Worthabid Privacy Policy

Tavrik Pty Ltd, trading as Worthabid (ABN 35 700 515 457) ("Tavrik", "we", "us"), operates the Worthabid service at https://www.worthabid.com.au. This policy explains what personal information we collect, why, how we hold it, who we share it with, and how you can access, correct or complain about our handling of it.

We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth). We are committed to those principles whether or not the Act requires it of us at any given time, and this policy is written to meet them.

Worthabid is a business-to-business service. Most of the personal information we hold is the work contact details of people at our customers, prospective customers and their clients.

1. What we collect

Account and user information. When an organisation signs up we collect the name and work email address of each user, the organisation's name and ABN, and the time and IP address of sign-ins and of acceptance of our terms.

Organisation profile. To score tenders we build a profile of your organisation. This draws on the public ABN Lookup record for your ABN, the public content of the website you nominate, and the capabilities, certifications, locations and preferences you enter or confirm. The profile describes an organisation, but it can include the names and roles of key people if they appear on your website or you add them.

Decisions and outcomes. The notices you look at, the verdicts you accept or override, and the outcomes you record, together with which user did so and when.

Client information on Agency plans. If you use an Agency plan, the same profile information about the client organisations you manage, and the work contact details of client staff you choose to enter.

Billing information. Your billing contact, plan, invoices and payment history. Card details are entered directly with Stripe and are never received or stored by us. We see the card type and last four digits only.

Support and correspondence. Emails and messages you send us, and our records of support requests. This includes feedback you send from within the service, the page you sent it from, and any screenshot you attach.

Waitlist and marketing. If you join the waitlist or contact us from the website, the email address and any details you give.

Technical information. Server logs including IP address, browser type, pages requested and timestamps, kept for security and troubleshooting.

Product usage. When your users sign in, open a notice, follow a link from a digest, or record what they did with a notice, we record which organisation and user it was, what they did, the notice concerned and when. We do not track whether an email is opened.

Integration data. If you connect a CRM, the authorisation token for that connection and a log of what was sent.

We do not collect sensitive information (such as health, racial or ethnic origin, political opinions or criminal record) and ask that you do not put it into the service.

2. How we collect it

Directly from you when you sign up, onboard, use the service, or contact us. From public sources when you give us your ABN or website address, namely the Australian Business Register and the website you nominate. From your users when they sign in. From the payment processor about the status of payments. Automatically through server logs when you use the service.

If you give us personal information about someone else, such as a colleague you invite or a client on an Agency plan, you are responsible for making sure they know their details will be held in Worthabid and that you are entitled to provide them.

3. Why we collect and use it

We use personal information to provide the service, including creating and securing accounts, building and maintaining your profile, scoring notices, sending digests and transactional emails, and passing notices to a CRM you connect; to bill you and keep tax records; to support you and respond to your requests; to protect the service, including detecting misuse, unauthorised access and abuse of trials; to improve the service, using product usage records to see which parts of it each customer uses and to follow up with them, and publishing only aggregated statistics that do not identify any organisation or person; to tell you about changes to the service, our terms or this policy; and to comply with the law.

We send marketing emails only to people who have joined the waitlist or asked to hear from us, and every one includes an unsubscribe link. We do not sell personal information and we do not share it with anyone for their own marketing.

4. Automated processing

Scores, win odds and verdicts are produced by automated systems from your organisation profile and public procurement data. They assess the fit of an organisation to a tender. They are not decisions about individuals and have no legal or similarly significant effect on any person. You can override any verdict and see the reasons behind it in the service.

5. Where your information is held

Our production systems, including the database that holds your account, profile, decisions and outcomes, run on servers we operate in OVHcloud's Sydney data centre. Backups are encrypted, held in Australia and used only to recover the service after a disaster. Sign-in links, digests and notifications are sent from our own mail servers in Australia.

Some of our service providers process limited information outside Australia, as listed in section 6. We do not otherwise send personal information overseas.

6. Who we share it with

We share personal information only with the service providers below, only for the purposes described, and under contracts that restrict their use of it.

We do not use third-party analytics, advertising or tracking services on the service or the website.

We may also disclose personal information where the law requires it, to our professional advisers under confidentiality, or to a buyer of the Worthabid business, in which case we will tell you before your information is transferred.

7. Cookies

The service uses cookies that are strictly necessary to keep you signed in and protect against cross-site request forgery. The marketing website uses no cookies. We do not use advertising or analytics cookies. You can clear cookies in your browser at any time, which will sign you out.

8. Security

We protect personal information with measures including encryption in transit, encryption of stored data at rest (including backups), encryption of stored credentials and integration tokens, tenant isolation in the database so one organisation cannot read another's data, sign-in by single-use emailed links rather than stored passwords, access limited to staff who need it, logging of administrative access, and regular backups with a tested restore process.

No system is completely secure. If a data breach occurs that is likely to result in serious harm to anyone, we will notify the affected people and the Office of the Australian Information Commissioner as soon as practicable and in any case as the Notifiable Data Breaches scheme requires.

9. How long we keep it

We keep your account information and service data for as long as your account is active. When a subscription ends we keep the data for 30 days so it can be exported or the account reactivated, then delete it. Whenever information is deleted, it leaves our live systems immediately and leaves our backups within 90 days, as the backups rotate. Trial accounts that do not subscribe are deleted 60 days after the trial ends, after a reminder.

Server logs are kept for 90 days. Product usage records are kept for 12 months. Billing records are kept for seven years as tax law requires. Waitlist and correspondence records are kept until you ask us to remove them or they are no longer needed.

10. Access, correction and deletion

You can see and change your own user details and your organisation's profile in the service at any time, and export your profile, assessments and outcomes from Settings. Account owners can remove users, which deletes their sign-in and leaves an anonymised record of the decisions they made. Notes a user wrote on notices belong to the organisation. They stay after the user is removed, shown as written by a "Former member", and are deleted with the organisation's other data. Their product usage records stay with the organisation without their name, and feedback they sent stays without their name.

To access or correct other personal information we hold about you, or to ask us to delete your account or your details, email the contact form. We will respond within 30 days. We may need to verify your identity first. If we refuse a request we will tell you why and how to complain.

If you are a person whose details have been entered by one of our customers, for example as a client on an Agency plan, you can contact us directly and we will act on your request and inform the customer.

11. Complaints

If you have a concern about how we have handled your personal information, email the contact form with the subject "Privacy complaint". We will acknowledge it within five business days, investigate, and give you a written response within 30 days.

If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

12. Changes to this policy

We will publish any changes on this page and update the effective date. For changes that affect how we use or share your personal information we will email account owners at least 30 days before the change takes effect.

13. Contact

Privacy Officer Tavrik Pty Ltd, trading as Worthabid, ABN 35 700 515 457 the contact form