Privacy Policy

1. Introduction

Kelsy Pty Ltd (ABN pending) ("Kelsy", "we", "us") operates the Kelsy platform at kelsy.com.au. This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information We Collect

We collect the following types of personal information:

• Account information: name, email address, organisation name, role
• Workspace data: documents, assessments, compliance records you create
• Payment information: billing address, payment method details (processed via Stripe)
• Usage data: feature usage, session activity, device information, IP addresses
• Communications: support requests, feedback, and correspondence with us

3. How We Use Your Information

We use personal information to:

• Provide, maintain, and improve the Kelsy platform
• Process payments and manage subscriptions
• Send service notifications, security alerts, and account updates
• Provide customer support and respond to enquiries
• Comply with legal obligations (including ASQA reporting requirements)
• Detect and prevent fraud, abuse, and security threats

4. Data Storage and Security

All data is stored on Amazon Web Services (AWS) infrastructure located in the Asia Pacific (Sydney) region (ap-southeast-2). We implement:

• Encryption at rest (AES-256) for all stored data
• Encryption in transit (TLS 1.3) for all network communications
• Role-based access controls and least-privilege principles
• Regular security audits and vulnerability assessments
• Automated backup with point-in-time recovery

5. Data Sharing

We do not sell personal information. We share data only with:

• Service providers who assist in operating the platform (AWS, Stripe, AWS SES)
• As required by law, regulation, or valid legal process
• With your consent or at your direction (e.g., sharing with validators you engage)

6. Data Retention

We retain personal information for as long as your account is active or as needed to provide services. Specific retention periods:

• Account data: retained while account is active, deleted within 30 days of account closure
• Compliance records and validation reports: retained for 7 years per ASQA regulatory requirements
• Payment records: retained for 7 years per Australian tax law
• Usage logs: retained for 12 months for security and analytics

7. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal data (subject to legal retention requirements)
• Withdraw consent for optional data processing
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

8. Cookies

We use essential cookies for authentication and session management. We do not use third-party advertising cookies. Analytics cookies are used to understand platform usage and improve the service.

9. Contact

For privacy enquiries, data access requests, or complaints:

Email: privacy@kelsy.com.au

Post: Kelsy Pty Ltd, Melbourne, VIC, Australia