Privacy Policy

CamberWork (ABN 99 766 485 239) builds and runs AI workflow automation for Australian businesses, such as workflows that follow up quotes a business has sent to its customers. We value and respect the privacy of the people we deal with, and we handle personal information in line with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

This Privacy Policy (Policy) explains how we collect, hold, use and disclose personal information, and how we keep it accurate and secure. In this Policy, “we”, “us” and “our” mean CamberWork. The Policy covers two groups of people:

• people who deal with us directly, such as our clients, prospective clients and visitors to our website; and
• customers of our clients, whose information we handle on our clients’ behalf when we run workflows for them (see “Information we handle for our clients”).

What is personal information?

“Personal information” means any information or opinion, whether true or not, and whether recorded in a material form or not, about an identified individual or an individual who is reasonably identifiable. In general terms, this includes information or an opinion that personally identifies you either directly (e.g. your name) or indirectly.

What personal information do we collect?

If you deal with us directly, the personal information we collect depends on the nature of your dealings with us. It may include:

• your name, job title and the business you work for;
• your email address and phone number;
• billing and payment details, which are processed by our payment provider;
• records of our communications with you; and
• information about how you use our website (see “Website analytics and cookies”).

If your business is our client, we also hold the access details (such as API keys or system logins) that our workflows need to connect to your business systems. We store these securely and use them only to run your workflows.

If you are a customer of one of our clients, the information we handle is described under “Information we handle for our clients”.

Sensitive information

We do not ask for sensitive information, such as health information, racial or ethnic origin, religious or political beliefs, or criminal records, and our workflows are designed not to request it. If someone volunteers sensitive information, for example in a reply to a follow-up message, we keep it only as part of that conversation record, pass it to the relevant business with the conversation, and delete it with the rest of the record. We otherwise collect sensitive information only with consent, or where the law requires or authorises it.

Dealing with us anonymously

You do not have to provide us with your personal information. Where possible, we will give you the option to interact with us anonymously or by using a pseudonym. However, if you choose to deal with us in this way or choose not to provide us with your personal information, we may not be able to provide you with our services or otherwise interact with you.

How do we collect your personal information?

We collect personal information directly from you when you:

• contact us by phone, email or in person;
• submit an enquiry or request through our website;
• become a client, for example by accepting an Order Form or setting up payment; or
• subscribe to our mailing list.

We may also collect business contact details from publicly available sources, such as business websites and online business listings, when we contact businesses that may be interested in our services.

We collect information about our clients’ customers from our clients’ own systems, as described under “Information we handle for our clients”.

How do we use your personal information?

We use the personal information of people who deal with us directly to:

• provide, set up and support the services you request;
• communicate with you about your enquiry, your account and our services;
• invoice you and manage payments;
• improve our website and services;
• send you marketing where permitted (see “Direct marketing”); and
• meet our legal obligations, such as tax record-keeping.

Information we handle for our clients

When a business engages us, we run workflows on its behalf using information from its own systems, such as its customer relationship management (CRM) software. If you have received a message from one of our clients’ workflows, this section explains how we handle your information.

What we handle

• your name, phone number and email address;

• details of the quote or enquiry you have with that business, such as its date, the work involved and the amount;

• the messages a workflow sends you, your replies and summaries of the conversation; and

• whether you have asked not to be contacted again.

How we use it

We use this information only to provide the workflow to the business that engaged us. For example, a workflow may send you a follow-up about a quote you received from that business in the last 9 months, answer straightforward questions within rules the business has approved, and pass the conversation to the business’s staff when you want to speak to a person or take the next step.

We do not sell this information, use it for our own marketing, or use it to market to you on anyone else’s behalf. We may use aggregated statistics that do not identify anyone, such as overall response rates, to improve our services.

Who we share it with

We share it with the business that engaged us and with the service providers we need to run the workflow, as set out under “Disclosure of personal information to third parties”.

Opting out

Every message includes a way to opt out, such as replying STOP or using an unsubscribe link. We action opt-outs as soon as practicable and always within 5 business days. You can also ask the business directly, or contact us using the details under “How to contact us”.

The business that contacted you

The business that engaged us decides who its workflows contact and is responsible for having permission to contact you. Its own privacy policy also applies to your information. If you ask us to access or correct information we hold for that business, we may consult it before responding.

Use of artificial intelligence

Some of our workflows use artificial intelligence (AI) to write messages, read and reply to responses, and decide when to pass a conversation to a person. To do this, the AI processes the information described above, such as names, quote details and conversation content.

• The AI works within rules approved by the business it acts for. It cannot offer discounts, change prices or agree terms on that business’s behalf.
• It will not claim to be a person and, if asked, will say it is an automated assistant.
• You can ask to speak to a person at any time, and the conversation will be passed to the business’s staff.
• We use AI model providers, such as Anthropic, whose commercial terms do not allow them to train their models on the information we send. We send them only the information a task needs.

Our current workflows do not make decisions that significantly affect people’s rights or interests, such as decisions about credit, employment or housing. If that changes, we will update this Policy to describe those decisions and the kinds of personal information used to make them.

Disclosure of personal information to third parties

We disclose personal information only where you would reasonably expect us to, or where the law allows. This may include disclosure to:

• the business we run a workflow for, in the case of information we handle on its behalf;
• our service providers, including our cloud hosting provider, AI model providers (such as Anthropic), SMS and email delivery providers, our website analytics provider, and our payment and billing providers;
• our professional advisers, such as our accountant or lawyer; and
• government authorities and others, where required or authorised by law.

Our service providers may use personal information only to provide their services to us.

Transfer of personal information overseas

Some of our service providers are located, or store or process information, outside Australia, including in Germany, France, Austria, the Netherlands and the United States. For example, AI model providers we use, such as Anthropic, may process information in the United States.

Before we disclose personal information to an overseas recipient, we take reasonable steps to ensure it will handle that information consistently with the APPs, including by using providers bound by contractual terms that restrict how they use the information and require them to protect it. We remain accountable under the Privacy Act for how those overseas recipients handle the information, unless the disclosure is required or authorised by an Australian law or a court or tribunal order.

How do we protect your personal information?

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure, including by:

• encrypting information as it travels between our systems and our service providers;
• hosting our systems with established cloud providers, which are responsible for the physical security of their data centres;
• limiting access to personal information to people who need it to provide our services;
• storing client system access details securely and using them only to run that client’s workflows;
• keeping our software and systems up to date; and
• deleting or de-identifying personal information when we no longer need it.

Data breaches

If we become aware of a data breach involving personal information, we will act quickly to contain it and assess the risk of harm. Where a breach affects information we hold for a client, we will notify that client without undue delay and within 72 hours. Where the Notifiable Data Breaches scheme applies, affected individuals and the Office of the Australian Information Commissioner (OAIC) will be notified as the scheme requires.

Website analytics and cookies

Our website uses cookies and analytics tools to understand how visitors use it, such as which pages are viewed and how visitors find us, so we can improve it. A cookie is a small file that a website places on your device. Analytics information may include technical details such as your device’s IP address, browser type and the pages you visit. We do not use it to identify individual visitors. Our analytics provider may process this information overseas.

You can set your browser to block or delete cookies. If you do, some parts of our website may not work as well.

Direct marketing

We may send our clients, prospective clients and mailing list subscribers information about our services by email, SMS or phone, where you have agreed to receive it or the law otherwise allows. We never use information we handle for our clients to market to their customers.

Every marketing email or SMS we send includes a way to unsubscribe. You can also opt out at any time by contacting us using the details under “How to contact us”. We action unsubscribe requests within 5 business days.

Retention of personal information

We keep personal information only for as long as we need it, then delete or de-identify it:

• Clients, prospective clients and website visitors: for as long as we have a relationship with you, and longer where the law requires, such as tax and financial records, which we generally keep for 5 years.

• Workflow contact records (contact details, quote details, messages and conversations): up to 9 months, so a workflow does not contact the same person again about the same quote.

• Opt-out records: for as long as the relevant business uses our services, so people who have opted out are not contacted again.

• When a business stops using our services: we give it the list of people who opted out so it can keep honouring those requests, and we delete the information we hold for it after 30 days, unless the law requires us to keep it.

How to access and correct your personal information

CamberWork will take reasonable steps to keep the personal information we hold accurate, complete and up to date.

If you wish to access or correct the personal information we hold about you, please contact us. We will respond within 30 days and will deal with your request as follows:

1. Submission of request: Submit your request in writing by email to our Privacy Officer at seamus@camberwork.com. Please state whether you are seeking access to your information, a correction, or both.

2. Identity verification: To protect your privacy, we will take reasonable steps to verify your identity before giving access or making corrections, usually by confirming details we already hold, such as your email address or phone number. We will only ask for identification documents if we cannot verify you another way, and we will not keep copies of them. If an authorised agent makes the request for you, we will need written proof of their authority to act for you.

3. Assessment and retrieval: Once your identity is confirmed, our Privacy Officer will locate and review the personal information we hold about you. If the request relates to information we hold for one of our clients, we may consult that business.

   • For access requests: We will retrieve your information from our systems and aim to provide it in the way you ask (for example, by email or a secure download link) where reasonable and practicable.
   • For correction requests: If the information we hold is inaccurate, out of date, incomplete, irrelevant or misleading, we will correct it.

4. Permitted exemptions: In limited circumstances permitted under the APPs, we may be unable to give access to some or all of your information. These include where giving access would pose a serious threat to life or health, unreasonably affect the privacy of others, reveal commercially sensitive decision-making processes, or relate to existing or expected legal proceedings between us.

5. Response and notification: We will respond within 30 days of receiving your request.

   • If we refuse your request for access or correction, in whole or in part, we will give you written reasons (unless it would be unreasonable to do so) and tell you how to complain.
   • If we correct personal information that we previously disclosed to a third party, you may ask us to notify that third party, and we will take reasonable steps to do so.

6. Costs: We do not charge for making an access or correction request, or for making corrections. We generally provide access free of charge, but may charge a reasonable fee to cover our costs if a request requires significant time to retrieve or reproduce the information. We will always tell you about any fee before proceeding.

Links to third party sites

CamberWork website(s) may contain links to websites operated by third parties. If you access a third party website through our website(s), personal information may be collected by that third party website. We make no representations or warranties in relation to the privacy practices of any third party provider or website and we are not responsible for the privacy policies or the content of any third party provider or website. Third party providers and websites are responsible for informing you about their own privacy practices and we encourage you to read their privacy policies.

Inquiries and complaints

If you have a complaint about how CamberWork handles your personal information, please email seamus@camberwork.com with details of your complaint. We may need to verify your identity before we can deal with it.

We will respond to your complaint within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

Changes to this Policy

We may update this Policy from time to time, for example when our services or the law change. The current version will always be available on our website, with the date it was last updated.

How to contact us

If you have a question or concern about how we handle personal information or about this Policy, please contact CamberWork (ABN 99 766 485 239):

Email

seamus@camberwork.com

Contact number

0466 032 268