Privacy Policy

ABN 36 651 581 396 | ACN 651 581 396
contact@rightomation.com.au
rightomation.com.au
Effective date: 3 August 2026
Last reviewed: 3 August 2026

Introduction and Who We Are

Rightomation Pty Ltd (ABN 36 651 581 396) (Rightomation, we, us, or our) is committed to protecting the privacy of individuals whose personal information we collect, hold, use, and disclose in connection with our business activities.

This Privacy Policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) contained in Schedule 1 of the Privacy Act.

This Privacy Policy applies to personal information collected through:

• our public website at rightomation.com.au and associated subdomains (Website);
• our software platforms and products, including FormSight, PrimalAudit, TruckSight, and related workflow automation tools (collectively, the Platform); and
• email, telephone, and other business interactions with Rightomation.
• This Privacy Policy should be read together with our:
• Cookie Policy (available at https://rightomation.com.au/cookie-policy.html);
• Website Terms of Use (available at https://rightomation.com.au/terms-of-use.html); and

Customer Terms and Conditions (available at https://rightomation.com.au/customer-terms.html).

By using the Website or Platform, or by providing your personal information to us, you consent to the collection, use, and disclosure of your personal information in accordance with this Privacy Policy.

What Is Personal Information

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether it is recorded in a material form or not. Examples include names, email addresses, IP addresses, and account credentials.

Sensitive information is a subset of personal information that includes information about a person's health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and certain other categories. Rightomation does not intentionally collect sensitive information about individuals. If sensitive information is inadvertently included in Customer-supplied data, it is handled in accordance with the additional requirements that apply to sensitive information under the APPs, and is not used for any purpose beyond delivering the Services.

What Personal Information We Collect

Account and contact information. When you register for an account, contact us, or engage with our Services, we may collect:

• your name and the name of your organisation;
• your email address, telephone number, and business contact details;
• your account credentials (username and password); and
• billing and payment information (processed by our payment processor; we do not store full card numbers).

Customer-entered operational data. When you or your Authorised Users use the Platform, you may enter operational data that includes personal information about third parties (such as your employees or contractors). Depending on the product used, this may include:

• employee or contractor identifiers, names, and contact details entered by you for the purpose of generating payslips, invoices, ABA payment files, or other administrative documents from Customer-supplied figures;
• financial figures and payment data entered by you for the purpose of generating structured output files;
• shift, scheduling, and administrative records entered by you for workflow management purposes; and
• compliance evidence metadata and operational records entered by you in connection with PrimalAudit or TruckSight.

This data is entered and controlled by you as the Customer. Rightomation processes it solely to deliver the Services you have requested.

Technical and log data. When you access the Website or Platform, our servers automatically collect certain technical information, including:

• your IP address;
• browser type and version (user-agent string);
• session timestamps and access logs;
• pages visited and features accessed;
• HTTP request data (URL, method, response code, referrer); and
• error and exception logs.

This data is collected for security, diagnostic, and operational purposes.

Communications. If you contact us by email, through a contact form, or by telephone, we collect the content of your communication and any personal information you provide in the course of that communication.

How We Collect Personal Information

We collect personal information:

• directly from you when you register for an account, complete a form, contact us, or use the Platform;
• automatically through technical logging when you access the Website or Platform (see clause 3.3);
• from your Authorised Users when they access the Platform on your behalf; and
• from third parties where you have authorised them to share your information with us, or where we are permitted by law to collect it from a third party.

Where it is reasonably practicable to do so, we collect personal information directly from the individual to whom it relates.

Purposes of Collection, Use, and Disclosure

We collect, hold, use, and disclose personal information for the following purposes:

• to provide, operate, and improve the Platform and Services;
• to create and manage your account and verify your identity;
• to process payments and manage billing;
• to communicate with you about your account, the Services, and any enquiries you make;
• to send you service-related notices, updates, and security alerts;
• to detect, investigate, and prevent security incidents, fraud, and unauthorised access;
• to comply with our legal obligations, including under the Privacy Act 1988 (Cth), the Corporations Act 2001 (Cth), and applicable tax laws;
• to enforce our Customer Terms and Conditions and other agreements; and
• to improve the Website and Platform through aggregated, de-identified analytics.

We will not use or disclose your personal information for a purpose other than those listed in clause 5.1 without your consent, unless we are required or permitted to do so by law.

No advertising use. We do not use personal information for targeted advertising, behavioural profiling, or to build advertising audiences. We do not sell, rent, or trade personal information to advertisers, data brokers, or marketing platforms.

Disclosure of Personal Information

We may disclose personal information to the following categories of recipients:

• Sub-processors and service providers: third-party providers engaged to assist us in delivering the Services, including cloud hosting and infrastructure providers, managed database and data platform providers, transactional email providers, and payment processors. These providers are engaged under contractual obligations consistent with our privacy obligations and are only permitted to use personal information to provide services to us;
• Professional advisers: lawyers, accountants, auditors, and insurers engaged by Rightomation in the ordinary course of business, under confidentiality obligations;
• Regulatory and law enforcement authorities: where required by applicable law, a court order, or a lawful request from a regulatory authority;
• Business transfers: in connection with a merger, acquisition, restructure, or sale of all or substantially all of Rightomation's assets, where personal information may be transferred to the acquiring entity subject to equivalent privacy protections; and

With your consent: to any other recipient where you have given your prior written consent.

We do not sell, rent, or disclose personal information to third-party advertisers, data brokers, or marketing platforms.

Sub-processor list. We maintain a current list of our key sub-processors. You may request a copy of this list by contacting our Privacy Officer at contact@rightomation.com.au. We will notify you of material changes to our sub-processors in accordance with our Customer Terms and Conditions.

Overseas Disclosure

Some of the sub-processors we engage to deliver the Services operate infrastructure or process data in locations outside Australia, including in the Asia-Pacific region (for example, Singapore). As a result, personal information we hold may be stored or processed overseas.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the APPs in relation to that information, including by entering into contractual arrangements that impose APP-equivalent privacy obligations on the recipient, consistent with our obligations under APP 8 of the Privacy Act.

You acknowledge that, by consenting to the disclosure of your personal information to overseas recipients under clause 7.2, the protections in APP 8.1 may not apply to the extent that we have taken the reasonable steps described in clause 7.2 and the overseas recipient handles the information in a manner inconsistent with the APPs. In that case, we remain accountable under section 16C of the Privacy Act for the overseas recipient's acts or practices that would breach the APPs.

We do not disclose personal information to overseas recipients for advertising, profiling, or any purpose beyond delivering the Services.

Security

We implement and maintain reasonable technical and organisational security measures to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure, consistent with our obligations under APP 11 of the Privacy Act.

Our security measures are informed by recognised industry frameworks, including controls commonly associated with SOC 2 and ISO 27001. At a high level, these measures include:

• encryption of personal information in transit and at rest;
• access controls and role-based permissions limiting staff access to personal information;
• monitoring and logging of access to systems holding personal information;
• incident response procedures for detecting and responding to security events; and
• regular review of security practices as the Platform evolves.

We do not warrant that our security measures are equivalent to or certified under any particular standard unless a current certification is separately confirmed in writing.

Notifiable Data Breaches. We comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. If we have reasonable grounds to believe that an eligible data breach has occurred (being unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm to one or more individuals), we will:

• assess the breach as soon as practicable and in any event within 30 days of becoming aware of the suspected breach;
• notify affected individuals and the Office of the Australian Information Commissioner (OAIC) where required; and
• take reasonable steps to contain the breach and prevent further harm.

If you become aware of or suspect a security incident involving your personal information held by Rightomation, please contact us promptly at contact@rightomation.com.au.

Retention

We retain personal information only for as long as is necessary for the purposes for which it was collected, or as required by applicable law.

As a general guide:

• account and contact information is retained for the duration of your account and for a reasonable period after account closure to comply with legal obligations and resolve disputes;
• Customer-entered operational data is retained for the duration of the Subscription Period and for a reasonable period thereafter, after which it is deleted or anonymised, subject to any legal obligation to retain records; and
• technical log data is retained for up to 12 months for security and diagnostic purposes, after which it is deleted or anonymised, unless retention is required in connection with a security incident or legal proceedings.

When personal information is no longer required, we take reasonable steps to destroy or de-identify it in accordance with APP 11.

Access to Your Personal Information

Under APP 12 of the Privacy Act, you have the right to request access to the personal information we hold about you.

To make an access request, please contact our Privacy Officer at contact@rightomation.com.au with sufficient detail to identify the information you are seeking.

We will respond to your access request within 30 days of receipt. If we are unable to provide access within that period, we will notify you of the reason for the delay and the expected timeframe for a response.

We will provide access to personal information free of charge in most cases. Where a request is complex or requires significant resources, we may charge a reasonable fee, of which we will notify you in advance.

We may decline to provide access in circumstances permitted by the Privacy Act, including where providing access would be unlawful, would unreasonably impact the privacy of another individual, or where the information relates to existing or anticipated legal proceedings. If we decline access, we will provide written reasons.

Correction of Your Personal Information

Under APP 13 of the Privacy Act, you have the right to request correction of personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant, or misleading.

To make a correction request, please contact our Privacy Officer at contact@rightomation.com.au.

We will respond to your correction request within 30 days of receipt. If we correct the information, we will notify any third parties to whom we have disclosed the information where it is reasonably practicable and appropriate to do so.

If we decline to correct the information, we will provide written reasons and information about how you may make a complaint.

Complaints and OAIC

If you have a complaint about how we have handled your personal information, please contact our Privacy Officer in the first instance:

• Privacy Officer
• Rightomation Pty Ltd
• Email: contact@rightomation.com.au
• Website: rightomation.com.au

Please provide sufficient detail about your complaint so that we can investigate and respond appropriately. We will acknowledge receipt of your complaint within 5 business days and aim to resolve it within 30 days. If we require additional time, we will notify you.

If you are not satisfied with our response, or if we fail to respond within a reasonable time, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Office of the Australian Information Commissioner
• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

The OAIC has the power to investigate complaints about alleged breaches of the Privacy Act and the APPs.

Privacy Officer Contact

Our Privacy Officer is responsible for overseeing compliance with this Privacy Policy and the Privacy Act. You may contact the Privacy Officer for any privacy-related enquiry, access or correction request, or complaint:

• Privacy Officer
• Rightomation Pty Ltd
• ABN 36 651 581 396
• Email: contact@rightomation.com.au
• Website: rightomation.com.au

If a postal address is required for formal correspondence, please contact us by email in the first instance and we will provide appropriate postal details.

Cookies and Similar Technologies

We use cookies and similar technologies on the Website and Platform. Our use of these technologies is described in detail in our Cookie Policy, available at https://rightomation.com.au/cookie-policy.html.

As a summary:

• the public Website (rightomation.com.au and associated marketing pages) is largely static. We use minimal or no cookies on the public Website. Where cookies are used, they are first-party only and limited to basic site function, security, or limited first-party analytics if and when enabled;
• on the authenticated Platform (FormSight, PrimalAudit, TruckSight, and related products), we use first-party cookies for session management and security. Sub-processors engaged to deliver the Services (such as payment processors and infrastructure providers) may set or access cookies or similar identifiers as necessary to provide those services;
• we do not use third-party advertising networks, behavioural advertising tools, social media tracking pixels, or remarketing tags on the Website or Platform; and
• we do not use third-party analytics platforms such as Google Analytics, Mixpanel, or Segment.

For full details of the cookies we use, their purposes, and how to control them, please refer to our Cookie Policy at https://rightomation.com.au/cookie-policy.html.

Third-Party Links

The Website and Platform may contain links to third-party websites or services that are not operated by Rightomation. We are not responsible for the privacy practices of those third parties.

We encourage you to review the privacy policies of any third-party websites you visit. This Privacy Policy applies only to personal information collected by Rightomation.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. When we make material changes, we will:

• post the updated Privacy Policy on the Website at https://rightomation.com.au/privacy-policy.html;
• update the "Last reviewed" date at the top of this document; and
• where practicable, notify you by email or by an in-product notice.

Your continued use of the Website or Platform after the effective date of any update constitutes your acceptance of the updated Privacy Policy.

Governing Law

This Privacy Policy is governed by the laws of Victoria, Australia, and the Privacy Act 1988 (Cth).

Any dispute arising out of or in connection with this Privacy Policy is subject to the dispute resolution process set out in our Customer Terms and Conditions (for customers) or, for other individuals, to the jurisdiction of the courts of Victoria, Australia.

This Privacy Policy was prepared in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For privacy enquiries, contact contact@rightomation.com.au.