Cérge Pty Ltd: Privacy Policy

1. Introduction

This Privacy Policy covers Cérge Pty Ltd ACN 635 871 975 ("we," "us," "our," and "Cérge") and explains how we collect, use, disclose, and otherwise handle your Personal Information. This policy applies to all users of the Cérge platform and associated mobile application (the "App"), including Members, Carers, and venue administrators.

Cérge is committed to complying with applicable privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We recognise the importance of your privacy and your right to control your Personal Information.

Cérge has developed this platform to improve accessibility and inclusion for people with disabilities. We understand the sensitive nature of accessibility-related information and are committed to handling it with appropriate care and respect.

2. Anonymity and Pseudonymity

Wherever it is lawful and practicable, Cérge offers you the opportunity of not identifying yourself or using a pseudonym when interacting with our services. However, due to the nature of our accessibility services, complete anonymity may not always be possible while maintaining full functionality of the platform. For more information on using our services anonymously, please contact us at info@cerge.app.

3. Types of Personal Information We Collect

3.1 Basic Personal Information

The types of Personal Information Cérge may collect depends on the purposes for which it is collected but may include:

• Your name, email address, profile image, and contact details

• Demographic information such as age and gender

• Shopping preferences and food and beverage preferences

• Information about your accessibility needs and requirements

• Account authentication information

3.2 Sensitive Information

If necessary to provide specific services to you, we may collect sensitive information about you, including:

• Health information related to disability or accessibility requirements

• Specific accommodation needs for venues or events

We will only collect sensitive information from you if:

• You agree to provide it to us

• You authorize us to obtain it from a third party

• The collection is required or authorised by law

• The collection is otherwise permitted under Australian law

3.3 Technical Information

We may also collect:

• Device information (device type, operating system, browser type)

• IP address and network information

• Location data (when using the App with location services enabled)

• App usage data and analytics

4. How We Collect Your Personal Information

We collect personal information in the following ways:

• When you register for an account on our platform

• When you fill in and return to us a signed client form

• When you submit personal information through our software (such as when you send us a message or fill out a form)

• When you use our App with location services enabled

• In person, for example, when you engage with our employees, agents, or customer service representatives

• In the course of providing services to you

5. Why We Collect, Use, Hold and Disclose Your Personal Information

5.1 Primary Purposes

Cérge collects, holds, uses, and discloses personal information for several primary purposes, including:

• To provide the accessibility services you have requested

• To facilitate communication between users and venues regarding accessibility needs

• To process payments for premium services (if applicable)

• To improve our platform, products, and services

• To analyse usage patterns and enhance user experience

• To comply with legal obligations

5.2 Secondary Purposes

We may also use your information for related secondary purposes such as:

• To notify you about updates or changes to our services

• To provide support and respond to your inquiries

• To personalize your experience on our platform

• Statistical analysis and research to improve accessibility services

5.3 Direct Marketing

Cérge may use your personal information, such as your email address, to send you newsletters and updates about our services. Our approach to direct marketing communications includes:

• We will only send marketing communications where you would reasonably expect to receive them

• Each communication will include a simple opt-out mechanism (such as an unsubscribe link)

• You can opt out of receiving direct marketing at any time

• We will honour your opt-out request promptly

• We will not share your contact information with third parties for their direct marketing purposes

If you do not wish to receive direct marketing communications from us, you can opt out at any time by:

• Clicking the 'unsubscribe' link in any marketing email we send

• Updating your communication preferences in your account settings

• Contacting our Privacy Officer at info@cerge.app

5.4 AI-Powered Services

Cérge provides AI-powered accessibility guidance through our Cérge Wayfinder service. When you interact with Cérge Wayfinder:

• Your conversation data is processed by our AI technology partner, Chatbase, located in the United States

• This conversation data is separate from any personal profile information you may have provided in the Cérge Companion App

• We use these AI services solely to provide you with accurate, personalised accessibility information about venues

• Conversations with the AI may be retained to improve the quality and accuracy of responses

• The AI system is trained exclusively on publicly available accessibility information that has been collected through Cérge's assessment processes

6. Disclosure of Your Personal Information

6.1 Sharing with Venues and Service Providers

• User-Controlled Sharing:

  When you choose to share your accessibility profile with a venue through our platform, that venue will receive the information you've specified.

• Service Providers:

  We may disclose your Personal Information to our service providers who assist in operating our platform, such as:

• Cloud hosting providers

• Payment processors

• Analytics providers

• Customer support tools

• AI technology partners (see Section 6.3)

6.2 Legal Requirements

We may disclose your Personal Information if required to do so by law or if we believe that such action is necessary to:

• Comply with a legal obligation

• Protect and defend our rights or property

• Prevent or investigate possible wrongdoing

• Protect the personal safety of users or the public

6.3 AI Services and Technology Partners

When you use our Cérge Wayfinder service:

• Your conversation data is processed by Chatbase, our AI technology partner based in the United States

• Chatbase processes this data in accordance with their privacy policy (available at https://www.chatbase.co/legal/privacy)

• Chatbase employs robust security measures, including:

• Encryption of data in transit (TLS 1.2) and at rest (AES-256)

• Role-based access controls

• Secure cloud infrastructure on AWS

• Compliance with GDPR and SOC 2 standards

• Chatbase does not use your data to train their AI models

• Standard conversation data is retained for 90 days from your last interaction

• A subset of conversations used for service improvement may be retained in anonymised form for up to 12 months

• You may request deletion of your conversation history at any time by contacting our Privacy Officer

7. Data Quality and Security

7.1 Data Quality

Cérge will take reasonable steps to ensure that the Personal Information we collect, use, or disclose is accurate, complete, and up-to-date.

7.2 Data Security

We implement appropriate technical and organisational measures to protect the Personal Information we hold from misuse, interference, loss, unauthorised access, modification, or disclosure, including:

• Encrypting data in transit and at rest

• Implementing secure password policies and access controls

• Regular security assessments and updates

• Staff training on privacy and data protection

• Secure development practices

7.3 Data Retention and Destruction

We will retain your Personal Information for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law:

• Account information: Retained while your account is active and for a period of up to 24 months after account closure

• Transaction records: Retained for 7 years as required by tax regulations

• AI conversation data: Retained for 90 days from last interaction, with anonymized data for service improvement retained up to 12 months

• User accessibility preferences: Retained until you update them or close your account

8. Access, Correction, and Deletion of Your Personal Information

8.1 Accessing Your Information

You have the right to access the Personal Information we hold about you. You can access most of your information directly through your account settings in the App.

For information not accessible through the App, you may request access by contacting our Privacy Officer at info@cerge.app. We will respond to your request within a reasonable timeframe (typically within 30 days).

8.2 Correcting Your Information

You can update most of your Personal Information directly through the App. If you believe any information we hold about you is inaccurate, out-of-date, incomplete, irrelevant, or misleading, you can request that we correct it by:

• Updating your profile in the App

• Contacting our Privacy Officer at info@cerge.app

8.3 Deleting Your Information

You may request deletion of your Personal Information by:

• Deleting your account through the App settings

• Contacting our Privacy Officer at info@cerge.app

9. Transborder Data Flows

9.1 Overseas Recipients

Cérge discloses certain data to overseas recipients for processing and service delivery:

• AI Conversation Data:

  When you interact with Cérge Wayfinder, your conversation data is processed in the United States by our AI technology partner, Chatbase.

• No Other International Transfers:

  Beyond the AI conversation data processed by Chatbase, Cérge does not transfer personal information to any other countries or international recipients.

9.2 Publicly Available Training Data

It's important to note that all data used to train the Cérge Wayfinder AI is publicly available information that has been collected through Cérge's venue assessment processes and subsequently published online. This information is already accessible across international boundaries.

9.3 Safeguards for International Transfers

Before transferring your Personal Information to an overseas recipient, Cérge takes steps reasonable in the circumstances to ensure that the overseas recipient:

• Is subject to privacy laws offering similar protections to Australian laws

• Is contractually obligated to handle your information in accordance with this Privacy Policy and applicable laws

• Has adequate data protection measures in place

10. Notifiable Data Breaches

In the event of any loss, or unauthorised access or disclosure of your Personal Information that is likely to result in serious harm to you, Cérge will:

• Investigate the incident promptly

• Notify affected individuals and the Office of the Australian Information Commissioner (OAIC) within 72 hours of becoming aware of the breach

• Take all reasonable steps to contain the breach and minimise potential harm

• Provide recommendations on steps you can take to protect yourself