling necessary cookies may prevent parts of KookaburraOS from functioning.

We may send information about KookaburraOS products, updates and offers where:

• the individual has consented;
• consent may reasonably be inferred; or
• another lawful basis permits the communication.

Marketing emails and SMS messages will identify the sender and include a method for unsubscribing.

Unsubscribe requests will be honoured within the period required by law.

Service, security, billing and account-administration messages are not marketing messages and may still be sent where necessary to provide the Services.

Tenants using KookaburraOS to communicate with their customers are responsible for complying with the Spam Act 2003, the Do Not Call Register Act 2006 and other applicable marketing laws.

A person may request:

• access to personal information we hold about them;
• correction of inaccurate, incomplete, out-of-date or misleading information;
• deletion of information where applicable;
• information about how their data has been handled; or
• disconnection of an enabled integration.

Requests may be submitted to [email protected].

We may need to verify the requester’s identity before taking action.

Access or deletion may be refused or limited where permitted or required by law, including where information concerns another person, is required for legal proceedings, must be retained by law or cannot reasonably be separated from protected records.

Where the requested information is controlled by a subscribing business, we may refer the request to that business or assist it in responding.

We aim to respond to privacy requests within 30 days.

Users may request deletion of information obtained through a connected Meta, Google, Microsoft or other third-party account by:

1. disconnecting the service through KookaburraOS;
2. revoking KookaburraOS access through the provider’s account settings; and
3. submitting a deletion request to [email protected].

The request should include:

• the user’s name;
• business or tenant name;
• account email address;
• connected service;
• description of the information to be deleted; and
• any relevant account, page or connection identifier.

We will verify the request and delete or de-identify information we control, subject to lawful retention requirements.

Where the information forms part of a tenant’s Customer Data, the tenant may need to authorise the deletion.

We maintain procedures for identifying, assessing and responding to suspected data breaches.

Where a breach is likely to result in serious harm and notification is required under Australian law, we will notify affected individuals and the Office of the Australian Information Commissioner as required.

We may also notify affected tenants where their Customer Data is involved so they can meet their own obligations.

KookaburraOS may offer automation features that:

• extract information from inquiries or communications;
• classify or organise records;
• identify possible duplicates;
• recommend workflow actions;
• generate draft text or summaries;
• assist with scheduling, reporting or reconciliation; or
• flag records for user review.

These features are intended to assist authorised users. Unless clearly disclosed otherwise, they are not intended to make decisions that have legal or similarly significant effects about an individual without meaningful human review.

Automated outputs may be incomplete or inaccurate and should be reviewed by an authorised user before being relied upon.

If we introduce automated decisions that could significantly affect individuals, we will update this Privacy Policy and provide additional information about the types of information and decisions involved.

KookaburraOS is a business platform and is not intended for independent use by people under 18 years of age.

A tenant must not create an authorised-user account for a minor unless lawful, appropriate and supervised by an adult with authority to do so.

Where a tenant collects information about children through its own services, the tenant is responsible for obtaining required consents and complying with applicable child-safety and privacy requirements.

Privacy complaints should be sent to:

Please include sufficient information for us to understand and investigate the complaint.

We will acknowledge the complaint and aim to provide a substantive response within 30 days.

A person who is not satisfied with our response may be entitled to complain to the Office of the Australian Information Commissioner.

We may update this Privacy Policy to reflect:

• changes to the Services;
• new integrations;
• changes to our information-handling practices;
• legal or regulatory developments; or
• security and operational requirements.

The current version will be published at /privacy.

Where a change materially affects how we handle existing personal information, we will provide reasonable notice and obtain consent where required by law.

Questions about this Privacy Policy or our information-handling practices may be directed to: