Legal
Contents
This policy is written in plain English. It explains how OchreOnline Pty Ltd handles personal information in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
OchreOnline Pty Ltd (ABN 66 783 251 59) ("we", "us", "our") operates OchreKiosk, a cloud-based visitor management system for Australian buildings. Our registered contact address is in the Northern Territory, Australia.
We are an APP entity under the Privacy Act 1988 (Cth) and we are committed to handling personal information responsibly and transparently.
We collect different types of personal information depending on the context.
We only collect personal information that is reasonably necessary for the purposes described in this policy (APP 3). We do not collect sensitive information (such as health information, racial or ethnic origin, or government identifiers) unless required by a specific service arrangement and with explicit consent.
We collect personal information in the following ways:
We will always collect personal information by lawful and fair means, and we will not collect personal information in an unreasonably intrusive way (APP 3.5).
We collect personal information for the following primary purposes:
Where we use personal information for a secondary purpose, we will only do so where that use is related to the primary purpose and you would reasonably expect it, or where you have consented (APP 6).
We share personal information with the following third-party service providers as necessary to deliver OchreKiosk:
We do not sell, rent, or trade personal information to any third party for marketing or commercial purposes.
We may disclose personal information where required to do so by law, court order, or in response to a lawful request by a government authority.
Visitor and customer data is stored in Cloudflare's Australian edge network and does not leave Australia.
Some of our service providers (Stripe, Resend) operate infrastructure internationally. To the extent personal information is processed by these providers, it may transit servers outside Australia. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles the information in a manner consistent with the APPs (APP 8).
By using OchreKiosk, you acknowledge that some processing may occur via overseas-headquartered service providers, while your primary data remains stored in Australia.
We take reasonable steps to protect personal information from misuse, interference, loss, and from unauthorised access, modification, or disclosure (APP 11). Our security measures include:
In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988. We will also report eligible incidents to the Australian Signals Directorate (ASD) via the ReportCyber portal.
We retain visitor records for as long as required by the building manager's subscription and any applicable legal obligations. Building managers can export and delete visitor records from the admin panel at any time.
When a customer subscription is cancelled, we retain data for a period of up to 12 months to allow for dispute resolution and compliance obligations, after which it is deleted.
We destroy or de-identify personal information when it is no longer required for any purpose, in accordance with APP 11.2.
Under APP 12 and APP 13, individuals have the right to:
To make an access or correction request, contact us at privacy@ochrekiosk.com.au. We will respond within 30 days.
Note: visitor records are held by building managers (our customers) on their behalf. For access requests relating to visitor sign-in data, we may need to direct you to the relevant building management organisation.
We will not charge a fee for access requests, but may charge a reasonable fee for the costs of providing access if the request is complex.
We may use customer contact information to send service-related communications such as subscription confirmations, renewal reminders, and product updates. These are not marketing communications and are necessary for the operation of your subscription.
We do not use personal information for unsolicited direct marketing without consent. If we send any optional marketing communications, we will provide a clear opt-out mechanism in each message.
Visitor information collected via the kiosk is not used for any marketing purpose by OchreOnline.
Our marketing website uses cookies for the following purposes:
We do not use third-party advertising cookies or tracking pixels. We do not share browsing data with advertisers.
The kiosk application does not use cookies. It communicates directly with our API endpoints.
If you believe we have mishandled your personal information, please contact us first at privacy@ochrekiosk.com.au. We take all privacy complaints seriously and will respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The effective date at the top of this page will be updated accordingly.
We encourage customers and visitors to review this policy periodically. For material changes, we will notify active customers by email.
For privacy-related enquiries, access requests, or complaints: