Privacy policy
Melius is operated by [entity: to be confirmed] (ABN [abn: to be confirmed]). This policy explains how we collect, use, hold and disclose personal information. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, where it applies, the EU and UK General Data Protection Regulation (GDPR). Effective [effectiveDate: to be confirmed].
What we collect
We only collect information we need to provide our services:
- Contact and business details you give us: your name, role, company name, email address, phone number, company size, approximate monthly spend and where your goods are used.
- Account details: your sign-in email and a record of when you sign in.
- Invoices and purchasing documents you upload, and the results we produce from them. These contain commercial information (suppliers, products, prices and quantities) and may contain personal information about other people, such as a supplier's contact name.
- Technical information needed to run the service securely: for example your IP address, browser type and essential cookies that keep you signed in or connect an upload to your session. We don't use advertising or tracking cookies.
We collect information directly from you. If you upload documents that include other people's personal information, please make sure you're allowed to share it with us for this purpose.
How we use it
- To read your invoices and give you procurement assessments and results.
- To create and run your account, and to let you see your stored invoices and results.
- To contact you about your assessment, including emailing you a copy of your results.
- To keep the service secure, prevent misuse and fix problems.
- To meet our legal obligations, such as record-keeping.
We'll only send you marketing if you've agreed to it, and every marketing message lets you opt out. We don't sell personal information.
We don't currently use artificial intelligence services to process your invoices. If we start to, we'll update this policy and ask for your consent before any of your documents are sent to such a service.
Using a pseudonym
You can browse our website without telling us who you are. To receive an assessment or open an account we need to know who you are and how to contact you, so dealing with us anonymously isn't practicable for those services.
Who we share it with
We share personal information only with service providers who help us run the service, and only as needed for that purpose:
- Hosting and application services: [hosting: to be confirmed].
- Database and file storage: Supabase, with data stored in Sydney, Australia.
- Email delivery, once we start sending results by email.
- Professional advisers, and government or law enforcement bodies where the law requires or allows it.
We don't share your invoices with suppliers or anyone else without your written approval.
Overseas disclosure
Your account data and documents are stored in Australia. Some of our service providers may process information outside Australia, including in [hosting: to be confirmed]. Where that happens we take reasonable steps, including contractual commitments, to make sure the information is handled in line with the Australian Privacy Principles.
How we protect it
We protect personal information with access controls, encryption in transit and at rest, and by limiting access to the people who need it. No system is perfectly secure; if a data breach is likely to cause serious harm, we'll notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
How long we keep it
We keep your account details, invoices and results for 7 years after your last activity, so you can return to them and so we can meet record-keeping obligations. After that we delete or de-identify them. You can ask us to delete your account and documents sooner (see "Your rights"); we may need to keep some records where the law requires it.
Your rights
You can ask to access the personal information we hold about you, or to correct it. You can also ask us to delete your account and documents. We'll respond within 30 days and won't charge you for making a request. If we refuse, we'll tell you why and how to complain.
Contact our privacy officer at [privacyEmail: to be confirmed] or write to [address: to be confirmed].
Complaints
If you have a concern about how we've handled your personal information, contact us first at [privacyEmail: to be confirmed] and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
If you're in the EU or UK
Where the GDPR applies, [entity: to be confirmed] is the controller of your personal data. We rely on these lawful bases:
- Performing our contract with you, to provide assessments and your account.
- Our legitimate interests in running, securing and improving the service, balanced against your rights.
- Your consent, for marketing and for any optional processing we ask about. You can withdraw consent at any time.
- Legal obligations, such as record-keeping.
You have the right to access, rectify or erase your data, restrict or object to processing, receive your data in a portable format, and withdraw consent. You can also complain to your local supervisory authority (in the UK, the Information Commissioner's Office).
Your data is stored in Australia. Transfers out of the EU or UK rely on safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. EU/UK representative: [euRepresentative: to be confirmed].
Children
Our services are for businesses and aren't directed at people under 18.
Changes to this policy
We'll post any changes on this page with a new effective date, and tell account holders about significant changes by email.
Contact us
[entity: to be confirmed] · ABN [abn: to be confirmed] · [address: to be confirmed] · [privacyEmail: to be confirmed]