Privacy policy

Scope

What this policy covers

This policy describes the personal information Woosh Cloud Australia Pty Ltd (“Woosh”) collects when you use My Website and the products and services reached through it, and how we handle it.

It applies to the information we collect through our websites, our applications and the merchant portal, and in email, SMS and other electronic communications sent through or in connection with them (together, the Services).

It does not apply to information you give to a third party we introduce you to or integrate with — a payment provider, a delivery platform, an accounting package. Those organisations have their own policies, and we encourage you to read them.

By using the Services or registering an account you agree to this policy. If you do not provide the information we ask for, we may not be able to provide all of the Services to you.

Who holds your data

The data controller

Woosh Cloud Australia Pty Ltd is the controller of personal data provided to, collected by or for, or processed in connection with the Services. We are registered in New South Wales, Australia.

We may process and store personal information on our own servers or on the servers of service providers we have contracts with, which may be inside or outside Australia. Where information leaves Australia we take reasonable steps to ensure it is handled consistently with this policy and Australian privacy law.

Your customers' data

When we process data on your behalf

Added for review. Where you use Woosh to collect information about your own customers — for example a phone number captured at the terminal for a loyalty program — you are the controller of that information and Woosh is your processor. We handle it on your instructions, to provide the Services to you, and we do not sell it, mine it for our own marketing, or use it to contact your customers on our own behalf.

You remain responsible for having a lawful basis to collect it, and for telling your customers what you do with it.

What we collect

The information we collect, and how

Information you give us

Account and business details — your name, work email, phone number, role, and the trading and legal details of the business you represent, including its ABN and addresses.
Venue and configuration data — the products, prices, staff records, floor plans and settings you enter to run the Services.
Billing details — the card used for subscription payments, and the bank account nominated for settlement. Card numbers are handled by PCI-compliant payment providers; we store a token, never the card number.
Communications — what you tell us in support requests, enquiries and surveys.

Information we collect automatically

Usage — which features you use, when, and for how long; searches you run; errors you hit.
Device and connection — IP address, browser and operating system, device type, and network information.
Cookies and similar technologies — see below.

Information from others — payment providers, credit and identity verification services used at onboarding, and partners who refer you to us.

Why we hold it

How we use the information

To provide, operate and support the Services, and to set up your venues, terminals and users.
To bill you, take payment, and recover unpaid amounts.
To respond to your enquiries and provide support.
To detect, investigate and prevent fraud, abuse and security incidents.
To meet our legal, tax and regulatory obligations, including those of payment providers and financial regulators.
To understand how the Services are used so we can improve them.
To tell you about changes to the Services, and about products and features that are relevant to your business. You can opt out of the marketing messages at any time; you cannot opt out of service and billing notices while you hold an account.

We do not sell your personal information, and we do not disclose it to advertising networks.

Who else sees it

How we share information

Payment providers — to process card payments, settle funds to you and meet their regulatory obligations.
Service providers — hosting, communications, analytics and support tools, bound by contract to keep it confidential and use it only to provide their service to us.
Professional advisers — lawyers, auditors and accountants, where they need it to advise us.
A buyer or successor — if the business is merged, restructured or sold, information held about users may be among the assets transferred.
Law enforcement and regulators — where we believe in good faith that it is reasonably necessary to comply with the law, respond to a subpoena or court order, or to protect the rights, property or safety of any person.
Anyone else you consent to.

Cookies

Cookies and similar technologies

A cookie is a small text file this site stores on your device so it can recognise you on the next page or the next visit. Similar technologies — local storage, pixels, tags — do much the same job.

What follows is our full cookie policy, shown here so you do not have to go looking for it. It is the same text you will find at /cookie-policy.

What we set

The cookies this site uses

Every cookie in the table is strictly necessary: the site cannot sign you in, keep you signed in, or remember your basic choices without them. They are set by us, not by a third party.

Cookie	What it does	Type	Life
`session_id`	Keeps you signed in and holds your session. Without it you cannot log in or stay logged in.	Essential	Session
`frontend_lang`	Remembers the language you are reading the site in.	Essential	Up to 1 year
`cids`	Remembers which company you are working in, where your login has access to more than one.	Essential	Up to 1 year
`website_cookies_bar`	Remembers that you have answered the cookie banner, so it stops asking.	Essential	Up to 1 year

Because these are strictly necessary, they are set whether or not you accept optional cookies. Blocking them in your browser will stop parts of the site working.

What we do not set

No advertising, no tracking across sites

We do not use advertising cookies. We do not sell your browsing data, we do not run retargeting, and we do not embed ad networks or social tracking pixels. Nothing on this site follows you to another one.

We currently run no analytics cookies either. If that changes, this page changes with it — it is generated from the site’s own settings rather than written by hand.

Your choices

Controlling cookies

We do not show a cookie banner, because the only cookies we set are the ones the site cannot work without. If we ever add optional cookies, a banner will appear and you will be asked first.

Every major browser lets you see the cookies a site has set, delete them, and block new ones. Look under Privacy or Site settings. You will need to do it on each browser and each device you use, and blocking the strictly necessary cookies above will break sign-in.

Elsewhere

Third parties and embedded content

Pages that embed something from another service — a video, a map, a payment form — let that service set its own cookies. We do not control those, and their own policies govern them.

When you pay through a Woosh product, the payment provider handles the card details and may set cookies for fraud prevention. That is part of how card payments are kept safe, and it happens on their systems, not ours.

Security

How we protect it

We use physical, electronic and procedural safeguards appropriate to the sensitivity of the information we hold, and we follow generally accepted industry standards to protect personal information in transit and at rest. Card data is handled by providers validated as PCI DSS compliant.

No system is impenetrable, and we cannot guarantee the security of information transmitted to us. You play a part too: do not share your password or API keys, and tell us immediately if you believe an account has been compromised. Instructions received with your credentials will be treated as yours.

Your rights

Accessing, correcting and deleting

You can ask us for a copy of the personal information we hold about you, ask us to correct it if it is wrong, and ask us to delete it. Write to privacy@wooshcloud.com.au and we will respond within a reasonable time.

Those rights have limits: we may keep information where we are required to by law — tax and financial records in particular — where it relates to an actual or anticipated legal proceeding, or where a request is unreasonable or would affect another person's privacy. If we refuse, we will tell you why.

Added for review. If you are unhappy with how we have handled your information or a request, you can complain to us first, and then to the Office of the Australian Information Commissioner at oaic.gov.au.

Retention

How long we keep it

We keep personal information for as long as your account is open, and afterwards for as long as we need it for the purposes described here or to meet a legal obligation. When we no longer need it we delete it or de-identify it so it can no longer be linked to you.

Other

Age, third-party links and changes

Age. The Services are intended for people aged 18 and over acting for a business. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

Third-party links. The Services link to sites and tools we do not control. This policy does not cover them, and we are not responsible for their content or their privacy practices.

Changes. We may update this policy to reflect changes in the law, our practices or the Services. Material changes will be posted here. Continuing to use the Services after a change means you accept it, so it is worth checking this page from time to time.

Contact

Talk to us about your information

Privacy questions, access and correction requests, and complaints go to our privacy contact at privacy@wooshcloud.com.au.

Postal: Woosh Cloud Australia Pty Ltd, 43 George Street, Parramatta New South Wales 2150.