Terms of Service

ProvenTrack is operated by Arimsys Pty Ltd (ABN 62 672 927 454), Ground Floor, 470 St Kilda Rd, Melbourne VIC 3004, Australia (ProvenTrack, we, us).

These Terms govern business accounts and use of our platform, dashboards, product passports, QR services, uploads, APIs, analytics and related services (Services). The Customer is the business or individual subscribing. An authorised representative accepts these Terms for the Customer during registration or another express acceptance process. Business users must be at least 18 and authorised to act for the Customer. Public visitors do not become subscription customers merely by viewing a passport; sections describing information limitations explain how passports should be understood.

An order form expressly agreed by both parties prevails over these Terms to the extent of an identified inconsistency. The Privacy & Cookies Policy explains personal information handling; acknowledging it is not blanket consent to optional uses. Mandatory legal rights always prevail.

ProvenTrack helps businesses record and communicate product origins, production methods, supply-chain stages, certification details and supporting evidence through digital passports. Features and limits depend on the selected plan.

Unless a separate written service description expressly states otherwise, we are a technology provider, not a manufacturer, seller, importer, regulator, certifier, auditor, laboratory or independent verifier. A passport does not itself establish compliance with an Australian or overseas product-passport regime, certification scheme or industry standard. The Customer must determine the requirements relevant to its products and markets.

We will provide the Services with reasonable care and skill and comply with applicable laws. No provision transfers our own legal responsibilities to the Customer.

The Customer must provide current registration and billing information, protect credentials, assign appropriate permissions, promptly remove departing users and notify us of suspected compromise. It is responsible for authorised users' conduct within their authority, except to the extent a loss is caused by our breach, negligence or unlawful conduct.

Organisation administrators control business records and access. An individual's departure or account closure does not automatically delete organisation records. We may reasonably verify authority before changing ownership, granting access, exporting records or resolving competing instructions. We will not knowingly disclose one organisation's private records to another without lawful authority.

Customer Content means product and supply-chain records, images, documents, certificates, reports, CSV imports and other material supplied by or for the Customer. The Customer retains its rights in that material. Third-party rights remain with their owners.

The Customer must have the rights and lawful authority needed for the particular upload, processing and publication it requests. This includes relevant copyright, confidentiality, privacy and certification-mark permissions. Possession of a certificate does not necessarily authorise reproduction of its logo or the entire document.

The Customer must not upload information that is unnecessary for the service purpose. Sensitive personal information, identity documents, banking details, private addresses, signatures and information about children must not be uploaded unless necessary, lawful and agreed with us in advance. Customers must inspect files, embedded metadata and public fields and redact unnecessary information.

The Customer grants us a non-exclusive licence to host, store, copy, format, transmit, back up and otherwise process Customer Content as reasonably necessary to provide and secure the Services, follow authorised instructions and meet legal obligations. We may allow contracted providers to do these things only for those purposes and subject to appropriate safeguards.

We may publish only content selected for publication by an authorised user, or otherwise lawfully required to be disclosed. This licence does not authorise selling Customer Content, publicising private supplier relationships, or training AI models as a general service-improvement activity.

The licence ends when the relevant processing is no longer needed, except for the limited continuation needed for agreed exports, lawful retention, security records and backup expiry under section 17. It does not permit continued public display after the Customer withdraws publication, except where law requires it.

The Customer decides what to publish and must review the public presentation, supporting files and sharing settings before publication. Published information may be copied, indexed, cached or redistributed by others. Removing it from our systems cannot recall copies already obtained elsewhere.

A QR code links to information. It does not prove product authenticity, uninterrupted physical custody, ownership, safety or certificate validity. Codes can be copied or placed on other items. Customers should test printed codes and use any additional controls needed for their products.

Publication does not guarantee permanent hosting. Availability after cancellation or closure is governed by section 17 and any expressly agreed archive plan. We will not knowingly reassign a retired customer passport URL to an unrelated product.

The Customer is responsible for having reasonable grounds for its product, origin, ethical-sourcing, certification and environmental claims and for keeping them accurate and current. Evidence must relate to the relevant product, batch, facility, activity and period. Customers must promptly correct material errors and expired, withdrawn or suspended certification claims.

Environmental claims must clearly identify relevant scope, units, methodology, assumptions, estimates, boundaries and material limitations. Customers must not imply that a limited certification covers an entire product or supply chain, or that displaying records establishes a broader environmental benefit.

“Business-provided”, “document supplied” and similar labels identify the source or presence of information, not independent verification. Uploading a certificate does not establish its authenticity or continuing validity. If we offer a particular verification service, its statement will identify who checked what, when, and the scope and limitations. No broader assurance should be inferred.

Passports supplement required labels, safety warnings, recall communications and official records; they do not replace them. The Customer remains responsible for its products and applicable food, consumer-product, import, labelling and other requirements.

Customers must promptly notify us of materially misleading, unsafe, unlawfully disclosed or disputed content. Anyone may report a passport using the contact channel in section 26, identifying its URL and the concern. We may request evidence, flag disputed content, restrict publication or remove material where reasonably necessary. Where practicable, we will explain the action and allow a response or review. Urgent protective action may occur first. We do not undertake to audit every record, and leaving content online is not endorsement.

Each party must protect the other's non-public information reasonably understood to be confidential and use it only to perform this agreement, exercise its rights or meet legal obligations. This includes unpublished supplier relationships, production methods, pricing, contracts and evidence. We will not use private Customer Content to create identifiable competitor intelligence.

Disclosure is permitted to personnel, advisers and contracted providers who need access and are subject to appropriate confidentiality obligations, or as required by law. Where lawful and practicable, the disclosing party will notify the other of compelled disclosure. Reasonable care must be taken to limit disclosure.

These duties do not apply to information lawfully public without breach, independently developed, lawfully received without restriction or already lawfully known. Customer-selected publication removes confidentiality only for the information actually published. Confidentiality continues after termination while the information remains confidential.

Each party must meet its own applicable privacy obligations. Customers must provide required collection notices and obtain any permissions necessary for information about employees, suppliers and other people. We remain responsible for our own handling of that information.

We will maintain reasonable technical and organisational safeguards appropriate to the information and risks, including access controls and appropriate provider arrangements. No system is completely secure. We will assess and respond to suspected incidents and notify affected Customers without undue delay after confirming unauthorised access to their Customer Content where notification is reasonably necessary to protect them or meet legal obligations. Notices may be staged as facts emerge and will not be delayed merely because an investigation is incomplete. Statutory reporting duties apply separately.

We may process operational records and scan events to provide analytics, protect the Services and diagnose performance. Scans can include repeats, automated traffic and shared devices; they do not necessarily establish purchases, unique people or precise locations.

Customer-facing scan reports will be aggregated and will not expose raw IP addresses, persistent viewer identifiers or viewer-level browsing histories. Authorised organisation administrators may see account activity needed for business administration and auditing.

We may use aggregated statistics for internal service analytics, security, capacity planning and business reporting only where individuals cannot reasonably be identified and customer-confidential information is not disclosed or reasonably inferable. We will not attempt to re-identify such statistics. External benchmarking, dataset sales and AI training require separate rights and safeguards; this clause does not authorise them.

We do not currently use Customer Content to train or fine-tune AI models, or authorise providers to do so. Before introducing such use, we will obtain a separate express opt-in agreement identifying the dataset, purpose, model/provider, beneficiaries, ownership and use rights, retention, withdrawal arrangements and practical limits of removing information from trained models. Publishing a passport or accepting these Terms is not AI-training consent.

The Customer's agreement does not replace permissions required from rights holders or individuals. We will assess those requirements separately. Declining optional training will not prevent access to the core subscribed service.

If future optional AI features process Customer Content without training, we will explain the processing, provider handling, limitations and relevant privacy changes before activation. AI-generated statements must not be presented as certification or independent verification without a valid basis.

Customers and users must not use the Services for unlawful activity, deception, counterfeiting, unsupported claims, infringement, unlawful surveillance, malware, unauthorised access or interference with others. They must not bypass access restrictions or use automated access that materially disrupts the Services. Lawful interoperability and rights that cannot be excluded are preserved.

Before purchase, we will disclose the plan, inclusions, limits, currency, applicable GST, billing period, renewal arrangements and cancellation method. Consumer-facing price displays will include mandatory charges where required by law. The Customer pays agreed fees; we may use Stripe for payment processing. Complete card details entered directly into Stripe are handled by Stripe.

Subscriptions renew only as disclosed and agreed at checkout. Cancellation must be available through billing controls or by contacting us; we will confirm receipt. Cancellation stops the next renewal if received before it occurs and normally takes effect at the end of the paid period. Upgrades, downgrades and any prorating will be explained before confirmation.

We will give at least 30 days' notice of a price increase, which will take effect at the next renewal after that notice, not during a prepaid fixed term without agreement. Customers may cancel before the increase takes effect. No charge for an additional service will be imposed without agreement.

Fees already earned are not refundable merely because the Customer changes its mind. This does not limit statutory remedies, refunds expressly offered, or refunds under these Terms. We will give notice of overdue payment and at least 14 days to remedy it before suspension, unless urgent circumstances reasonably justify earlier action.

We aim for reliable service but do not promise uninterrupted operation or a particular service level unless separately agreed. We will take reasonable steps to minimise avoidable disruption and provide notice of planned material interruptions where practicable.

We may use hosting, storage, payment, messaging, mapping and security providers. Their involvement does not remove our responsibilities under these Terms or applicable law. Customer-requested integrations may have separate terms, disclosed before activation where relevant.

We may improve features without reducing the substance of a purchased service. For a materially adverse feature or quota change, we will ordinarily give at least 30 days' notice. The Customer may terminate before it takes effect and receive a proportionate refund of unused prepaid fees for the affected service. Earlier changes are permitted where reasonably necessary for law or urgent security, with notice as soon as practicable and equivalent termination/refund rights if the purchased service is materially reduced.

We may restrict or suspend only the access reasonably necessary to address a material breach, overdue payment, fraud, serious security risk, unlawful content or legal requirement. For a remediable breach, we will ordinarily explain the issue and allow at least 14 days to remedy it before termination. Urgent action may occur where delay would create a material risk; we will explain it as soon as lawful and practicable and provide a review channel.

The Customer may terminate for our material breach if we fail to remedy it within 14 days after notice, or sooner where the breach cannot be remedied and materially defeats the agreement. Statutory termination rights remain available. Unused prepaid fees will be refunded where termination results from our unremedied material breach.

If we discontinue the service for business reasons, we will ordinarily give at least 90 days' notice, provide export access and refund unused prepaid fees. If law or circumstances outside our reasonable control make that notice impossible, we will give as much notice and export assistance as practicable. We will not rely on this exception to avoid reasonable continuity planning.

Unless an expressly agreed archive plan provides otherwise, at the end of a subscription the public passport will cease displaying product claims and show a neutral unavailability/archival notice. Customers may unpublish earlier. We do not promise continued public product information after that date. A neutral status page is not an ongoing certification or recall service.

For 30 days after termination, an authorised Customer may obtain a standard machine-readable export of product and journey records and copies of its uploaded files, through available controls or on request, without an additional export fee. Access may be securely mediated where restoring dashboard access would create a security or legal risk. Custom migration work requires a separate quote.

We will delete or irreversibly de-identify ordinary live Customer Content within 60 days after the export window closes, unless the Customer requests earlier deletion and it is lawful, or specific records remain necessary for a permitted purpose such as legal obligations, dispute resolution or security. Such retained records will be restricted to that purpose and reviewed for deletion. Routine backups will expire within a further 90 days; deletion instructions will be reapplied if backups are restored.

Public copies held by search engines or other people are outside our direct control. Customer deletion requests do not authorise destruction of another person's records or override an individual's statutory privacy rights. Record retention does not authorise keeping unnecessary personal information merely because an organisation owns a record.

We and our licensors retain rights in the platform, software, branding and documentation. During the subscription, the Customer receives a limited right to use the purchased Services and generated QR assets for its business, subject to the agreed hosting term. Third-party marks must be used with appropriate authority.

We may use voluntarily supplied feedback to improve the Services without payment, but this does not grant rights to exploit confidential Customer Content or train models on it. Neither party may imply the other's endorsement or use its logo for marketing without permission.

Nothing excludes, restricts or modifies rights, guarantees or remedies under the Australian Consumer Law or another law that cannot lawfully be excluded. Business purchases can attract consumer guarantees. Those rights prevail over all disclaimers, caps, exclusions and refund provisions here.

Subject to those rights and our express obligations, we do not promise that Customer Content, third-party evidence, maps, analytics or customer claims are accurate, or that use of the Services establishes regulatory compliance. We do not provide legal, engineering, medical or environmental-accounting advice unless expressly agreed as a separate qualified service.

Only where section 64A of the Australian Consumer Law lawfully permits it, and it is fair and reasonable to do so, liability for breach of an applicable service guarantee is limited, at our option, to supplying the services again or paying the reasonable cost of resupply. This does not apply where that limitation is legally unavailable.

Subject to section 19 and the exceptions below, each party's aggregate liability arising from this agreement for events occurring in any 12-month period is capped at the greater of AUD 1,000 and the fees paid or payable for the Services in that period. A series of related events is treated as occurring when its first event occurred. The cap applies across contract, negligence and other legal bases, including section 21.

For a party's breach of confidentiality or privacy/security obligations, the applicable cap is instead the greater of AUD 10,000 and twice those annual fees.

Neither party is liable for loss that was not reasonably foreseeable when the agreement was made. Reasonable direct costs of restoring affected data and responding to a breach are not excluded merely because they follow an incident. Each party must take reasonable steps to mitigate loss. Liability is reduced to the extent the other party's conduct caused or contributed to the loss.

No contractual cap or exclusion applies to fraud, deliberate unlawful conduct, death or personal injury caused by negligence, or liability that cannot legally be limited. The Customer's obligation to pay properly incurred subscription fees is not reduced by these caps. Refunds expressly owed remain payable. These provisions do not exclude reasonable care and skill or make the Customer responsible for our own misconduct.

Subject to section 20, the Customer will reimburse our reasonable losses from a third-party claim to the extent caused by its unlawful or infringing Customer Content, unauthorised disclosure, or materially misleading product claims in breach of these Terms. This does not apply to the extent caused by our modification outside authorised instructions, negligence, breach or unlawful conduct.

We must promptly notify the Customer, provide reasonable cooperation, mitigate loss and allow it a reasonable opportunity to participate in the defence with appropriate legal representation. We must not agree to an admission, non-monetary obligation or settlement at the Customer's expense without its consent, not to be unreasonably withheld. Delay in notice reduces recovery to the extent it prejudices the Customer. Nothing prevents either party seeking urgent protective relief.

We will give at least 30 days' notice of material changes and explain their effect. Materially adverse changes will not apply retrospectively or during an existing prepaid fixed term without express agreement, except where required by law or urgently necessary for security. For such earlier changes, we will give notice as soon as practicable; affected Customers may terminate and obtain a proportionate refund of unused prepaid fees.

Where renewed acceptance is necessary, we will obtain and record it honestly. A policy update alone does not create consent to a new optional use such as AI training. We will retain accessible versions and effective dates.

Contact us first with the relevant account or passport details and the outcome sought. We will acknowledge complaints within five business days and aim to provide a substantive response within 30 calendar days, or explain why more time is needed. If unresolved, the parties will seek in good faith to agree a practical escalation or mediation process. This does not prevent urgent relief, statutory complaints or access to courts or tribunals.

We will send contractual notices to the Customer's nominated contact or through a clearly identified dashboard notice, with direct notice for material changes where practicable. Customers must keep contact details current. Marketing preferences do not prevent genuinely necessary service notices.

Neither party may transfer this agreement in a way that materially reduces the other's protections without consent. We may transfer it as part of a genuine business sale or restructure if the successor assumes these obligations; we will give reasonable notice, protect confidential information during due diligence and allow termination with an unused-fee refund if the transfer materially disadvantages the Customer. Any personal information transfer must also be lawful.

If a provision is unenforceable, it is severed to the extent possible without changing the substance of the agreement. A failure to enforce a right once is not a waiver. Accrued rights, confidentiality, ownership, necessary exit permissions and liability provisions survive as appropriate. No provision prevents lawful reporting to a regulator.

Victorian and applicable Commonwealth laws govern these Terms. The parties submit to the non-exclusive jurisdiction of Victorian courts, subject to mandatory rights to use another court or tribunal.

Arimsys Pty Ltd — ProvenTrack
ABN 62 672 927 454
Ground Floor, 470 St Kilda Rd, Melbourne VIC 3004, Australia
Website: https://proventrack.com.au/ — use the Contact form for legal, content and privacy enquiries.