RHIXO

RHIXO Privacy Policy

Privacy terms for RHIXO websites, checkout, support and delivered services.

This document forms part of the RHIXO controlled legal framework and applies as described below. It operates together with the RHIXO Customer Agreement, RHIXO Product and Service Schedule, accepted order and other incorporated documents where relevant.

1. Scope and commitment

We manage personal information transparently and apply the Australian Privacy Principles where they apply to the relevant entity or activity. We may also be subject to other privacy laws depending on the customer, user and place of processing.

2. Information we may collect

• identity and contact details;
• account credentials and authentication information;
• organisation, employment, contractor or role information;
• billing, subscription and transaction records;
• support requests, correspondence, call/chat recordings where notified, and troubleshooting information;
• device, browser, IP address, logs, security and usage information;
• content and files submitted to a product, including images, documents, forms and operational records;
• location information where a product feature requires it and the user or organisation enables it;
• feedback, survey responses and preferences;
• information received from authorised integrations and service providers.

3. How we collect information

We collect information directly from users and customers, automatically through products and websites, from authorised administrators, from integrations the customer enables, and from service providers acting on our behalf. Where practicable, collection notices explain material context at the point information is collected.

4. Purposes of processing

• provide, secure, administer and support products and accounts;
• process orders, subscriptions, payments and entitlements;
• authenticate users and enforce permissions;
• deliver customer support and investigate incidents;
• operate analytics, reliability, fraud and abuse-prevention controls;
• improve products, workflows and user experience;
• communicate service, security, billing and product information;
• comply with legal, regulatory, tax, accounting and dispute-resolution obligations;
• protect the rights, safety, security and integrity of customers, users, InnovatechIQ and third parties.

5. Customer-controlled data

For hosted business products, the customer often determines what workforce, contractor, client, site, document or operational information is entered. The customer is responsible for its own lawful collection and instructions. We process that information to provide the Service and according to the applicable DPA and customer configuration.

6. Sensitive information

Sensitive information should only be submitted where the product is intended to process it, the customer has a lawful basis and appropriate controls are enabled. We may restrict categories of highly sensitive information where they are unnecessary for the Service or create disproportionate risk.

7. Use of AI and automation

Where AI or automated features are used, relevant input, context and output data may be processed to provide the feature, apply safety controls, troubleshoot and maintain the Service. Product-specific AI Terms describe additional safeguards and limitations. Customer Data will not be used to train a public foundation model unless the applicable terms clearly permit it and any required consent or authority has been obtained.

8. Disclosure and subprocessors

We may disclose information to infrastructure, hosting, identity, communications, payment, analytics, support, security and other service providers where reasonably necessary. We may also disclose information where directed by the customer, required by law, needed to protect legal rights or security, or as part of a corporate transaction subject to appropriate protections.

9. Overseas processing

Some service providers may process information outside Australia. Where applicable, we will take reasonable steps required by law in relation to overseas disclosure and will identify likely countries or regions where practicable through this Policy, a subprocessor list or product documentation.

10. Security

We use technical and organisational measures designed to protect information, including access controls, authentication, encryption in transit where appropriate, logging, backups, segregation and security monitoring according to the Service. No system can guarantee absolute security. Customers also have security responsibilities under the Customer Agreement.

11. Retention and deletion

We retain information for as long as reasonably necessary for the purpose collected, to provide the Service, maintain security and audit records, meet legal/accounting obligations, resolve disputes and enforce agreements. Retention periods vary by data type and Product Schedule. Data may be deleted or de-identified when no longer reasonably required, subject to backups and lawful retention.

12. Access, correction and privacy requests

Individuals may request access to or correction of personal information where applicable. We may need to verify identity and may refuse or limit a request where permitted by law, explaining the reason where required. For customer-controlled business data, we may direct the individual to the relevant customer organisation where appropriate.

13. Complaints

Privacy complaints should be lodged through the RHIXO at team@rhixo.com.au. We will record, investigate and respond within a reasonable period. This does not limit a person's right to contact an applicable regulator.

14. Cookies and similar technologies

Website and product cookies, local storage, pixels and similar technologies are described in the Cookie Policy and any point-of-collection notice.

15. Children

Our business products are not directed to children unless a specific Product Schedule expressly provides otherwise. Customers must not knowingly submit children's personal information unless the relevant Service is intended for that use and all required permissions and safeguards are in place.

16. Data breaches

We maintain incident-response procedures. Where a data breach triggers a legal notification obligation, we will take the steps required by applicable law and coordinate with affected customers where the breach involves customer-controlled data.

17. Changes

We may update this Policy when practices, technology or legal requirements change. The current effective date will be published. Material changes will be communicated where required or reasonably appropriate.

RHIXO-delivered customer-site analytics

RHIXO may install a RHIXO-controlled Google Analytics 4 measurement tag on websites it builds and hosts for customers for service-quality, usage and performance measurement. Where RHIXO determines the purposes and means of that measurement, RHIXO handles the resulting analytics information as a controller for that activity. Customers remain responsible for the privacy notices, cookie/consent controls and other obligations that apply to their own websites and visitors. Where consent is required before analytics operates, the customer must ensure an appropriate consent mechanism is enabled before public launch. RHIXO will not represent a customer site as cookieless where RHIXO-controlled analytics is installed.

Current material subprocessors

Material providers currently used in RHIXO delivery include Stripe (payments), Postmark (transactional email), Anthropic/Claude API (AI-assisted customer website copy where enabled), and GoDaddy/cPanel or successor authorised hosting providers. The RHIXO Subprocessor Register is the controlled current list.