Privacy & Cookies Policy

Arimsys Pty Ltd (ABN 62 672 927 454), trading as ProvenTrack (we, us), provides product passports and supply-chain traceability services. This policy explains personal information handling through our website, business accounts, product records, public passports, QR pages, uploads, billing, support and related operations.

It covers business representatives, account users, suppliers and other people identified in uploaded records, website visitors and people viewing product passports. We comply with the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs) where they apply. We also honour the commitments made in this policy. This statement does not represent that we are voluntarily registered under the Privacy Act unless we have actually opted in.

Personal information concerns an identified or reasonably identifiable individual. Product specifications and corporate records are not necessarily personal information, but a sole trader's details, an employee's name, a photograph or a farm address may identify someone. Confidential commercial information is separately addressed in our Terms of Service.

Depending on how you interact with us, information may include:

We seek to collect only information reasonably necessary for our functions. We do not intentionally seek sensitive information, such as health information or government identifiers, through ordinary product records. Customers should not provide such information unless necessary, lawful and specifically agreed with us. Where applicable, additional legal requirements, including consent requirements for sensitive information, must be satisfied.

If we receive unsolicited personal information, we assess whether it could lawfully have been collected. Where required, we destroy or de-identify information we cannot lawfully retain, when lawful and reasonable to do so.

We collect information directly when you register, manage an organisation, submit records, upload files, pay, contact us or exercise privacy rights. We also collect information from organisation administrators, business Customers and authorised suppliers who provide records about other people; from payment and operational providers; and automatically when our pages and Services are used.

Customers must give relevant notices and obtain permissions where required before submitting another person's information. Their responsibility does not remove ours. Where the APPs apply, we take reasonable steps to notify people about relevant collection circumstances as required, including where information is received indirectly.

We do not operate a general programme of collecting personal profiles from public websites for resale or AI training. If collection practices materially change, we will reassess lawfulness and provide the required notices before the new activity.

You can generally view public passports without an account and can make general enquiries anonymously or under a pseudonym where practicable. Technical request data may still be processed to deliver and protect a page. Identity and business-contact details are needed to administer business accounts, process payments and respond securely to some requests.

If necessary information is not provided, we may be unable to create an account, deliver a feature or resolve a request. Optional fields will be identified where relevant. You can choose not to publish a passport and can manage permissions through available account controls.

We use personal information as reasonably necessary to:

• Establish accounts, authenticate users and manage organisation access.
• Store and display Customer-authorised product and supply-chain information.
• Operate passports, QR links, evidence files and requested analytics.
• Process billing, support requests and account communications.
• Maintain activity records, prevent abuse, investigate incidents and protect the Services.
• Diagnose problems and improve service usability and reliability without treating that purpose as blanket permission for unrelated data reuse or AI training.
• Meet legal obligations, handle complaints, resolve disputes and establish or defend legal rights.

We use or disclose personal information for the purpose for which it was collected, or another purpose permitted by applicable law. If a proposed use needs consent, we obtain it separately. A business customer's instruction does not automatically authorise every use of information about an individual.

Authorised Customers choose which records and documents to publish. A public passport may display product details, origins, locations, production stages, certification information, sustainability information and supporting evidence. Published material can be viewed without an account and may be downloaded, indexed, copied, cached or redistributed worldwide.

Customers should check the public preview and sharing settings, remove unnecessary personal information and confirm the right to publish documents and third-party marks. Removing a record from ProvenTrack does not guarantee removal of copies elsewhere. Private records must not be treated as public merely because a related passport is published.

If your personal information appears in a passport and you have concerns, contact us with the passport URL and relevant details. We will assess the concern, contact the relevant Customer where appropriate and consider correction, restriction or removal. We will not refuse to assess a privacy concern merely because the Customer supplied the information.

Viewing a QR-linked passport can generate records including the product reference, timestamp, source, user-agent and an IP-derived identifier. A network address may be processed to deliver the request, prevent abuse or derive a hash. Hosting, CDN and security services may also record network addresses under their configured logging arrangements.

An IP-derived hash is not necessarily anonymous. Combined technical data can sometimes identify or distinguish an individual, so we protect it accordingly. A scan does not necessarily represent a purchase, a unique person or a precise physical location.

Business Customers receive aggregated scan statistics rather than raw IP addresses, persistent viewer identifiers or viewer-level browsing histories. Authorised administrators may see identifiable staff account activity necessary to manage their own organisation.

We do not currently use QR analytics for behavioural advertising or cross-site advertising profiles. We do not sell personal scan histories or identify viewers to brands for direct marketing. Any proposed materially different tracking will require a fresh privacy assessment, notices and consent where required.

We use essential session and authentication technologies for secure access. The localStorage key provena-landing-theme remembers appearance preferences. These technologies do not themselves authorise advertising or AI training.

Cloudflare Turnstile may process device and network information for bot protection. Upstash may support rate limiting. Stripe-hosted checkout uses Stripe's technologies. Map features may load OpenStreetMap/Nominatim or CARTO resources; Google-hosted fonts or resources may also be loaded. External requests can disclose network addresses, user-agent data and requested resource information to those providers. Geocoding may disclose the location submitted for a lookup. We will minimise unnecessary information sent in such requests.

You can manage cookies and site storage in browser settings, but disabling essential technologies can prevent sign-in or other features. We will explain optional tracking and provide choices or obtain consent where required before introducing it. We do not rely on a statement that “all use is consent” to optional tracking.

We may disclose information, limited to what is reasonably necessary, to:

• Authorised users of the relevant organisation according to their permissions.
• The public, for information deliberately selected for public publication.
• Contracted hosting, storage, database, email, payment, security, support and analytics providers.
• Professional advisers, insurers and service providers assisting with a specific legal, security or business need under appropriate confidentiality arrangements.
• Regulators, courts, law-enforcement bodies or others where disclosure is legally required or otherwise lawfully justified.
• A prospective or actual business successor where lawful and necessary, subject to appropriate due-diligence confidentiality and data-protection safeguards.

Operational providers currently identified include AWS/S3, MongoDB, Stripe, Resend, Upstash, Cloudflare, mapping/resource providers and hosting/CDN providers.

We select providers with appropriate contractual, security and privacy safeguards. Providers acting on our behalf may access information only as needed for agreed services and lawful obligations. Some providers, such as payment services, also handle information for their own disclosed purposes; we assess those arrangements and do not imply that a link to their policy removes our responsibilities.

Information may be stored, accessed or otherwise handled in Australia and overseas. The relevant locations depend on hosting regions, provider operations, remote support and subprocessors. Australian hosting alone does not guarantee that no overseas access occurs.

We assess whether an arrangement is an overseas disclosure or a use under our effective control. Where APP 8 applies, we take reasonable steps required by that principle and recognise accountability under Australian law where applicable. We do not treat acceptance of this policy as a waiver of overseas-disclosure protections. Global public access to deliberately published passports is explained separately in section 6.

We do not currently use Customer Content, uploaded evidence, personal account information or identifiable scan records to train or fine-tune AI models, and do not authorise our providers to do so.

Before any future training involving Customer Content, we will explain the proposed dataset, purposes, model/provider, who benefits, retention and practical withdrawal/deletion limits, and seek a separate express agreement from the Customer. We will also establish any necessary lawful basis, notices and individual permissions for personal information. A Customer's opt-in cannot replace another individual's consent where required. Public availability of a passport does not itself authorise unrestricted training.

If optional AI features are introduced without model training, we will explain relevant processing and provider handling before activation. We will assess security, confidentiality and overseas handling and update relevant notices. Declining optional model training will not prevent access to the core subscribed service.

New categories of collection or materially different uses will be assessed before introduction. Updating this policy or asking users to acknowledge it is not, by itself, consent to an otherwise unauthorised use.

We may use aggregated or appropriately de-identified statistics for internal analytics, capacity planning, security and business reporting. We consider whether people can reasonably be identified from the data alone or combined with other available information. Hashing and removing names are not automatically sufficient.

We apply access and use restrictions appropriate to the re-identification risk and do not attempt re-identification. If information remains personal information, we continue to treat it as such. Removing personal identifiers does not remove obligations to protect customer-confidential business information. This clause does not authorise external dataset sales or AI training.

We use reasonable technical and organisational safeguards appropriate to the information and risks, including protected credentials, authenticated sessions, role-based access, restrictions on uploads and administrative access, and security/activity records. We review provider access and maintain incident-response arrangements.

No internet service is completely secure. If an incident occurs, we assess and take reasonable containment, investigation and remediation steps. Where the Notifiable Data Breaches scheme applies, we notify the OAIC and affected individuals as required. We also notify Customers of confirmed unauthorised access to their content in accordance with our Terms, without treating customer notification as a substitute for statutory duties.

We retain personal information only for as long as reasonably needed for a permitted purpose, including service delivery, lawful record keeping, security and specific disputes. Business ownership of a record is not, by itself, a reason to retain unnecessary personal information indefinitely. We review retained information and take reasonable steps to destroy or de-identify it when no longer required, subject to applicable legal requirements.

The schedule for proposed standard arrangements will be kept with ProvenTrack and updated depending on the needs.

Account closure and organisation termination are different events. An organisation may retain necessary business records after a representative leaves, but requests concerning that person's information will still be assessed. Public copies held by others may remain outside our control. We will explain relevant retention limits when responding to a request.

You may request access to or correction of your personal information through account controls, Privacy & Data settings where available, or our contact details below. People without accounts can use the same public contact channels. You may also request deletion; Australian privacy law does not provide an unconditional right to erase every record on demand.

We may reasonably verify identity and authority using proportionate information. We will not require excessive identity documents as a routine condition. We may consult the relevant organisation, but it does not have an automatic veto over your statutory rights.

We aim to respond within 30 calendar days, or explain any delay and expected next steps, subject to applicable legal timeframes. We do not charge for making an access request or seeking correction. If a lawful, reasonable access-processing charge is proposed, we will explain it in advance. If access, correction or deletion is refused or limited, we will explain the basis and complaint options where required. Where applicable, you may ask for a statement of disputed accuracy to be associated with the record.

We send necessary account, security, billing and support communications. We do not avoid marketing rules by adding promotions to messages labelled operational.

Where we send electronic marketing, we obtain the consent required by the Spam Act 2003, identify the sender and provide a clear, functional unsubscribe method. We honour unsubscribe requests within five working days, without requiring a fee, login or unnecessary personal details. You can also contact us to opt out. A minimal suppression record may be retained to respect that preference.

Business accounts are intended for adults. Public passports may be viewed by children, but are not designed to collect children's profiles. Customers must avoid unnecessary information about children in uploads. If we become aware of inappropriate collection or publication, we will assess and take appropriate corrective action.

Authentication, validation, plan limits, rate limiting and bot protection use automated technical rules. These processes support operation and security. Contact us if a control appears to have affected you incorrectly; we will assess the issue and provide a review where appropriate.

We do not currently use personal information for automated decisions that could reasonably be expected to significantly affect an individual's rights or interests. If such use is introduced, we will meet applicable transparency obligations and explain the relevant personal information and decision types. These obligations are separate from consent requirements for any underlying use.

Contact our privacy contact below with the issue, relevant passport/account details and preferred outcome. We will acknowledge complaints within five business days, investigate fairly and aim to provide a substantive response within 30 calendar days. If additional time is reasonably needed, we will explain why and provide an expected response date.

Where Australian privacy law applies, you can complain to the Office of the Australian Information Commissioner if the issue is not resolved. Information about its process is available at https://www.oaic.gov.au/privacy/privacy-complaints. Other statutory complaint and legal rights are preserved. We will not require an account to raise a privacy concern.

We will update this policy when practices or legal requirements change, display the effective date and give reasonable direct or prominent notice of material changes where practicable. Changes describe lawful practices; they do not retrospectively authorise an unlawful collection or use. Where consent is required, we obtain it separately before the relevant new processing.

Privacy Contact — Arimsys Pty Ltd / ProvenTrack
ABN 62 672 927 454
Ground Floor, 470 St Kilda Rd, Melbourne VIC 3004, Australia
Website: https://proventrack.com.au/ — use the Contact form.