Privacy notice

Who we are. The Servicing Portal is operated by CRM Servicing. Contact our privacy officer at privacy@crmservicing.com.

What we collect

• Your account:
• your email address and name
• your two-step sign-in settings
• whether you want email reminders If you sign in with Google or Microsoft, we receive your name, your email address, and whether your email is verified. We don't receive your password or anything else from those accounts.
• What your business enters: the business records you and your colleagues add, such as goals, processes, software, costs, risks and the names and roles of the people involved, plus any files you upload.
• Security records:
• what was changed and when, linked to an account id but not to your name
• IP addresses and request details, kept in access logs

• The trial: anything you enter while trying the portal stays in your own browser. We never receive it.
• If you request access: your name, email address, business name, phone number (optional), team size, number of systems, the option you're interested in, what you'd like help with, and whether you tried the trial. We use this only to reply, prepare your quote and set up your portal. To stop misuse of the form, we keep a scrambled fingerprint of the address your request came from for 7 days.
• Invoices: the business name, email address and ABN you give us, and the amount and payment details.

We don't use advertising or tracking cookies, and we don't sell or rent information.

Please don't enter health information, racial or ethnic origin, government identifiers, or payment card details. The portal isn't designed for them.

How we use it

We use the information only to:

• run the portal for you
• send the invitations and reminders you ask for
• keep the portal secure
• respond to your requests

The portal's suggestions are about software and processes. The portal doesn't make decisions about individuals. People in your business decide what to act on.

Who can see it

• Members of your business, according to their role. Partners can only read. Consultants' private notes are visible only to the consultant.
• CRM Servicing can see a business only if the business invites us in. Our technical staff can reach the database only in an emergency, and every such access is logged.
• Amazon Web Services hosts the portal in Australia. That covers storage, sign-in and email.
• Google or Microsoft, if you choose to sign in with them, under their own privacy policies.

Where it is stored

All portal data is stored and processed in Australia. The web pages themselves are delivered through a global network, but those pages contain no business data.

If you or your business is outside Australia, your information is transferred to Australia. For EU, UK and New Zealand businesses, our data processing terms include the standard contractual safeguards those laws require.

The "AI analysis pack"

The portal can assemble a summary that you can copy into an AI assistant of your choice. The portal never sends this to any AI service itself. If you paste it somewhere, that service's terms apply. Business owners can hide this feature.

How long we keep it

See the retention schedule. In short:

• Business records are kept while the business is active and deleted 30 days after an owner deletes the business.
• Your account details are removed when you close your account.
• Security records are kept for up to 7 years.
• Backups roll over every 14 days, so deleted information can remain in an encrypted backup for up to 14 days.
• Access requests that don't go ahead are deleted 2 years after we decide them.
• Invoices are kept for 7 years, because tax law requires us to keep business records.

Your rights

You can:

• download everything we hold about you (Settings → Download my data)
• correct your details
• close your account
• lodge a privacy request or complaint (Settings → Privacy request)

We respond within 30 days.

If you're not satisfied, you can complain to:

• the Office of the Australian Information Commissioner (oaic.gov.au)
• the NZ Privacy Commissioner (privacy.org.nz)
• your local EU or UK data protection authority

Information that your business entered about you is controlled by that business, so contact them first; we'll help them respond.

Security

Measures include:

• encryption in storage and in transit
• required two-step sign-in
• strict separation between businesses
• a tamper-evident activity log
• continuous threat monitoring

If a data breach is likely to cause serious harm, we will tell you and the regulator as the law requires.

Changes

We'll ask you to accept any updated policy the next time you sign in.