PRIVACY POLICY

Introduction
This privacy policy sets out the privacy practices of UCert Pty Ltd (ACN: 688 007 678) (referred to in this privacy policy as we, us, or our). We operate an online software platform that helps registered building certifiers manage their certification workflows (Software).

We take our privacy obligations seriously. This privacy policy explains how we collect, hold, use and disclose personal information, in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

By providing personal information to us, or by using the Software or our website, you consent to our handling of personal information in accordance with this privacy policy.

We may update this privacy policy from time to time by posting an updated copy on our website. We encourage you to check our website regularly to ensure that you are aware of our most current privacy policy.
Two Categories of Personal Information
This privacy policy distinguishes between two different categories of personal information:
1. Customer Information — personal information we collect directly from, or about, our customers (including registered certifiers, individuals at certifier companies who use the Software, and individuals who interact with our website or contact us). We are responsible for handling Customer Information in accordance with the Privacy Act.
2. User Data — personal information that our customers (and their authorised users) collect, upload, input, store, transmit or process through the Software in the course of their certification work. This may include personal information about the customer's own clients, end customers, contractors, employees and other third parties. Our customers are responsible for handling User Data in accordance with the Privacy Act and other applicable privacy laws. We handle User Data on our customers' behalf, in accordance with our customer agreement (the SaaS Terms and Conditions) and this privacy policy.
Different parts of this privacy policy apply to each category. Sections 3 to 9 explain how we handle Customer Information. Section 10 explains how we handle User Data and the obligations of our customers in relation to User Data.
Types of Customer Information We Collect
The Customer Information we collect may include:
1. name;
2. email address and other contact details (including telephone number and mailing or street address);
3. the name and details of the organisation you represent (including ABN);
4. your professional registration details (including your certifier registration number);
5. payment details (which are processed and held by our payment provider — see section 6);
6. login credentials and other account information;
7. signatures (where required for use of the Software);
8. information about your business and how you use the Software;
9. information you provide to us through customer surveys, feedback, or in response to communications from us;
10. your device identity and type, IP address, geo-location information, page view statistics, and standard web log information; and
11. any other information you provide to us via the Software, our website or otherwise.
How We Collect Customer Information
We collect Customer Information directly from you, or from third parties on your behalf, including when you:
1. sign up to use the Software, or set up an Account or Authorised User profile;
2. contact us through our website, by email, telephone or otherwise;
3. use or access the Software or our website;
4. respond to a survey, questionnaire, or feedback request from us;
5. participate in marketing or promotional activities; and
6. apply for a position with us.
We may also collect Customer Information through the use of cookies, web analytics tools and similar tracking technologies when you use or interact with our website. Cookies are small files that store information on your device and allow us to recognise you when you return to our website. You can disable cookies through your browser settings, although doing so may affect the functionality of our website.

We may use Google Analytics or similar tools to collect and process website usage data. To find out more about how Google handles such data, see https://policies.google.com/privacy.
How We Use Customer Information
We collect, hold and use Customer Information for the following purposes:
1. to provide the Software and any related goods or services to you;
2. to set up, manage, and administer your Account and Authorised User access;
3. to bill, charge and collect payments from you;
4. to communicate with you, including in relation to the Software, your Account, our policies, and these privacy practices;
5. to provide customer support, respond to enquiries, and resolve disputes;
6. to improve and develop the Software, our website and our services;
7. to monitor, analyse and produce statistics, benchmarks and insights (including by using personal information in aggregated and de-identified form);
8. to comply with our legal obligations, enforce our agreements, and protect our rights and the rights of others;
9. to send you marketing or promotional materials about the Software and other products or services we offer (in accordance with the Spam Act 2003 (Cth) and section 8 below); and
10. any other purpose that is reasonably necessary in connection with our business or that you would reasonably expect.
We do not generally collect or use sensitive information (as defined in the Privacy Act). Where we incidentally collect sensitive information through Customer Information, we will only use or disclose it for the primary purpose for which it was collected, or as otherwise permitted by the Privacy Act.
Disclosure of Customer Information
We may disclose Customer Information to third parties, including:
1. our personnel, contractors, and professional advisers;
2. our cloud hosting providers (including Amazon Web Services, which hosts the Software in Australia);
3. our payment processor (Stripe Payments Australia Pty Ltd) for the purpose of processing payments;
4. other third-party service providers we use to operate our business (for example, providers of customer relationship management, email, communication, analytics, accounting, and customer support tools);
5. any third party with your consent or at your direction;
6. any party we are required or permitted to disclose to by law or regulation, or in connection with legal proceedings; and
7. any party to whom we sell or transfer (or propose to sell or transfer) all or part of our business or assets.
We require third parties who handle Customer Information on our behalf to have appropriate measures in place to protect that information.
Cross-Border Disclosure
We host the Software and User Data on cloud infrastructure located in Australia. However, in operating our business we use third-party service providers that are located outside Australia, or that have group entities or sub-processors located outside Australia. As a result, personal information may be disclosed to, or accessed from, recipients located in:
1. the United States (including in connection with services provided by Amazon Web Services and Stripe); and
2. other jurisdictions in which our service providers (or their group entities or sub-processors) operate from time to time.
Before disclosing personal information to a recipient outside Australia, we take reasonable steps to ensure that the recipient handles the information in a manner consistent with the APPs, or that another exception under APP 8 applies.
Marketing Communications
We may use your Customer Information (including your name and email address) to send you marketing or promotional materials about the Software, related products or services, or about our business more generally.

We will only send you marketing materials where we are permitted to do so under the Privacy Act and the Spam Act 2003 (Cth). You can opt out of receiving marketing materials at any time by:
1. using the unsubscribe link at the foot of any marketing email we send you; or
2. contacting us using the details in section 15.
Opting out of marketing does not affect your access to the Software or any administrative or transactional communications relating to your use of the Software.
Automated Decision-Making
Where we use automated systems (including any artificial intelligence or machine-learning models) to make decisions that significantly affect you, we will tell you about that use, including the kinds of personal information used to make the decision and how you can request human review.

You may request human review of any automated decision that significantly affects you by contacting us using the details in section 15.
Personal Information in User Data
When our customers and their authorised users use the Software, they may collect, upload, input, store, transmit or process personal information about their own clients, end customers, contractors, employees and other third parties (User Data). For example, User Data may include personal information about homeowners, builders, developers and other parties to a building project.

Our customers are responsible for User Data. Where personal information is uploaded to or handled through the Software as part of User Data, our customer (and not us) is responsible for:
1. complying with the Privacy Act, the APPs, and any other applicable privacy laws (including in relation to the collection, use, storage and disclosure of that information);
2. providing all required notices to, and obtaining all required consents from, the individuals to whom the personal information relates (including in respect of disclosure of the information to us, our processing of it through the Software, our use of it in aggregated or de-identified form, and any disclosure to government portals or third-party integrations);
3. maintaining their own privacy policy that accurately describes how they handle personal information; and
4. responding to any access, correction, complaint or other request from individuals in relation to that information.
How we handle User Data. When we handle User Data, we do so on behalf of our customer and in accordance with the SaaS Terms and Conditions. In particular:
1. we host User Data on cloud infrastructure located in Australia;
2. we use User Data only as reasonably necessary to provide the Software and the Permitted Integrations to our customer, and as otherwise permitted under the SaaS Terms and Conditions;
3. we may use User Data in aggregated and de-identified form (so that it does not identify any individual or any specific project) to monitor, analyse and improve the Software and our other products and services, produce statistics, benchmarks and insights, and train and improve internal analytics and machine learning models we use to operate the Software;
4. we will not use raw, identifiable User Data to train any machine learning model, and we will not sell User Data; and
5. we may disclose User Data to the same categories of recipients listed in section 6, where reasonably necessary to provide the Software.
Government portal submissions. Where User Data is submitted through the Software to the NSW Planning Portal or any other government portal, we act as a conduit for that submission only — the submission is made by our customer (or their authorised user) using their own credentials. Once data is submitted to a government portal, the relevant government agency handles that data under its own privacy framework, and we are not responsible for that further handling.

Requests in respect of User Data. If you are an individual whose personal information is included in User Data and you wish to make a request relating to that information (for example, to access, correct or have it deleted), please contact our customer (the certifier company that holds your information). We are generally not in a position to action such requests directly, because our customer is the entity that controls how that information is collected and used. We will assist our customer to respond to your request as required under the Privacy Act.
Security
We take reasonable steps to keep personal information secure, accurate and up to date. Our information technology systems are protected through a range of technical, administrative and physical safeguards, including access controls, encryption (in transit and where appropriate at rest), and personnel training.

However, no system is completely secure. We cannot guarantee the security of any personal information, including User Data, that is transmitted to or stored by us, and we do not warrant that personal information will not be subject to unauthorised access despite our security measures.
Data Breach Notification
If we are subject to the Notifiable Data Breaches scheme under the Privacy Act and we become aware of a data breach involving personal information that is likely to result in serious harm to one or more individuals, we will (where the scheme applies to us):
1. promptly assess and contain the breach;
2. notify the affected individuals and the Office of the Australian Information Commissioner in accordance with the scheme; and
3. take reasonable steps to remediate the breach.
Where a data breach involves User Data and our customer is responsible for that User Data under the Privacy Act, we will notify the relevant customer as soon as reasonably practicable and assist them in their own response and notification obligations.
Retention of Personal Information
We retain personal information only for as long as is reasonably necessary for the purposes for which it was collected, or as required by law.

Customer Information. We generally retain Customer Information while you are a customer (or otherwise have an active relationship with us), and for a reasonable period after that to allow us to:
1. respond to enquiries or complaints;
2. comply with our legal, accounting and tax obligations, which may require us to retain transactional records (such as invoices, payment records and accounting records) for a period determined by the relevant law; and
3. exercise or defend our legal rights.
User Data. Following cancellation or termination of a customer's subscription, the customer has 30 days to extract or download User Data from the Software. After that period, we may delete User Data in accordance with the SaaS Terms and Conditions. Customers are responsible for retaining their own copies of records they are required to keep under any applicable law (including, for registered certifiers, statutory record-keeping obligations of up to 10 years or longer under the Building and Development Certifiers Act 2018 (NSW) and associated regulations).

Where we are no longer required to retain personal information, we will take reasonable steps to destroy or de-identify it. We may retain de-identified or aggregated information indefinitely.
Access, Correction and Complaints
Access and correction. You may request access to, or correction of, the Customer Information we hold about you by contacting us using the details in section 15. We may need to verify your identity before responding to your request. We will respond within a reasonable timeframe. In some cases, we may decline a request for access or correction (for example, where giving access would be unlawful, would compromise another person's privacy, or where the request is frivolous or vexatious). If we decline a request, we will explain why.

Complaints. If you have a complaint about how we handle personal information, please contact us using the details in section 15. We will investigate your complaint and respond within a reasonable time.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at https://www.oaic.gov.au.

Requests relating to User Data. As noted in section 10, if you are an individual whose personal information is included in User Data, please contact the relevant certifier company (our customer) for any request relating to that information.
Contact Us
For more information about this privacy policy or our privacy practices, or to make a request or complaint, please contact us using the details below:

Email: milan@ucert.com.au, luke@ucert.com.au
Address: PO Box 42, Ramsgate, NSW, 2177

This privacy policy was last updated on 29 April 2026.

} /* ── Top-level numbered sections ── */ ol.sections { list-style: none; counter-reset: section; padding-left: 0; } ol.sections > li { counter-increment: section; margin-bottom: 1.6em; } ol.sections > li::before { content: counter(section) " "; font-weight: bold; font-size: 1.05em; } ol.sections > li > .section-title { font-weight: bold; font-size: 1.05em; text-transform: uppercase; display: inline; } ol.sections > li > p, ol.sections > li > ol, ol.sections > li > .sub-section { margin-top: 0.6em; } /* ── Sub-sections (e.g. "12.1") ── */ ol.subsections { list-style: none; counter-reset: subsection; padding-left: 1.5em; margin-top: 0.6em; } ol.subsections > li { counter-increment: subsection; margin-bottom: 0.8em; } ol.subsections > li::before { content: counter(section) "." counter(subsection) " "; font-weight: bold; } ol.subsections > li > .subsection-title { font-weight: bold; display: inline; } /* ── Alpha sub-lists ── */ ol.alpha { list-style-type: lower-alpha; padding-left: 2em; margin-top: 0.4em; } ol.alpha > li { margin-bottom: 0.4em; } /* ── Roman sub-lists ── */ ol.roman { list-style-type: lower-roman; padding-left: 2em; margin-top: 0.4em; } ol.roman > li { margin-bottom: 0.4em; } .last-updated { margin-top: 2.5em; font-style: italic; color: #555; text-align: right; } a { color: #1a5fa8; }

PRIVACY POLICY

Introduction
This privacy policy sets out the privacy practices of UCert Pty Ltd (ACN: 688 007 678) (referred to in this privacy policy as we, us, or our). We operate an online software platform that helps registered building certifiers manage their certification workflows (Software).

We take our privacy obligations seriously. This privacy policy explains how we collect, hold, use and disclose personal information, in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

By providing personal information to us, or by using the Software or our website, you consent to our handling of personal information in accordance with this privacy policy.

We may update this privacy policy from time to time by posting an updated copy on our website. We encourage you to check our website regularly to ensure that you are aware of our most current privacy policy.
Two Categories of Personal Information
This privacy policy distinguishes between two different categories of personal information:
1. Customer Information — personal information we collect directly from, or about, our customers (including registered certifiers, individuals at certifier companies who use the Software, and individuals who interact with our website or contact us). We are responsible for handling Customer Information in accordance with the Privacy Act.
2. User Data — personal information that our customers (and their authorised users) collect, upload, input, store, transmit or process through the Software in the course of their certification work. This may include personal information about the customer's own clients, end customers, contractors, employees and other third parties. Our customers are responsible for handling User Data in accordance with the Privacy Act and other applicable privacy laws. We handle User Data on our customers' behalf, in accordance with our customer agreement (the SaaS Terms and Conditions) and this privacy policy.
Different parts of this privacy policy apply to each category. Sections 3 to 9 explain how we handle Customer Information. Section 10 explains how we handle User Data and the obligations of our customers in relation to User Data.
Types of Customer Information We Collect
The Customer Information we collect may include:
1. name;
2. email address and other contact details (including telephone number and mailing or street address);
3. the name and details of the organisation you represent (including ABN);
4. your professional registration details (including your certifier registration number);
5. payment details (which are processed and held by our payment provider — see section 6);
6. login credentials and other account information;
7. signatures (where required for use of the Software);
8. information about your business and how you use the Software;
9. information you provide to us through customer surveys, feedback, or in response to communications from us;
10. your device identity and type, IP address, geo-location information, page view statistics, and standard web log information; and
11. any other information you provide to us via the Software, our website or otherwise.
How We Collect Customer Information
We collect Customer Information directly from you, or from third parties on your behalf, including when you:
1. sign up to use the Software, or set up an Account or Authorised User profile;
2. contact us through our website, by email, telephone or otherwise;
3. use or access the Software or our website;
4. respond to a survey, questionnaire, or feedback request from us;
5. participate in marketing or promotional activities; and
6. apply for a position with us.
We may also collect Customer Information through the use of cookies, web analytics tools and similar tracking technologies when you use or interact with our website. Cookies are small files that store information on your device and allow us to recognise you when you return to our website. You can disable cookies through your browser settings, although doing so may affect the functionality of our website.

We may use Google Analytics or similar tools to collect and process website usage data. To find out more about how Google handles such data, see https://policies.google.com/privacy.
How We Use Customer Information
We collect, hold and use Customer Information for the following purposes:
1. to provide the Software and any related goods or services to you;
2. to set up, manage, and administer your Account and Authorised User access;
3. to bill, charge and collect payments from you;
4. to communicate with you, including in relation to the Software, your Account, our policies, and these privacy practices;
5. to provide customer support, respond to enquiries, and resolve disputes;
6. to improve and develop the Software, our website and our services;
7. to monitor, analyse and produce statistics, benchmarks and insights (including by using personal information in aggregated and de-identified form);
8. to comply with our legal obligations, enforce our agreements, and protect our rights and the rights of others;
9. to send you marketing or promotional materials about the Software and other products or services we offer (in accordance with the Spam Act 2003 (Cth) and section 8 below); and
10. any other purpose that is reasonably necessary in connection with our business or that you would reasonably expect.
We do not generally collect or use sensitive information (as defined in the Privacy Act). Where we incidentally collect sensitive information through Customer Information, we will only use or disclose it for the primary purpose for which it was collected, or as otherwise permitted by the Privacy Act.
Disclosure of Customer Information
We may disclose Customer Information to third parties, including:
1. our personnel, contractors, and professional advisers;
2. our cloud hosting providers (including Amazon Web Services, which hosts the Software in Australia);
3. our payment processor (Stripe Payments Australia Pty Ltd) for the purpose of processing payments;
4. other third-party service providers we use to operate our business (for example, providers of customer relationship management, email, communication, analytics, accounting, and customer support tools);
5. any third party with your consent or at your direction;
6. any party we are required or permitted to disclose to by law or regulation, or in connection with legal proceedings; and
7. any party to whom we sell or transfer (or propose to sell or transfer) all or part of our business or assets.
We require third parties who handle Customer Information on our behalf to have appropriate measures in place to protect that information.
Cross-Border Disclosure
We host the Software and User Data on cloud infrastructure located in Australia. However, in operating our business we use third-party service providers that are located outside Australia, or that have group entities or sub-processors located outside Australia. As a result, personal information may be disclosed to, or accessed from, recipients located in:
1. the United States (including in connection with services provided by Amazon Web Services and Stripe); and
2. other jurisdictions in which our service providers (or their group entities or sub-processors) operate from time to time.
Before disclosing personal information to a recipient outside Australia, we take reasonable steps to ensure that the recipient handles the information in a manner consistent with the APPs, or that another exception under APP 8 applies.
Marketing Communications
We may use your Customer Information (including your name and email address) to send you marketing or promotional materials about the Software, related products or services, or about our business more generally.

We will only send you marketing materials where we are permitted to do so under the Privacy Act and the Spam Act 2003 (Cth). You can opt out of receiving marketing materials at any time by:
1. using the unsubscribe link at the foot of any marketing email we send you; or
2. contacting us using the details in section 15.
Opting out of marketing does not affect your access to the Software or any administrative or transactional communications relating to your use of the Software.
Automated Decision-Making
Where we use automated systems (including any artificial intelligence or machine-learning models) to make decisions that significantly affect you, we will tell you about that use, including the kinds of personal information used to make the decision and how you can request human review.

You may request human review of any automated decision that significantly affects you by contacting us using the details in section 15.
Personal Information in User Data
When our customers and their authorised users use the Software, they may collect, upload, input, store, transmit or process personal information about their own clients, end customers, contractors, employees and other third parties (User Data). For example, User Data may include personal information about homeowners, builders, developers and other parties to a building project.

Our customers are responsible for User Data. Where personal information is uploaded to or handled through the Software as part of User Data, our customer (and not us) is responsible for:
1. complying with the Privacy Act, the APPs, and any other applicable privacy laws (including in relation to the collection, use, storage and disclosure of that information);
2. providing all required notices to, and obtaining all required consents from, the individuals to whom the personal information relates (including in respect of disclosure of the information to us, our processing of it through the Software, our use of it in aggregated or de-identified form, and any disclosure to government portals or third-party integrations);
3. maintaining their own privacy policy that accurately describes how they handle personal information; and
4. responding to any access, correction, complaint or other request from individuals in relation to that information.
How we handle User Data. When we handle User Data, we do so on behalf of our customer and in accordance with the SaaS Terms and Conditions. In particular:
1. we host User Data on cloud infrastructure located in Australia;
2. we use User Data only as reasonably necessary to provide the Software and the Permitted Integrations to our customer, and as otherwise permitted under the SaaS Terms and Conditions;
3. we may use User Data in aggregated and de-identified form (so that it does not identify any individual or any specific project) to monitor, analyse and improve the Software and our other products and services, produce statistics, benchmarks and insights, and train and improve internal analytics and machine learning models we use to operate the Software;
4. we will not use raw, identifiable User Data to train any machine learning model, and we will not sell User Data; and
5. we may disclose User Data to the same categories of recipients listed in section 6, where reasonably necessary to provide the Software.
Government portal submissions. Where User Data is submitted through the Software to the NSW Planning Portal or any other government portal, we act as a conduit for that submission only — the submission is made by our customer (or their authorised user) using their own credentials. Once data is submitted to a government portal, the relevant government agency handles that data under its own privacy framework, and we are not responsible for that further handling.

Requests in respect of User Data. If you are an individual whose personal information is included in User Data and you wish to make a request relating to that information (for example, to access, correct or have it deleted), please contact our customer (the certifier company that holds your information). We are generally not in a position to action such requests directly, because our customer is the entity that controls how that information is collected and used. We will assist our customer to respond to your request as required under the Privacy Act.
Security
We take reasonable steps to keep personal information secure, accurate and up to date. Our information technology systems are protected through a range of technical, administrative and physical safeguards, including access controls, encryption (in transit and where appropriate at rest), and personnel training.

However, no system is completely secure. We cannot guarantee the security of any personal information, including User Data, that is transmitted to or stored by us, and we do not warrant that personal information will not be subject to unauthorised access despite our security measures.
Data Breach Notification
If we are subject to the Notifiable Data Breaches scheme under the Privacy Act and we become aware of a data breach involving personal information that is likely to result in serious harm to one or more individuals, we will (where the scheme applies to us):
1. promptly assess and contain the breach;
2. notify the affected individuals and the Office of the Australian Information Commissioner in accordance with the scheme; and
3. take reasonable steps to remediate the breach.
Where a data breach involves User Data and our customer is responsible for that User Data under the Privacy Act, we will notify the relevant customer as soon as reasonably practicable and assist them in their own response and notification obligations.
Retention of Personal Information
We retain personal information only for as long as is reasonably necessary for the purposes for which it was collected, or as required by law.

Customer Information. We generally retain Customer Information while you are a customer (or otherwise have an active relationship with us), and for a reasonable period after that to allow us to:
1. respond to enquiries or complaints;
2. comply with our legal, accounting and tax obligations, which may require us to retain transactional records (such as invoices, payment records and accounting records) for a period determined by the relevant law; and
3. exercise or defend our legal rights.
User Data. Following cancellation or termination of a customer's subscription, the customer has 30 days to extract or download User Data from the Software. After that period, we may delete User Data in accordance with the SaaS Terms and Conditions. Customers are responsible for retaining their own copies of records they are required to keep under any applicable law (including, for registered certifiers, statutory record-keeping obligations of up to 10 years or longer under the Building and Development Certifiers Act 2018 (NSW) and associated regulations).

Where we are no longer required to retain personal information, we will take reasonable steps to destroy or de-identify it. We may retain de-identified or aggregated information indefinitely.
Access, Correction and Complaints
Access and correction. You may request access to, or correction of, the Customer Information we hold about you by contacting us using the details in section 15. We may need to verify your identity before responding to your request. We will respond within a reasonable timeframe. In some cases, we may decline a request for access or correction (for example, where giving access would be unlawful, would compromise another person's privacy, or where the request is frivolous or vexatious). If we decline a request, we will explain why.

Complaints. If you have a complaint about how we handle personal information, please contact us using the details in section 15. We will investigate your complaint and respond within a reasonable time.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at https://www.oaic.gov.au.

Requests relating to User Data. As noted in section 10, if you are an individual whose personal information is included in User Data, please contact the relevant certifier company (our customer) for any request relating to that information.
Contact Us
For more information about this privacy policy or our privacy practices, or to make a request or complaint, please contact us using the details below:

Email: milan@ucert.com.au, luke@ucert.com.au
Address: PO Box 42, Ramsgate, NSW, 2177

This privacy policy was last updated on 29 April 2026.