Privacy notice
Effective from · All documents
Who we are
Get Frank is provided by Get Frank Pty Ltd, a company registered in Queensland, Australia; its ACN is 703 155 757. This notice explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. For any privacy question or request, contact us at [email protected].
What we collect
We collect personal information directly from you, automatically as you use the site, and — where you are named in something a customer organisation puts into the platform — from that organisation rather than from you. The table below is a guide, not an exhaustive list.
| Information | How we collect it | Why we collect it |
|---|---|---|
| Contact and identity details — name, email, organisation | Directly, when you submit the contact form or correspond with us | Enquiry and marketing |
| Account details — your name, work email, organisation | Directly, when you or your organisation set up and use your account | Service delivery |
| Contact details a customer organisation keeps in the platform for us to reach it — the email address of its security contact and of its billing contact, every earlier address each has had, who set each and when, and the notices we have sent to each | From that customer organisation, when one of its owners or administrators sets the contact; a new address is confirmed by whoever reads it, through a link we send there | Service delivery: telling that organisation what our terms say we will tell it, and, once we invoice through the platform, invoicing it |
| The files and records a customer organisation uploads to the platform, which may contain personal information about its employees, contractors, suppliers, or other people | From that customer organisation, not from the individuals named in them | Service delivery |
| Usage and device information — pages viewed, referring site, browser and device type, country | Automatically, through Cloudflare Web Analytics when you visit the site | Analytics and improvement |
| IP address and browser or device security signals | Automatically, through Cloudflare Turnstile when you visit the contact page or use the form | Bot protection |
Everyone who uses the platform does so on an organisation’s behalf, and we deal with them as that organisation’s authorised representative. Putting a file or a record into the platform is a statement that the person doing it is entitled to act for the organisation, and that the organisation holds whatever permission it needs to give us what is in that file.
Information about people who are not our users
A governance record can name people who never dealt with us: the owner of a risk, the contact at a supplier, the person an incident concerns. If we hold information about you for that reason, we did not collect it from you, and this section is our notice of that collection.
We do not come to you for it directly because we have no way to. We hold no relationship with you and no means of reaching you; the organisation that engaged us holds both. No law requires us to collect it. The customer organisation decides what its records contain and what it puts into the platform, and we hold what it uploads to deliver the service to that organisation and for nothing else — the sub-processors, retention, and security sections below apply to it exactly as they do to anyone’s. If information about you is never uploaded, no consequence follows for you. You are not our customer and we owe you no service; any consequence is the customer organisation’s, in its own records.
Our agreement with each customer requires it to have collected what it uploads lawfully, to be allowed by law to pass it to us, and to have given the people named in it whatever notice they are owed, including that it is passed to us. If you were not told, or you want to know what is held about you or have it corrected, ask that organisation first. It decides what its records contain and we will not alter them on your behalf. Come to us at [email protected] and we will tell you who holds it, help where we practicably can, and treat a complaint about our own handling under the complaints section below.
A customer organisation can also name someone outside it as the contact we send its notices or invoices to: a security provider it engages, or its accounts firm. If that is you, we hold your email address, which organisation named you, who in it did so and when, and what we have sent you. You confirmed the address yourself through the link we sent to it; the organisation that named you decides whether you stay its contact, and changing that is for it to do. Being named does not make you our user or give you any access to that organisation’s records.
Sensitive information
We do not seek to collect sensitive information. As defined in the Privacy Act 1988 (Cth), this includes information about health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or criminal record. Please do not submit it through our contact form or in correspondence. Where we receive it there without having asked for it, we will destroy or de-identify it as soon as practicable, unless the law requires us to retain it.
The platform is not built to hold it either, and it should not reach the platform at all — though a governance record can carry it without anyone intending it to, in a health detail inside an incident narrative or a background check inside a supplier file. Customers decide what goes into an upload: remove or redact sensitive information before the file is uploaded. Where something has already reached us, raise a support request and we will remove it from working data.
How we use it
- To deliver a service you have engaged us for.
- To understand how the Get Frank platform is used, to troubleshoot issues, and to improve our services.
- To keep the service secure and to monitor and enforce compliance with our terms of service, including detecting and preventing misuse.
- To contact you about that service, or where you have opted in to marketing from us. You can opt out of marketing at any time through the unsubscribe link in any marketing email.
- We may share your details with the sub-processors on our sub-processors and hosting page, for the purpose shown against each of them. We do not share your details with another party for their own use, except where required for compliance purposes or to comply with a valid legal request.
Cookies
We set no cookies of our own, and our analytics set none. Cloudflare Web Analytics counts page views without setting cookies, without writing to your browser’s local storage, and without fingerprinting your browser or device. It does not identify you, track you across sites, or track you over time. It derives a country from your IP address as the page loads; the analytics record keeps the country and not the address.
The Cloudflare Turnstile widget on our contact page is served by Cloudflare from its own domain and runs under Cloudflare’s own terms. To run and secure the challenge, Cloudflare may store data on your device, including cookies. We do not control what it stores and we do not read it. See the sub-processors section below for what Turnstile processes on our behalf.
Separately from analytics, Cloudflare receives your IP address whenever it serves you a page, and processes it to deliver and secure the site. You can block or delete stored data at any time through your browser settings, though blocking it may stop the contact form’s bot check from completing.
The Get Frank platform is a separate application from this website, and it does set one cookie: a strictly necessary cookie that keeps you signed in between visits. It is scoped to the platform’s own origin and is not sent to this website or to any other site. The platform sets no analytics or advertising cookies.
It also keeps two things in your browser’s own storage, both strictly necessary to run: the token that authenticates your signed-in session, and the state of what you were working on, so that reloading a page does not lose your place. Signing out clears the token; the view state is held per tab and goes when you close it.
Sub-processors
We rely on a small number of providers to operate the service. Who they are, what each does for us, and where data is held are on the sub-processors and hosting page, which is the canonical list and says how we notify changes. In short: the Get Frank application and everything it stores run in Sydney, Australia; email runs in Australia; and the website is served from Cloudflare’s global edge and holds no customer content.
When you visit the contact page or use the form, Cloudflare Turnstile processes your IP address and browser or device security signals on our behalf to tell humans from bots, and Cloudflare also uses those signals to improve its bot-detection service. We do not provide the contents of the contact form — your name, email, organisation, or message — to Cloudflare for this purpose.
Some of what we hold about you is reachable from outside Australia. The platform and everything it stores, and our email, are held in Australia, but DigitalOcean, Amazon Web Services, Cloudflare and Microsoft are companies based in the United States, and SMTP2GO in New Zealand, and their staff may reach the information they handle for us from there to run and support what they provide. The website is served from Cloudflare’s global network, so your IP address, and the signals Turnstile reads, are processed in whichever country’s Cloudflare data centre answers you, usually the one nearest you. Where a customer organisation subscribes to a feed that asks an outside service about its software, as the sub-processors page describes, the names of its packages are sent to that service, and a package published under a person’s own name carries that name with it; the organisation decides which of its packages are kept back. We do not otherwise disclose personal information outside Australia.
Retention
- Data collected through a service with you is retained for the duration of our relationship with you.
- Files your organisation uploads to the platform are held only as long as your organisation’s retention window allows. That window is yours to set: it defaults to 30 days and cannot be set beyond 365, and there is no option to keep file contents indefinitely. Once it passes, the contents become eligible for removal and are erased by a cleanup that runs daily, so a file can remain in active storage until the first run after its window closes. The record of the upload — file name, size, content hash, and how its columns were mapped — is part of your assurance history and is kept.
- The emails the platform sends you about your work are kept in full while they wait to be sent (one that cannot be delivered is withdrawn once it has waited a month), and for 30 days after they are sent or withdrawn. Once those 30 days have passed, what each one said becomes eligible for removal; a year after it was sent or withdrawn, so does the address it went to. The withdrawal and both erasures are done by a cleanup that runs daily, so each can happen up to a day after its window closes. At the year, an email that nothing in the platform still refers to is deleted. One that still answers for something you were told about is kept as a delivery record for as long as your organisation’s account exists: that it was for you, whether it went at once or in a digest, how many attempts it took, and when it was queued and sent or withdrawn. That record is what stops the same thing being emailed to you twice.
- The records of your signed-in sessions become eligible for removal 30 days after the session expires, and are erased by a cleanup that runs daily, so a record can remain until the first run after then.
- The contact details a customer organisation keeps in the platform, every earlier address each contact has had, and every notice we sent with the address it went to, are kept for as long as that organisation’s account exists, because together they answer whether the organisation was told and where. They leave with its complete export and are deleted with the rest of its data when the account ends. A copy of the contacts in force for every organisation is held in a mailbox outside the platform, on the sub-processors and hosting page, so that we can reach them when the platform cannot be reached; each copy is replaced by the next whenever a contact changes, and at least every week, and earlier copies are deleted within 12 months.
- All other data — including contact form submissions, email correspondence, and analytics — is retained for up to 12 months.
Backups and what erasure means
When we erase something — because a retention window has passed, or because you asked us to — it is removed from the platform’s active storage, and the running application has no way to reach it afterwards.
That is not the same as removing every physical copy. A database backup taken while we still held the data continues to hold it until the backup itself is deleted, and restoring a backup restores what that backup held at the moment it was taken. There are two kinds, both listed on the sub-processors and hosting page: point-in-time backups covering the previous seven days, kept for the seven days the hosting provider states, and a nightly dump of the database, each dump deleted by us within seven days of being taken. Neither is kept longer than the longest retention window in force for a customer. Until a backup is deleted, the data in it is used for nothing but restoring the service, and where we have removed sensitive information from the platform we remove it again from anything restored from an earlier copy.
Security
We apply industry-standard controls to protect the information we hold on your behalf. Given what we do for a living, we treat this as foundational rather than incidental.
In practice that means traffic to and from the platform is encrypted in transit and served only over HTTPS; each customer’s data is isolated from every other customer’s at the database layer; credentials you give us for connected systems are encrypted at rest; and the privileged console we use to support the service runs on a separate origin from the application you use, so a session in one cannot be reached from the other.
Data breaches
If an eligible data breach occurs — one that is likely to result in serious harm to an affected individual — we will act to contain it and notify the affected individuals and the Office of the Australian Information Commissioner, in line with the Notifiable Data Breaches scheme.
Children
Our services are built for organisations and the people who work in them. They are not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, email [email protected] and we will delete it.
Dealing with us anonymously
You can interact with us anonymously or using a pseudonym where it is practicable for us to deal with you that way. Some interactions require us to verify your identity — for example, confirming that you own an account or actioning a privacy request — and we cannot proceed anonymously in those cases.
Automated decisions
We do not make decisions that affect you using solely automated processing of your personal information.
Your rights
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you may request access to the personal information we hold about you and correction of anything that is inaccurate, out of date, or incomplete. Beyond those statutory rights, we also choose to offer erasure, restriction, and portability of your information where it is practicable for us to provide them. Email [email protected] to exercise any of these. Where you ask us to erase something, the limits described under backups apply: we remove it from the platform’s active storage, and any backup copy goes when that backup is deleted.
Complaints
If you believe we have mishandled your personal information, tell us first at [email protected]. We will acknowledge your complaint within 5 business days and aim to give you a full response within 30 days. If you are not satisfied with our response, you can escalate the matter to the Office of the Australian Information Commissioner at oaic.gov.au.
Updates
We update this notice as the service evolves, by publishing a new text with a new “Effective from” date; that date at the top is the date the text applies from and says which text applies. Monitor this page for the latest text.
— Get Frank Pty Ltd