Legal

Privacy Policy

Effective date: 16 October 2026  ·  Last updated: 16 October 2026  ·  Version: 3.0

This policy explains what personal information Automatrix collects, why we collect it, how we use and disclose it, how we use artificial intelligence and automated tools in our work, how we measure our advertising, and how you can access, correct, or complain about how we handle your information.

What changed in version 3.0 (16 October 2026): we now use the Meta Pixel, the Meta Conversions API, and Meta Lead Ads (Section 10). We added our own attribution cookies to the cookie table, corrected where our database is hosted (Sections 8 and 9), described our business research tools (Section 4.6), and expanded the automated decision-making disclosure ahead of the 10 December 2026 requirements (Section 6.5).

1. Who We Are

Automatrix Digital Pty Ltd (trading as Automatrix) ABN 89 700 072 608 ("Automatrix", "we", "us", "our") is a technology and business automation services company registered and operating in New South Wales, Australia. We provide business automation, software development, search engine optimisation, website development, systems integration, artificial intelligence implementation, and related digital services.

This Privacy Policy applies to all personal information collected by Automatrix through our website at www.automatrix.au (the "Site"), through our client portals and admin systems, through our advertising and lead forms on Facebook and Instagram, through our service delivery activities, through our client onboarding and application processes, and in connection with any contract or engagement we enter into.

Applicable law: This policy is prepared in accordance with the Privacy Act 1988 (Cth) as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth), the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act, the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), the Surveillance Devices Act 2007 (NSW) where relevant to recorded conversations, and relevant guidelines issued by the Office of the Australian Information Commissioner (OAIC).

1.1  Our Position on the Small Business Exemption

The Privacy Act contains an exemption for businesses with an annual turnover of $3 million or less. Whether or not that exemption applies to us in a given financial year, we handle personal information as though we are bound by the Australian Privacy Principles in full. We hold ourselves to that standard because our clients trust us with their systems and their customers' data, and a turnover threshold is a poor reason to offer anyone less protection. Where this policy describes an obligation, treat it as a commitment we have made to you.

1.2  Open and Transparent Management (APP 1)

We maintain internal practices, procedures, and systems designed to keep us compliant with the APPs and to handle privacy enquiries and complaints. This policy is available free of charge at automatrix.au/privacy-policy, and we will provide a copy in another format on request.

2. Dealing With Us Anonymously (APP 2)

You have the option of dealing with us anonymously or under a pseudonym where it is lawful and practicable for us to allow it. You can read our website, download a resource, or ask a general question by phone without telling us your name.

It is not practicable for us to deal with you anonymously when we are quoting, contracting, invoicing, delivering services, or providing support, because we need to know who you are to do those things and to meet our tax and record keeping obligations. If you would prefer to limit what you give us, tell us and we will tell you what is genuinely required.

3. Information We Collect

Automatrix collects personal information only to the extent reasonably necessary to provide our services and conduct our business. The types of personal information we may collect are described below.

3.1  Contact and Identity Information

• Full name (first and last)
• Business name and trading name
• Email address (personal and/or business)
• Phone number (mobile and/or landline)
• Postal and/or business address
• ABN or ACN (where provided for invoicing)
• Job title and role within your business

3.2  Business and Engagement Information

• Business industry, size, and operational details provided in our application questionnaire
• Details of your business challenges, goals, and operational pain points
• Budget ranges and project timelines you choose to disclose
• Service requirements and project scope information
• Communications and correspondence with us (emails, SMS, notes, meeting records)
• Information you provide during onboarding audits or consultations

3.3  Financial and Transaction Information

• Invoice details and payment history
• Bank account or payment method details (processed securely via our payment providers, and we do not store raw card numbers)
• GST registration status where applicable
• Receipts and expense records where you have engaged us to process them

3.4  Technical and Usage Information

• IP address and approximate geographic location
• Browser type and version, operating system (your "user agent")
• Pages visited on our Site, time and date of visit, time spent on pages
• Referring URLs (how you found us)
• Device identifiers and screen resolution
• Interaction data from our website analytics tools

3.5  Advertising and Attribution Information

When you reach us through an ad or a tracked link, or fill in one of our ad forms, we collect:

• Campaign tags in the link you clicked (UTM source, medium, campaign, term and content)
• Ad click identifiers added by the ad platform, such as Google's gclid and Meta's fbclid
• The page you first landed on and the site that referred you
• Meta browser identifiers stored in the _fbp and _fbc cookies
• For Facebook and Instagram lead forms: the Meta lead ID, and the IDs and names of the form, ad, ad set and campaign, plus whether you saw it on Facebook or Instagram
• The answers you give in a lead form, which can include your name, email, phone, business name, website, industry, approximate revenue band, team size, the software you use, and what you want help with

3.6  Credentials and Access Information

To deliver services we often need access to systems you control, such as hosting accounts, domain registrars, content management systems, analytics properties, advertising accounts, and business software. Where you give us credentials or delegated access:

• We prefer delegated or invited access over shared passwords, so you can revoke us at any time without changing your own login
• Credentials we do hold are stored in an encrypted vault, not in email, chat, spreadsheets, or project notes
• Access is limited to the people working on your engagement
• We remove or hand back access at the end of an engagement, or earlier on request

3.7  Recorded Calls and Meetings

We sometimes record or transcribe calls and video meetings to produce notes and summaries. We will tell you at the start of the meeting if recording or an AI notetaker is running, and you can ask us to turn it off. We do not record without telling you.

This matters legally as well as courteously. Under section 7 of the Surveillance Devices Act 2007 (NSW), recording a private conversation without the consent of all principal parties is an offence, even where you are one of the parties, unless a narrow exception applies. Recording rules differ in Victoria, Queensland, and the Northern Territory. We work to the strictest of them, which means we ask.

3.8  Sensitive Information

We do not intentionally collect sensitive information as defined under the Privacy Act, such as health information, racial or ethnic origin, political opinions, membership of a professional or trade association, religious beliefs, sexual orientation, criminal records, or biometric data. If you inadvertently provide sensitive information to us, we will handle it with the same level of care as other personal information and will use it only for the purpose for which it was disclosed. We will not use or disclose sensitive information for any other purpose without your consent.

If your business holds sensitive information and you want us to build or automate systems that touch it, tell us before the project starts. That changes how we scope the work, which AI tools we are willing to use, and where the data is allowed to sit.

3.9  Information About Third Parties

If you provide us with personal information about another individual, such as a business partner, employee, customer, or referee, you warrant that you are authorised to provide that information to us and that we may use it in accordance with this policy. You also agree to inform that individual of the matters set out in this policy.

4. How We Collect Your Information

We collect personal information in the following ways.

4.1  Directly From You

• When you complete and submit our online application, audit, booking, or contact forms on the Site
• When you submit one of our lead forms (Instant Forms) on Facebook or Instagram, which Meta then passes to us (see Section 4.5)
• When you correspond with us by email, phone, SMS, or any other means
• When you engage us to provide services (contract onboarding)
• When you participate in a discovery call, audit session, or strategy meeting
• When you subscribe to any communications from us
• When you provide feedback or testimonials
• When you use a client portal, proposal link, invoice payment page, or booking page we have issued to you

4.2  Automatically Via the Site

When you visit our Site, our web servers, analytics tools, our own attribution cookies, and the Meta Pixel automatically collect certain technical information. On its own, most of this does not tell us who you are. It becomes linked to you if you then send an enquiry or book a call, because we store it alongside your details so we know which ad or page brought you to us. See Section 10 for more detail.

4.3  From Third Parties

Occasionally we may receive information about you from third parties, including:

• Meta Platforms, when you submit one of our lead forms on Facebook or Instagram (see Section 4.5)
• Referrals from existing clients or business contacts who recommend you to us
• Publicly available sources such as LinkedIn, ASIC records, ABN Lookup, Google Business Profile, or your own business website (see Section 4.6)
• Payment processors and financial institutions in connection with invoicing and payment
• SEO and market data providers we use to prepare audits and proposals
• Integration platforms such as Zapier or Make, where your business has engaged us to configure systems on your behalf

APP 5 compliance: Where practicable, we collect personal information directly from you. When we collect from a third party, we will notify you of the collection as soon as reasonably practicable, unless notification would be unreasonable in the circumstances.

4.4  Unsolicited Information (APP 4)

If we receive personal information we did not ask for, we assess within a reasonable period whether we could have collected it under this policy. If we could not, and the information is not contained in a Commonwealth record and we are not required by law to keep it, we destroy or de-identify it as soon as practicable and where it is lawful and reasonable to do so.

4.5  Facebook and Instagram Lead Forms (Meta Lead Ads)

Some of our ads open a form inside Facebook or Instagram, for example to request a free systems audit. Meta may fill in parts of the form from your profile, and you can edit any field before you submit. When you submit it:

• Meta sends us what you entered, together with the Meta lead ID and details of the ad and form you responded to
• We store this as an enquiry in our CRM, and we email, call, or text you about your request
• As the enquiry moves forward, we send Meta short status updates linked to the Meta lead ID: for example that the lead was qualified, that an audit was booked, that a proposal was created, or that the work was won, with the deal value where there is one. Meta uses these to work out which kinds of people are likely to become customers and shows our ads to more people like them

Meta handles the information you give it under its own Privacy Policy. Once we receive your submission, we handle it under this policy.

4.6  Business Research (Our Lead Engine)

We run internal software we call the Lead Engine to find Australian businesses that may benefit from our services. It collects publicly available business information, such as the business name, website, publicly listed phone number and business email, address, Google Business Profile details and reviews, and the software a website uses. Some of this can identify a person, for example a sole trader trading under their own name or an owner named on a website.

We use it to work out which businesses to contact and what to say, and we may contact a business at its published business address (Section 15 explains when we do that). We do not buy personal contact lists. Whenever we contact a business this way, we tell them where we got their details. If you ask us to stop, we add you to a suppression list so you are not contacted again.

5. Why We Collect Your Information

We collect, hold, use, and disclose personal information only for purposes that are directly related to our business functions and are reasonably necessary for those functions. Those purposes are:

• Responding to enquiries and preparing quotes, audits, and proposals
• Delivering the services you have engaged us for, including building, configuring, hosting, and supporting your systems
• Managing the engagement, including project communication, approvals, scheduling, and reporting
• Billing and collection, including issuing invoices, processing payments, and following up overdue accounts
• Meeting our legal obligations, including tax, corporate record keeping, and responding to lawful requests
• Improving our services, including analysing how the Site is used and where our own process falls down
• Measuring and improving our advertising, including working out which ads produce enquiries and customers, and telling Meta which enquiries progressed so it can show our ads to similar businesses (Section 10)
• Finding businesses we can help, using publicly available business information (Section 4.6)
• Direct marketing within the limits set out in Section 15
• Protecting our systems, including fraud prevention, security monitoring, and enforcing our Terms of Service

5.1  Using Information for a Secondary Purpose

We will not use or disclose personal information for a secondary purpose unless:

• The secondary purpose is directly related to the primary purpose for which it was collected, and you would reasonably expect us to use or disclose it for that secondary purpose
• You have consented to the use or disclosure for the secondary purpose
• We are required or authorised to do so by or under Australian law or a court or tribunal order
• Use or disclosure is reasonably necessary for the enforcement of a criminal law or of a law imposing a pecuniary penalty, or for the protection of public revenue
• We reasonably believe it is necessary to lessen or prevent a serious threat to life, health, or safety

6. Artificial Intelligence and Automated Processing

Automation and AI are what we sell, so we are specific about how we use them on your information. This section covers our own use of AI. Where we build AI into a system for you, Section 7 and your service agreement govern that work.

6.1  What We Use AI For

We use AI systems, primarily large language models, to assist with:

• Drafting proposals, contracts, reports, and website copy
• Summarising meetings, emails, and call transcripts
• Reading receipts and invoices to extract line items for accounting
• Producing SEO audits, technical analysis, and competitor research
• Assisting with code we write for client projects
• Answering internal questions about a project's history

6.2  Which Providers We Send Data To

Our primary AI provider is Anthropic (the Claude family of models), accessed through Anthropic's commercial API. We also use AI features built into tools we already run, and speech and voice platforms where a project calls for them. Our current AI and voice providers are listed in the table in Section 8.1.

6.3  Training: Our Commitment

We do not permit your data to be used to train AI models. Specifically:

• We use commercial API access, not consumer chat products, for anything containing client or prospect information. Commercial API terms with our providers exclude customer inputs and outputs from model training by default
• We do not paste client data into free or personal-tier AI tools, which commonly reserve training rights
• We do not sell, license, or contribute your information to any dataset, model, or AI product
• Where a tool we use changes its training position, we review whether to keep using it, and we stop using it for client data if we cannot turn training off

6.4  Human Oversight

AI drafts, people decide. No AI system we run makes a final decision that legally or significantly affects you. Every proposal, contract, report, invoice adjustment, and piece of published work passes a human review before it leaves us. If an AI output is wrong, that is our error to fix, and it does not change what we owe you under our Terms of Service.

6.5  Automated Decisions and Computer Programs (APP 1.7 to 1.9)

From 10 December 2026, the Privacy Act requires a privacy policy to say when an organisation has arranged for a computer program to make a decision, or do something substantially and directly related to making a decision, that could reasonably be expected to significantly affect a person's rights or interests. We do not believe any of our automated tools make decisions of that kind. We list them below anyway, because we would rather you know than wonder.

Decisions made solely by a computer program: none that significantly affect your rights or interests. No program we run decides on its own whether you become a client, what you are charged, whether a contract is offered or ended, or whether you are refused a service.

Things our programs do that help a person decide:

• Scoring and qualifying enquiries. When an enquiry arrives from our website or a Facebook or Instagram form, our CRM may use your answers (business type, revenue band, team size, software used, what you want help with) and where you came from to rank how quickly we follow up and which audit format fits. A person always reviews the enquiry and decides whether to take it further
• Scoring businesses in our Lead Engine. Our Lead Engine uses publicly available business information (Section 4.6), and may use an AI model, to estimate whether a business is likely to benefit from our services and to draft an outreach message. A person approves each outreach before it is sent
• Automated reminders and follow-ups. Booking confirmations, reminders, and overdue invoice notices are sent automatically based on dates and payment status

Decisions made by Meta's systems: Meta's advertising systems, not ours, decide who sees our ads. They use their own data together with the events and lead status updates we send (Section 10). Meta explains this in its own Privacy Policy and Ad Preferences.

You can ask a person to review any automated step that involved you, explain how it was reached, or correct the information it used, by contacting our Privacy Officer (Section 20).

6.6  Accuracy and Limits

AI systems make mistakes, including confident ones. We treat AI output as a first draft, verify facts, figures, legal references, and code before they reach you, and never present raw model output as professional advice. Do not rely on AI-assisted material we provide as legal, financial, tax, or medical advice.

6.7  Your Choice

If you would prefer that we do not run your information through third-party AI systems, tell us before the engagement starts. We can usually accommodate it. It will affect turnaround times and, for some services, pricing, and we will tell you honestly which parts of the work become impractical.

7. Client Data We Handle on Your Behalf

When we build, host, integrate, or automate systems for you, we usually end up handling personal information that belongs to your customers, staff, patients, members, or suppliers. That is a different relationship from the one we have with you as our client, so it gets its own section.

7.1  Who Is Responsible for What

For that data, you are the controlling entity and we act on your instructions. You decide what is collected, why, and how long it is kept. You are responsible for having a lawful basis to collect it, for your own privacy policy and collection notices, and for the consents you rely on. We are responsible for handling it securely and only for the purposes of your engagement.

7.2  What We Commit To

• We use your data only to deliver the services you have engaged us for, and on your documented instructions
• We do not use your data or your customers' data for our own purposes, for marketing, or for AI training
• We apply the security measures in Section 11 to it
• We restrict access to personnel and providers who need it
• We tell you without undue delay if we become aware of a security incident affecting it, so you can meet your own notification obligations
• We assist you, at your cost where the work is substantial, in responding to access, correction, and deletion requests from your customers
• On termination we return or delete it as set out in your service agreement, subject to backup retention cycles and any legal hold

7.3  What You Should Tell Us

If your customers' data includes sensitive information, health records, financial data beyond ordinary invoicing, children's information, or data about individuals in the EU or UK, tell us before we design the system. It changes the architecture, the hosting location, and the AI tooling we are willing to use. Retrofitting compliance costs more than building for it.

8. Disclosure to Third Parties

Automatrix does not sell, rent, or trade your personal information. We may disclose your personal information to third parties only in the following circumstances. The one disclosure that goes beyond running our business day to day is the advertising measurement data we send to Meta, explained in Section 10.

8.1  Service Providers

We engage trusted third-party service providers who assist us in operating our business. They are bound by confidentiality obligations and are only permitted to use your information to the extent necessary to provide their service to us.

This list reflects our providers as at the review date at the top of this policy. We add and remove providers as our stack changes. To request the current list at any time, email privacy@automatrix.au.

8.2  Professional Advisors

We may disclose information to our accountants, lawyers, insurers, or other professional advisors where strictly necessary for the provision of professional services to us, subject to professional confidentiality obligations.

8.3  Legal Requirements and Law Enforcement

We may disclose personal information where we are required to do so by Australian law, a court order, or a lawful request from a government or law enforcement agency, including the ATO, ASIC, the OAIC, or the NSW Police Force. We will notify you of any such disclosure where we are permitted to do so by law.

8.4  Business Transactions

In the event of a merger, acquisition, sale of business assets, or other structural change, personal information held by Automatrix may be transferred to a successor entity. We will notify affected individuals and ensure the successor entity is bound by equivalent privacy obligations.

8.5  With Your Consent

We may disclose your personal information to other parties with your express consent, for example if you ask us to share project outcomes or case study material with a referral partner.

9. Overseas Disclosure

Some of our third-party service providers are based or operate infrastructure outside Australia. The countries where recipients are likely to be located include the United States, South Korea (where our main database is hosted), Ireland and other countries in the European Union, New Zealand, and Singapore. The table in Section 8.1 shows which provider is in which country.

When we disclose personal information to overseas recipients, we take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles. Specifically, we will:

• Ensure the recipient is subject to a law, binding scheme, or contractual obligations that provide at least comparable privacy protections to the APPs; or
• Obtain your consent to the overseas disclosure after advising you that APP 8.1 will not apply to that disclosure

Our main database is currently hosted in Supabase's Seoul (South Korea) region. Where a provider offers an Australian processing region and it is practical to move, we prefer it, and we will update this policy if our hosting location changes.

APP 8 note: By submitting your information through our website and engaging our services, you acknowledge that your personal information may be processed by overseas service providers as described above. If you wish to opt out of particular overseas transfers, contact us and we will tell you what remains possible.

10. Cookies and Tracking Technologies

10.1  What Are Cookies?

Cookies are small text files placed on your device by a website you visit. They are widely used to make websites work efficiently, to remember your preferences, and to provide information to website owners.

10.2  Cookies and Storage We Use

10.3  Meta Pixel and Meta Conversions API

We advertise on Facebook and Instagram, and we use two Meta tools to measure whether those ads work and to improve who sees them.

• The Meta Pixel is code on our Site that runs in your browser. It tells Meta when a page is viewed and when a form is submitted or a call is booked, along with your browser's IP address, user agent, and the _fbp and _fbc cookies
• The Meta Conversions API sends the same events from our server instead of your browser, so they still count if a browser blocks the Pixel. Each event is sent with a shared ID so Meta counts it once, not twice

When you send an enquiry or book a call, the server-side event can include your email address, phone number, and name. We hash these with SHA-256 before they leave our systems. Hashing turns the detail into a fixed string of characters that cannot practically be reversed. Meta compares it with the hashes of details people have given Meta, to work out whether the person who enquired had seen our ad. We do not send Meta the content of your message.

Meta uses this data to report ad results to us, to show our ads to people likely to be interested, and, as described in its own policies, for its broader advertising purposes. Meta acts under its Business Tools Terms and Privacy Policy.

10.4  Lead Status Updates Sent to Meta

If your enquiry came from one of our Facebook or Instagram ads (a lead form, or a website visit from a Meta ad), our CRM automatically sends Meta a short update as the enquiry progresses: qualified, audit booked, proposal created, and won. The "won" and "proposal" updates include the deal value in Australian dollars. Updates for lead-form enquiries are linked by the Meta lead ID. Updates for website enquiries are linked by hashed contact details and the _fbp/_fbc identifiers. We do not send updates to Meta about enquiries that did not come from Meta, such as referrals, organic search, or direct contact.

This lets Meta favour people who are likely to become customers over people who only fill in forms. You can ask us to stop sending updates about you at any time (Section 10.5).

10.5  Opting Out of Advertising Measurement

• Change how Meta uses activity from other websites and apps at Meta Ad Preferences, including the "Activity information from ad partners" setting, and manage or disconnect off-Meta activity in your Facebook or Instagram settings
• Block or delete cookies in your browser (see Section 10.6), or use a browser or extension that blocks tracking scripts
• Ask us not to send your details or lead status updates to Meta, by emailing privacy@automatrix.au. We will flag your record so no further events are sent, and let you know once done
• Learn about interest-based advertising more generally at youradchoices.com.au

10.6  Managing Cookies

You may control or delete cookies through your browser settings. Most browsers allow you to refuse all cookies, to accept only certain cookies, or to be notified when a cookie is set. Disabling cookies may affect the functionality of the Site, and signed-in areas such as client portals will not work without session cookies.

To opt out of Google Analytics tracking, you may install the Google Analytics Opt-out Browser Add-on.

10.7  Do Not Track and Global Privacy Control

Our Site checks for a "Do Not Track" signal from your browser. If one is present, we do not load Google Analytics for your visit. We will extend the same treatment to the Global Privacy Control signal as support for it becomes standard.

11. Data Security

Automatrix takes reasonable steps to protect the personal information we hold from misuse, interference, loss, unauthorised access, modification, or disclosure. Our security measures include:

• HTTPS encryption across our entire website and all form submissions, with HTTP Strict Transport Security enabled
• Encryption of data at rest in our database and file storage
• Row level security policies, so a signed-in user can reach only their own records
• Access controls limiting staff access to personal information on a need-to-know basis
• Multi-factor authentication on every administrative account that supports it
• Client credentials held in an encrypted vault, never in email, chat, or documents
• Secure email services with transport layer encryption
• Payment processing through PCI DSS compliant providers, with no raw card data stored by us
• Signed, expiring links for shared files rather than permanently public URLs
• Review of third-party provider security practices before and during engagement
• Device level encryption and screen locks on any hardware used in service delivery
• An internal data breach response plan, reviewed at least annually

While we take reasonable precautions, no method of data transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your personal information. If you believe your personal information has been compromised, contact us immediately using the details in Section 20.

12. Data Retention

We retain personal information for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, and to resolve disputes and enforce our agreements. Our general retention periods are:

When personal information is no longer required, we take reasonable steps to destroy or de-identify it securely and permanently. We do not retain personal information in a form that allows identification for longer than necessary. Where you ask us to delete information that we are legally required to keep, we delete what we can and tell you what has to stay and why.

13. Your Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights in relation to your personal information held by Automatrix.

13.1  Right of Access (APP 12)

You have the right to request access to the personal information we hold about you. We will respond to your access request within 30 days of receipt. We will provide access free of charge unless the request is unusually complex or time consuming, in which case we may charge a reasonable fee, which we will advise you of in advance.

We may refuse access in certain circumstances permitted by law, such as where providing access would have an unreasonable impact on the privacy of other individuals, or where the request is frivolous or vexatious. If we refuse access, we will provide written reasons and tell you how to complain.

13.2  Right to Correction (APP 13)

If you believe that personal information we hold about you is inaccurate, incomplete, out of date, irrelevant, or misleading, you have the right to request correction. We will correct the information within 30 days of your request, or if we are unable to agree that the information requires correction, we will make a note on the record that you dispute its accuracy. Where we have disclosed the incorrect information to a third party, you can ask us to notify them of the correction.

13.3  Right to Deletion

You can ask us to delete personal information we hold about you. We will do so unless we are required to keep it by law, need it to establish or defend a legal claim, or need it to complete work you have asked us to do. See Section 12 for what we are obliged to keep and for how long.

13.4  Right to Withdraw Consent

Where our processing is based on your consent, for example marketing communications, you may withdraw consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent prior to its withdrawal.

13.5  Right to Opt Out of Direct Marketing (APP 7)

You may opt out of receiving direct marketing communications from us at any time by using the unsubscribe mechanism in any commercial electronic message we send, or by contacting us directly. We will give effect to your opt-out within 5 business days. You can also ask us where we got your details from, and we will tell you.

13.6  Right to a Copy of Your Data

Where it is reasonable and technically practicable, we will provide the personal information we hold about you in a common, machine readable format such as CSV or JSON, so you can take it elsewhere.

13.7  Right to Complain

You have the right to lodge a privacy complaint with us, using the details in Section 20, or with the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

Separately, since June 2025 the Privacy Act has given individuals a statutory right to sue for a serious invasion of privacy, where someone intrudes on their seclusion or misuses their information, intentionally or recklessly. We mention it so you know it exists. We would always prefer to hear from you first and fix the problem.

13.8  Right to Ask About Automated Steps

You can ask us to explain, and have a person review, any automated step described in Section 6.5 that involved your information.

To exercise any of the above rights, submit a written request to privacy@automatrix.au. We will ask you to verify your identity before we act on the request, which protects you from someone else making it in your name.

13.9  Requests About Data We Hold for a Client

If you are a customer of one of our clients and your information sits in a system we built or host, we are not the right first stop. Contact the business you dealt with, because they decide what happens to that data. If you contact us instead, we will pass the request to them promptly and help them action it.

14. Notifiable Data Breaches

We operate in line with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). If a data breach occurs that is likely to result in serious harm to one or more individuals whose personal information is involved, we will:

• Contain the breach and begin assessing its severity immediately, completing that assessment within 30 days
• Notify the Office of the Australian Information Commissioner as soon as practicable after forming the view that an eligible data breach has occurred
• Notify all affected individuals directly, and where that is not practicable, publish a prominent notice on our website
• Notify any client whose data, or whose customers' data, is involved without undue delay, so they can meet their own obligations
• Remediate the breach, then review what let it happen and fix that too

We maintain an internal data breach response plan and review our security measures regularly to reduce the risk of a breach occurring. If you believe your personal information held by us may have been subject to unauthorised access or disclosure, contact us immediately at privacy@automatrix.au.

15. Marketing and Spam Act Compliance

Automatrix complies with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth). We will only send you commercial electronic messages, including email and SMS, if:

• You have given us your express consent to receive such messages; or
• You are an existing client and we are sending messages relating to similar services we have provided to you, and you have not previously opted out. This is inferred consent under the Spam Act; or
• Your business has conspicuously published a work email address or phone number (for example on its website or Google Business Profile), with no statement that it does not want unsolicited commercial messages, and our message relates directly to your business role or functions. This is the inferred consent the Spam Act allows for published business addresses, and it is the only basis we use for business-to-business outreach from our Lead Engine

When you ask for something, such as a free systems audit through our website or a Facebook or Instagram form, we contact you by email, phone, or SMS about that request. Replying to your own enquiry is not marketing. If we later want to send you ongoing marketing, we ask first or rely on one of the bases above.

Every commercial electronic message we send will:

• Clearly identify Automatrix as the sender
• Include our contact details
• Contain a clear and functional unsubscribe mechanism that works without you having to log in or reply

We will honour all unsubscribe requests within 5 business days of receipt. Once you have unsubscribed, we will not send you further commercial electronic messages unless you re-subscribe. Transactional messages, such as an invoice, a booking confirmation, or a security notice, are not marketing and will continue.

Where we make marketing calls, we check numbers against the Do Not Call Register before calling, unless an exemption applies.

16. Children's Privacy

Our services are directed exclusively at businesses and their adult representatives. We do not knowingly collect personal information from individuals under the age of 18 years. Our website is not intended for use by children, and our ads are targeted only at people aged 18 and over.

If you become aware that a child has provided us with personal information without parental or guardian consent, contact us at privacy@automatrix.au and we will delete that information as soon as practicable.

Where we build a service for a client that is likely to be accessed by children, we design it against the requirements of the Children's Online Privacy Code being developed by the OAIC, and we tell that client what those requirements mean for their build.

17. Third-Party Links and Integrations

Our website and materials may contain links to third-party websites, platforms, or services, such as client websites, tool providers, or referral sources. We are not responsible for the privacy practices of third parties and this policy does not apply to any third-party website or service.

Review the privacy policies of any third-party services you use in connection with our work, including platforms such as Google, Anthropic, Stripe, Zapier, Make, and Netlify.

Where we build integrations or automations for clients that involve third-party services, we act on your instructions in the way described in Section 7, and our obligations are governed by your service agreement with us.

18. If You Are in the EU or UK

We are an Australian business serving Australian clients, and we do not target the European Economic Area or the United Kingdom. If you contact us from there, or if we handle data about individuals located there as part of a client engagement, we will:

• Process personal data on the lawful bases of contract performance, legitimate interests, legal obligation, or consent, as applicable
• Honour requests for access, rectification, erasure, restriction, portability, and objection
• Apply Standard Contractual Clauses or an equivalent transfer mechanism where a client engagement requires one
• Support the client, as their processor, in meeting their own GDPR or UK GDPR obligations

If you are in the EU or UK and want to exercise a right, email privacy@automatrix.au and say so, and we will treat it under the applicable regime.

19. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technology, legal requirements, or other factors. When we update this policy, we will:

• Update the effective date, review date, and version number at the top of this page
• Post the updated policy to this URL: automatrix.au/privacy-policy
• Where changes are material, notify you by email if you are a current client, or by a prominent notice on our website, at least 14 days before the change takes effect where practicable

Your continued use of the Site or our services after any changes to this policy constitutes your acceptance of those changes. We keep prior versions and will provide one on request.

20. Contact and Complaints

If you have any questions about this Privacy Policy, wish to access or correct your personal information, or wish to make a privacy complaint, contact our Privacy Officer.

Automatrix Digital Pty Ltd, Privacy Officer
Email: privacy@automatrix.au (or info@automatrix.au)
Phone: 0490 760 526
Post: Automatrix Digital Pty Ltd, Albury NSW 2640, Australia
Web: automatrix.au

20.1  Complaints Process

• We will acknowledge receipt of your complaint within 5 business days
• We will investigate the complaint and provide you with a written response within 30 days of receipt
• If we require additional time to investigate, we will notify you of the extended timeframe and the reasons for the delay
• If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner

20.2  Office of the Australian Information Commissioner

Phone: 1300 363 992
Online: oaic.gov.au/privacy/privacy-complaints
Post: GPO Box 5218, Sydney NSW 2001

Related reading: our Terms of Service set out the commercial terms that sit alongside this policy, and our guide to AI and the Privacy Act explains what these obligations mean for your own business.