Privacy Policy

Privacy Policy

Last updated on: 24 March 2025

Zap BI Limited (ACN 619 127 132) and Zap Technology Pty Ltd (ACN 093 757 745) (together Zap, we, us, our) provide a web-application as a hosted cloud service to assist businesses in the areas of business intelligence, data management, data warehousing, reporting and analytics. References to ‘you’, ‘your’ and ‘yours’ are to our customers and third parties.

We understand the importance of, and are committed to, protecting your personal information. This Privacy Policy explains how we handle your personal information (that is, information or an opinion about you, whether true or not, which identifies you or from which your identity is reasonably identifiable), including our obligations and your rights in respect of our dealings with your personal information.

Please take a moment to read our Privacy Policy as it describes what happens to your personal information that is collected via our website at https://www.zapbi.com (our Website), and in the course of providing our services to you.

This Privacy Policy is our general privacy policy, but additional privacy terms may apply, to deal with relevant laws in your jurisdiction (Jurisdiction Specific Terms). To the extent that they might differ from this Privacy Policy, the Jurisdiction Specific Terms for your jurisdiction will override the terms of this Privacy Policy.

Throughout this Privacy Policy, references to ‘personal information’ have the meaning given to it in the Privacy Act 1988 (Cth) (Privacy Act). It is also to used interchangeably with ‘personal data’ if your relevant jurisdiction is the European Economic Area (EEA) or United Kingdom. ‘Personal data’ has the meaning given to it in the European Union General Data Protection Regulations (EU Regulations 2016/679) (EU GDPR), or the United Kingdom General Data Protection Regulations (UK GDPR) created by the UK Data Protection Act 2018 (collectively, the GDPR).

1. Types of personal information we collect

The type of personal information we may collect can include (but is not limited to), your name, postal address, email address, phone numbers, billing information and, if applicable, employment information.

Where you do not wish to provide us with your personal information, we may not be able to provide you with requested services.

2. How we collect your personal information

We will collect and hold your personal information in a fair and lawful manner, and not in an intrusive way. Where it is reasonably practical to do so, we will collect your personal information directly from you.

We may collect the personal information you directly give us through some of the following means:

• when you make an inquiry, or use or register for our products and services (free or paid), or purchase and license our products through our Website;

• in administering and performing any contracts with service providers;

• when you contact us via telephone or email;

• from correspondence (whether in writing or electronically);

• through any mobile applications provided by our organization;

• while conducting customer satisfaction and market research surveys;

• when administering any of our services; and

• as otherwise required to manage our business

You can also log in to our site using sign-in services such as Azure Active Directory. These services will authenticate your identity and provide you the option to share certain personal information with us such as your name and email address to pre-populate our sign up form.

However, in certain cases we may collect personal information from publicly available sources and third parties, such as suppliers, recruitment agencies, contractors, our clients and business partners.

If we collect personal information about you from a third party we will, where appropriate, request that the third party inform you that we are holding such information, how we will use and disclose it, and that you may contact us to gain access to and correct and update the information.

3. Our purposes for handling your personal information

As a general rule, we only process personal information for purposes that would be considered relevant and reasonable in the circumstances.

We collect, hold, use and disclose personal information to:

• offer and provide you with our products and services;

• manage and administer those products and services, including account keeping procedures;

• communicate with you, including (but not limited to), emailing you tax invoices, dispatch and tracking information, returns and exchange authorisations;

• comply with our legal and regulatory obligations; and

• otherwise to manage our business.

We will not use or disclose your personal information for any other purpose unless you have consented to that use or disclosure.

We may disclose personal information between our organizations or to third parties such as our suppliers, organizations that provide us with technical and support services, or our professional advisers, where permitted by law. If we disclose information to a third party, we generally require that the third party protect your information to the same extent that we do.

4. Protection of personal information

We will hold personal information as secure physical records, electronically on our intranet system, in cloud storage, and in some cases, records on third party servers, which may be located overseas.

We maintain appropriate physical, procedural and technical security for our offices and information storage facilities so as to prevent any loss, misuse, unauthorized access, disclosure, or modification of personal information. This also applies to disposal of personal information.

We further protect personal information by restricting access to personal information to only those who need access to the personal information do their job. Physical, electronic and managerial procedures have been employed to safeguard the security and integrity of your personal information.

For more information about the range of policies in place to provide a robust security environment, please visit our Cloud security page. We ensure the on-going adequacy of these measures by regularly reviewing them.

We will destroy or de-identify personal information once it is no longer needed for a valid purpose or required to be kept by law.

If we experience a security breach where your personal information is lost, stolen, accessed, used, disclosed, copied, modified or disposed of by any unauthorized person or in an unauthorized manner, we will notify you as soon as reasonably possible. If you reasonably believe that there has been unauthorized use or disclosure of your personal information, please contact our Privacy Officer.

5. Direct marketing

Like most businesses, marketing is important to our continued success. We believe we have a unique range of products and services that we provide to customers at a high standard. We therefore like to stay in touch with customers and let them know about new opportunities. If you have opted to receive such emails may provide you with information about new products, services and promotions either from us,

You can, at any time, opt out of receiving marketing material by contacting us. If you are a customer, you agree and acknowledge that even if you opt out of receiving marketing material, we will still send you essential information that we are legally required to send you relating to the services we provide. Once you opt out of receiving marketing material from us, you agree and acknowledge that this removal from our distribution lists may take several business days after the date of your request to be removed.

In order to deliver our products and services to you, we may disclose personal information to other organizations to whom we outsource certain functions including bulk mailing and market research, but only in relation to providing our products and services to you. We take reasonable steps to ensure that these organizations are bound by privacy obligations in relation to the protection of your personal information.

We take our obligations to protect personal information very seriously and we make every effort to deal only with parties who share and demonstrate the same attitude.

We will not disclose your personal information to third parties for marketing purposes without your consent.

You may opt out at any time if you no longer wish to receive commercial messages from us. You can make this request by contacting our Privacy Officer, or by using the unsubscribe function included in each marketing email.

6. Cookies

A cookie is a small text file stored in your computer’s memory or on your hard disk for a pre-defined period of time. We use cookies to identify specific machines in order to collect aggregate information on how visitors are experiencing the Website. This information will help to better adapt the Website to suit personal requirements. While cookies allow a computer to be identified, they do not permit any reference to a specific individual. For more information on cookies, please visit our Cookie Notice.

7. Accessing and correcting your personal information

You may contact our Privacy Officer to request access to the personal information that we hold about you and/or to make corrections to that information, at any time. On the rare occasions when we refuse access, we will provide you with a written notice stating our reasons for refusing access. We may seek to recover from you reasonable costs incurred for providing you with access to any of the personal information about you held by us.

We are not obliged to correct any of your personal information if it does not agree that it requires correction and may refuse to do so. If we refuse a correction request, we will provide you with a written notice stating our reasons for refusing.

We will respond to all requests for access to or correction of personal information within a reasonable time.

8. Inter-jurisdictional transfers of personal information

From time to time we may also engage a recipient outside the country (or EEA, if relevant) in which your personal information was collected to provide cloud-based storage services to us. Please note that the use of these service providers to store personal information will not always involve a disclosure of personal information to that provider.

We may disclose your personal information to the following service providers:

As at the date of this Privacy Policy, after we collect your personal information we are not likely to disclose personal information to other recipients outside of your jurisdiction, unless you direct us to send your information to a particular recipient located outside of your jurisdiction. The countries in which these recipients will be located will be the countries nominated by you in accordance with your request. If in future we do propose to disclose personal information outside of your jurisdiction, we will, where practicable, advise you of the countries in which any of these recipients outside of your jurisdiction are likely to be located.

By providing your personal information to us, you consent to us disclosing your personal information to any such recipients outside of your jurisdiction for purposes necessary or useful in the course of operating our business.

If you do not want us to disclose your information to recipients outside of your jurisdiction, please let us know.

9. Resolving personal information concerns

If you have any questions, concerns or complaints about this Privacy Policy, or how we handle your personal information, please contact our Privacy Officer:

The Privacy Officer

Zap Technology Pty Ltd.

85 Dundas Place, Albert Park, 3206 VIC. Australia

Email: privacy@zapbi.com

We take all complaints seriously, and will respond to your complaint within a reasonable period.

10. Take down notices

Although we reserve the right to screen or monitor content on our systems, we generally do not do so. If you discover content that you believe should be taken down, you may file a complaint.

Your take down request must include specific information about the allegedly offending content. If your complaint is about copyright, trademark, or publicity rights infringement you must be the copyright owner.

Upon receiving a request:

• If the complaint claims infringement of copyright, we will promptly remove the content while we evaluate the complaint.

• If the complaint claims (1) infringement of trademark, privacy, or publicity rights, or (2) that the content is obscene, child pornography, or depicts the exploitation of children, we may, in our discretion, remove the content.

• If the complaint makes some other claim, we may, in our discretion, take down the content while the complaint is evaluated. However our default position will be to not take down content while we evaluate the complaint.

• If we do take down content, we’ll notify the user who posted it.

Where contacting us, you have the option to remain anonymous or use a pseudonym. However, this right will not apply if it is impracticable for us to communicate with you that way or where we are required or authorized by law to only deal with individuals who have identified themselves.

Questions, requests or complaints should be made in writing by email at privacy@zapbi.com.

11. Consent

By your use of our website and our products or services, you consent to the collection, use, storage, disclosure and management of your personal information in accordance with the Policy and as otherwise permitted by the Regulations.

12. Changes

We reserve the right to change the terms of this Privacy Policy from time to time, and we will strive to notify you of such changes.

The last update to this document was: 13 September 2024.

13. Jurisdiction-specific terms

(a) Australia

As an Australian company we are bound by the Privacy Act. In addition to the terms of the Privacy Policy, please note the following:

Overseas transfers of personal information

By providing your personal information to us, you consent to us disclosing your personal information recipients outside of Australia as set out in our Privacy Policy, and agree that APP 8.1 will not apply to such disclosures. For the avoidance of doubt, in the event that an overseas recipient breaches the APPs, that entity will not be bound by, and you will not be able seek redress under, the Privacy Act.

If you are dissatisfied with the handling of your complaint, you may contact the Office of the Australian Information Commissioner:

Office of the Australian Information Commissioner

Address: GPO Box 5218. Sydney NSW 2001

Telephone: 1300 363 992

Email: enquiries@oaic.gov.au

-----------------------------------------------------------------------------

(b) Europe (European Economic Area) and the United Kingdom

As a European resident or entity, or to the extent the EU GDPR applies, we are bound by the requirements of EU GDPR.

As a United Kingdom resident or entity, or to the extent the UK GDPR applies, we are bound by the laws of the United Kingdom or of a part of the United Kingdom. This includes any UK GDPR created by the UK Data Protection Act 2018 on the UK’s exit from the European Union.

In addition to the above terms of the Privacy Policy, we have taken the following measures to ensure full compliance with the GDPR:

(i) Zap’s role in GDPR compliance

Zap acts as a data processor within the realm of GDPR compliance. Zap is responsible for safeguarding the data of partners or customers’ users as it flows through our services.

(ii) Customer’s role in GDPR compliance

As a Zap customer (or partner), you are a data controller within the GDPR. This means that throughout the time of your subscription to our services, you retain ownership of and control of your customer or user data.

You will want to pay attention to the following non-exhaustive list of items:

(A) Perform your own research, audit, internal training and strategy steps within your company to ensure you understand GDPR and how it applies to your business.

(B) Ensure your terms and privacy policies are up to date.

(C) If you are an organisation located in the EEA, and/or need to be GDPR compliant, you may request to sign our EU Data Protection Agreement (DPA).

(D) Be mindful of the amount of personal data that may be processed in a Zap model and limit it as much as possible.

Also ensure that users’ consent is handled appropriately.

(iii) What is a DPA?

This is an agreement that Zap offers, that governs the relationship between the customer (acting as a data controller) and Zap (acting as a data processor). The DPA facilitates Zap’s customers’ compliance with their obligations under the GDPR.

Our DPA contains data transfer frameworks to ensure that our customers can lawfully transfer personal data to Zap outside of the European Union by relying on one of these mechanisms: Binding Corporate Rules, or Standard Contractual Clauses. You may download this DPA by clicking this link.

(iv) Zap’s third-parties/sub-processors

A sub-processor is a third-party data processor engaged by Zap, including entities from within Zap, who has or potentially will have access to or process service data (which may contain personal data). Zap uses different types of sub-processors to perform various functions in order to operate its service.

Zap requires its sub-processors to satisfy equivalent obligations as those required by Zap (as a data processor). Zap maintains an up-to-date list of the names and locations of all sub-processors used for hosting or other processing of service data.

Zap owns or controls access to the infrastructure used to host the service and customer data. The infrastructure and service sub-processors include the following service providers in which Zap may disclose personal information as set out above in the Privacy Policy:

(A) Microsoft Azure;

(B) Microsoft Dynamics 365;

(C) Zendesk.

The following sub-processors may be used by Zap employees to store the minimum relevant set of data required to perform a specific function:

(v) Overseas transfers of personal information

Zap is subject to the above EEA and United Kingdom data protection terms outlined at clauses 13(b)(i) and 13(b)(iv) to protect data in accordance with EU and UK data protection laws. In each case, such transfers are made in accordance with the requirements of the regulations and may be based on the use of the UK or European Commission’s Standard Model Clauses for transfers of personal data outside the EEA or the UK.

By using our website, products or services or by interacting with us in the ways described in this Privacy Notice, you consent to the transfer of your information outside the EEA or UK in the circumstances set out in this Privacy Notice. If you do not want your information to be transferred outside the EEA or UK, you should not use our website, applications or services.

-----------------------------------------------------------------------------

(c) South Africa

As a South African user or entity, we are bound by the Promotion of Access to Information Act, 2000 (POPIA).

In addition to the above terms of the Privacy Policy, please note the following:

Overseas transfers of personal information

By using our website, products or services or by interacting with us in the ways described in this Privacy Notice, you consent to the transfer of your information outside South Africa in the circumstances set out in this Privacy Notice. In addition to personal data transfers outside of South Africa. The business data of your organization will be processed in a Microsoft Azure datacentre located in the EEA. If you do not want your information to be transferred outside South Africa, you should not use our website, applications or services.