Privacy Policy

This Privacy Policy explains how VeroPath Pty Ltd ACN 699 357 778 (VeroPath, we, us or our) handles personal information when you visit our website, use the VeroPath platform or otherwise interact with us.

VeroPath provides a business-to-business sustainability and ESG software platform to organisations internationally. Where applicable privacy law gives you additional or stronger rights, that law prevails.

1. Information we collect

Depending on how you interact with VeroPath, we may collect:

·   business contact details such as your name, employer, role, email address and telephone number;

·   account information, user permissions and authentication records;

·   information your organisation provides through the Platform, including sustainability, ESG, emissions, supply-chain and supporting business information;

·   technical and usage information such as IP address, device, browser, login, activity, audit and diagnostic logs;

·   communications, support requests, feedback and training records; and

·   billing, subscription and transaction information.

The Platform may contain personal information uploaded by customers about their personnel, contractors, suppliers or other individuals. Customers are responsible for ensuring that information is lawfully collected and provided to VeroPath.

2. How we use information

We use personal information to:

·   provide, administer, secure and support the Platform;

·   create and manage accounts and subscriptions;

·   process Customer Data and generate requested reports and outputs;

·   improve functionality, performance, security and user experience;

·   respond to enquiries and provide service communications;

·   conduct appropriate business-to-business marketing, subject to applicable law and opt-out rights;

·   prevent fraud, misuse and security incidents; and

·   comply with legal obligations and protect legal rights.

Where required by law, we rely on an appropriate legal basis such as performance of a contract, legitimate interests, consent, compliance with law or another recognised lawful basis.

3. Our role and Customer Data

For information relating to our own website, accounts, business contacts, support and operations, VeroPath generally acts as the controller or responsible organisation.

Where VeroPath processes personal information contained in Customer Data solely on behalf of a customer, VeroPath generally acts as that customer's processor, service provider or equivalent. In that case, the customer determines the purposes of processing and VeroPath processes the information on documented instructions and under the applicable customer agreement or Data Processing Addendum.

As between VeroPath and the customer, Customer Data remains the customer's data. VeroPath does not acquire ownership of Customer Data merely because it is uploaded to the Platform.

4. Sharing and service providers

We may share personal information with service providers and contractors that help us operate the Platform, including providers of hosting, infrastructure, security, authentication, analytics, communications, support, software development, payment processing and professional services.

We may also disclose information where required by law, to protect rights or security, or in connection with a genuine corporate transaction such as an investment, merger, acquisition or sale, subject to appropriate safeguards.

VeroPath does not use Customer Data for third-party behavioural advertising and does not intend to sell personal information for monetary consideration.

5. International processing

VeroPath operates internationally and may process personal information in countries other than the country in which it was collected. Where applicable law restricts international transfers, VeroPath will use a lawful transfer mechanism or other recognised safeguard, which may include adequacy arrangements, approved contractual clauses or equivalent legal mechanisms.

6. Security and retention

VeroPath uses reasonable and appropriate technical and organisational safeguards designed to protect personal information against unauthorised access, disclosure, alteration, loss, misuse and destruction. No online service can guarantee absolute security.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to provide the Services, maintain security and audit records, meet legal or contractual obligations, resolve disputes and enforce agreements. Customer Data is handled after termination in accordance with the applicable customer agreement, legal obligations and ordinary backup processes.

7. Cookies and analytics

VeroPath may use cookies, local storage and similar technologies for authentication, security, session management, preferences, performance and analytics. Where applicable law requires consent for non-essential cookies or similar technologies, we will request that consent through the website or Platform before using them.

8. Automated functionality

The Platform may use automated functions to perform calculations, classify information, identify incomplete data, generate sustainability metrics and prepare reports or dashboards. Unless expressly identified otherwise, VeroPath does not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

9. Your privacy rights

Depending on where you are located and the law that applies, you may have rights to access, correct, delete, restrict or object to certain processing of your personal information, withdraw consent, obtain eligible data in portable form, opt out of marketing, or make a complaint to a privacy regulator. Some jurisdictions also provide rights concerning targeted advertising, sale or sharing of personal information, profiling or qualifying automated decisions.

To exercise a privacy right or make a privacy complaint, contact VeroPath through the contact form or contact details published on the VeroPath website, or write to: Privacy Lead, VeroPath Pty Ltd, Suite 3, 108 Southbank Boulevard, Southbank, Victoria 3006, Australia. We may need to verify your identity before acting on a request.

Where the information is held by VeroPath only on behalf of a customer, we may refer your request to that customer or assist the customer in responding.

10. Marketing, children and third parties

You may unsubscribe from marketing emails at any time using the unsubscribe link provided. We may still send necessary service, account, security or legal communications.

The Platform is designed for organisations and professional users and is not directed to children. Customers that upload information relating to minors are responsible for ensuring that the processing is lawful and appropriate.

Our website or Platform may link to independent third-party services. Their privacy practices are governed by their own policies.

11. Changes and contact

We may update this Privacy Policy to reflect changes to the Platform, our practices or applicable law. The latest version posted on the VeroPath website will show its effective date. Where required by law, we will provide additional notice of material changes.

Questions or complaints may be sent through the contact details published on the VeroPath website or by post to VeroPath Pty Ltd at the address above.