Australian Privacy Principles
The thirteen principles in Schedule 1 of the Privacy Act 1988 (Cth) are what the Act actually requires of PezPC. Here is where we stand on every one, rather than a summary of the comfortable ones.
Nine are met outright and two do not apply to how we operate. The remaining two are met with a practical limit rather than a shortfall: APP 2, because full anonymity stops being workable once a payment is involved, and APP 11, where the controls are in place and scheduled expiry of older records is still to come.
This expands one row of the standards table in the main privacy policy. The standard itself is published by its own authority: OAIC quick reference.
9 in place 2 partial 2 not applicable
Consideration of personal information privacy
| APP 1 | Open and transparent management of personal information | In place | This page and the policy it hangs off are what APP 1 requires. They cost nothing to read, need no account, and are written to be understood rather than to be defensible. The policy is revised whenever what we collect or how we handle it changes, and the parts describing how the deployment is configured are generated from the running configuration, so they cannot quietly drift. How to complain, and where to escalate, is in the policy under Your rights. |
| APP 2 | Anonymity and pseudonymity | Partial | A portal account does not need your real name. The display name is free text and a pseudonym is perfectly acceptable; any email address works, including a role address or an alias, and we never check that it belongs to a named individual. There is no field for a legal name anywhere in registration. The partial mark is honest rather than reluctant: dealing with us entirely anonymously stops being practicable once money moves, because a licence has to bind to an account to be validated and renewed, and a payment needs a payment identity. When a licence is purchased, Stripe collects and holds the payment details and lodges with us the limited transaction information we must keep for tax. Billing and payments · How long we keep things |
Collection of personal information
| APP 3 | Collection of solicited personal information | In place | Registration collects an email address, a display name and a password, because those are the only things needed to run an account. There is no field for a legal name, ABN, postal address or phone number. What a licensed install sends is listed field by field in the policy and carries nothing from your database. All of it comes directly from you or from software you control, by ordinary lawful means. We do not buy, rent, scrape or otherwise acquire personal information from anyone else, and we collect no sensitive information within the meaning of the Act. |
| APP 4 | Dealing with unsolicited personal information | In place | We try not to receive information we did not ask for. The one route by which it realistically arrives is a feedback report, because the description and any attachment are free-form: a reporter can include a screenshot or a paragraph containing personal information about themselves or a third party that we never requested. Where we become aware of unsolicited personal information that we could not have collected under APP 3, we destroy or de-identify it as soon as practicable, and we edit the tracked issue rather than leaving the content sitting in it. If you think a report contains something it should not, tell us and we will remove it. |
| APP 5 | Notification of the collection of personal information | In place | Registration is self-evident about what it takes: three fields, on the form in front of you. The in-app feedback dialog goes further and lists every field that will travel with the report, showing each real value, before the report can be sent. A licence check-in happens with no person present, so the policy is the notice for it, and the fields are enumerated rather than summarised. |
Dealing with personal information
| APP 6 | Use or disclosure of personal information | In place | We use what we hold for the purpose it was collected for: running your account, issuing and validating your licence, taking payment, sending the transactional messages that go with those, and supporting the software. We do not repurpose it, build profiles from it, or use it to train anything. Disclosure is limited to the processors named in the policy's third-party table, each of which does a job we could not do without, and to disclosures required or authorised by law. We do not sell or rent personal information. |
| APP 7 | Direct marketing | Not applicable | We do not do direct marketing at all today. There is no newsletter, no product-announcement list, no lead capture and no advertising anywhere. Every message we send is transactional: it exists because you hold an account or a licence. If we ever introduce marketing it will be opt-in only, meaning you will have to ask for it and silence will never be treated as consent, and every message will carry a working unsubscribe link. Notifications that are not required to run your account already carry one and we honour it. |
| APP 8 | Cross-border disclosure of personal information | In place | Three recipients are overseas, each named in the policy's third-party table with its role and what it receives: Stripe holds payment information in the United States and elsewhere, GitHub holds feedback issues in the United States, and Cloudflare operates DNS infrastructure globally. Our own servers and database are in Australia. APP 8.1 asks for reasonable steps to ensure an overseas recipient does not breach the APPs, and the OAIC's guidance is that this generally means an enforceable contractual arrangement. Each of these providers imposes one through its standard terms, which incorporate a data processing agreement binding it on purpose limitation, security, sub-processing and breach notification. We rely on those rather than on separately negotiated clauses, which is what the reasonable steps test contemplates for a business of this size. One caveat worth stating rather than burying: those agreements are drafted against the GDPR rather than the APPs, so they do not bind the recipient to the APPs by name, even though the substantive obligations are comparable. Under section 16C we remain accountable for what an overseas recipient does with information we disclose, and we are not relying on an APP 8.2 exception to avoid that. Third parties |
| APP 9 | Adoption, use or disclosure of government related identifiers | Not applicable | We do not collect, adopt, use or disclose any government related identifier. We hold no tax file number, Medicare number, driver's licence number, passport number or Centrelink reference, and there is no field in which to enter one. We do not even collect an ABN. Your account is identified by an internal number that means nothing outside our database. |
Integrity of personal information
| APP 10 | Quality of personal information | In place | What we hold about you is either something you typed and can change yourself, or a machine-generated fact about your install. We do not enrich it from outside sources, buy data about you, or infer attributes, so the usual causes of quality drift do not arise. Your email address and display name are editable from your profile. Billing records come from Stripe and reflect transactions that actually occurred. |
| APP 11 | Security of personal information | Partial | Passwords are stored only as salted hashes. Configuration secrets are encrypted at rest under keys held outside the database. Everything is served over TLS. Administrator access is limited to PezPC staff who need it, and the administration screens are enumerated in the policy so you can see exactly what that access reveals. The gap is the destruction limb: apart from account deletion, nothing expires automatically yet. How long we keep things |
Access to, and correction of, personal information
| APP 12 | Access to personal information | In place | Most of what we hold is already visible once you sign in: your profile, your licences, your registered installs and your invoices. For anything beyond that, ask and we will provide a copy in a machine-readable form. If we ever refuse a request in whole or in part, we will tell you why in writing and how to complain about that decision. |
| APP 13 | Correction of personal information | In place | Your email address and display name are editable from your profile and take effect immediately. For anything else, tell us what is wrong and we will correct it. Where we have already passed something to one of the processors named in the policy and the correction matters to them, we will pass that on too. If we decide not to make a correction you have asked for, we will tell you why, and you can ask us to attach a statement recording that you disagree. |