Privacy Policy

Perfomir ("Perfomir", "we", "us" or "our") respects your privacy and is committed to protecting personal information in a transparent, secure and lawful way.

This Privacy Policy explains how we collect, hold, use, disclose and otherwise process personal information when you:

• visit our website;
• create an account or interact with our services;
• use our platforms and related intelligence tools;
• contact us, request a demo, subscribe, or engage with us for sales, support or partnership purposes; or
• otherwise interact with Perfomir online or offline.

This policy is designed for businesses serving users in multiple jurisdictions. It is intended to support compliance with applicable privacy and data protection laws, including the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, and, where applicable, laws such as the EU GDPR, UK GDPR, and other local privacy laws that may apply to our activities.

Trading name: Perfomir

ABN: 66574494701

Email: contact@perfomir.com.au

Website: https://perfomir.com.au/

If you have questions about this Privacy Policy or our handling of personal information, please contact us using the details above.

This Privacy Policy applies to personal information we handle as a business, including in connection with our website, marketing, customer relationships, account administration, platform operations, billing, analytics, support, and security.

In some cases, we act as a controller of personal information (for example, when we manage user accounts, billing, website analytics, marketing preferences and support requests). In other cases, we may act as a processor or service provider on behalf of a customer (for example, where a customer uploads documents to our platform that may contain personal or legal information).

Where we act only on behalf of a customer, that customer may have separate obligations under applicable law to provide notices, obtain permissions, and ensure an appropriate legal basis for sharing the relevant information with us.

The types of personal information we collect depend on how you interact with us and may include:

4.1 Information you provide directly

• contact details such as your name, email address, phone number and business address;
• account credentials and authentication details;
• payment and billing details;
• enquiry, support and correspondence records;
• demo requests, feedback, survey responses and preferences; and
• any other information you choose to provide to us.

4.2 Information collected through use of our services

• account and profile information;
• subscription and transaction records;
• usage data, log data, device information, browser type, IP address and approximate location data;
• platform activity, configuration data, troubleshooting data and diagnostic information;
• files, documents, attachments, text inputs, prompts, outputs, notes and related metadata submitted to the platform ("Customer Content"); and
• records relating to service performance, security and fraud prevention.

4.3 Information from third parties

We may receive personal information from:

• customers or authorised users within an organisation;
• payment providers;
• identity, security and fraud-prevention providers;
• analytics, hosting and cloud service providers;
• marketing, advertising or CRM providers;
• public sources such as company websites, professional networks or registers; and
• integration partners, advisors, resellers or referral sources.

We do not intentionally seek to collect sensitive information unless it is reasonably necessary for a lawful business purpose and we are permitted to do so under applicable law.

Because our platform may process documents uploaded by users, some Customer Content may incidentally contain sensitive information or other regulated data. Customers must avoid uploading unnecessary sensitive information and must ensure they have the right to share any information submitted through the platform.

If we become aware that sensitive information has been provided where it is not necessary for our purposes, we may delete or de-identify that information where reasonably practicable.

We may use personal information to:

• provide, operate, maintain and improve our website, platform and services;
• create and administer accounts;
• process payments, subscriptions and renewals;
• deliver contract analysis, reporting, workflow, document and AI-assisted features;
• provide customer support, onboarding and training;
• communicate with you about your account, service updates, security alerts and administrative matters;
• send product news, thought leadership, updates, event invitations or promotional communications where permitted by law;
• personalise content and improve user experience;
• monitor usage, conduct analytics, troubleshoot issues and improve performance;
• protect our systems, detect abuse, prevent fraud and enforce our terms;
• comply with legal, regulatory, insurance, audit and compliance obligations; and
• establish, exercise or defend legal claims.

Our services may use automated systems, including AI-assisted tools, to analyse documents, structured data and related inputs submitted by authorised users.

Those tools may help generate summaries, classifications, flags, recommendations, analytics, dashboards or other outputs. These outputs are designed to support human decision-making and workflow efficiency. They are not a substitute for legal advice, and users remain responsible for reviewing outputs and exercising independent judgment.

We do not intentionally use Customer Content to market to your counterparties or unrelated third parties. We also do not sell Customer Content.

Where third-party infrastructure or model providers are used to help deliver our services, we require them to act under contractual confidentiality and data protection obligations appropriate to the services they provide.

Where required by applicable law, we rely on one or more lawful bases to process personal information, including:

• performance of a contract or taking steps at your request before entering into a contract;
• compliance with legal obligations;
• our legitimate interests, such as operating and securing our business, improving our services, preventing misuse, and managing customer relationships, provided those interests are not overridden by applicable rights and interests; and
• consent, where we specifically ask for it.

Where consent is required, you may withdraw it at any time, but this will not affect processing already carried out lawfully before withdrawal.

We may use cookies, pixels, tags, SDKs and similar technologies to:

• remember preferences and settings;
• keep users signed in;
• understand website and platform usage;
• measure campaign effectiveness;
• improve performance, reliability and security; and
• support analytics and product improvement.

You can control cookies through your browser settings and, where applicable, through our consent tools. Blocking some cookies may affect site functionality.

We may disclose personal information to:

• our related entities and corporate advisors;
• cloud hosting, infrastructure, storage, analytics and security providers;
• payment processors and billing providers;
• customer relationship management, communications and support providers;
• AI, software, document processing and workflow service providers used to operate our platform;
• professional advisers including lawyers, accountants, auditors and insurers;
• regulators, law enforcement bodies, courts, government agencies or dispute bodies where required or permitted by law; and
• actual or prospective purchasers, investors, financiers or transaction counterparties in connection with a merger, acquisition, financing, restructure or sale of assets.

We may also disclose personal information where you ask us to do so, where it is reasonably necessary to provide a service you requested, or where disclosure is otherwise permitted or required by law.

We do not sell personal information in the ordinary sense of exchanging it for money.

Because we use service providers and technical infrastructure that may be located in Australia and other countries, personal information may be stored, processed or accessed outside your jurisdiction, including in countries that may not have the same privacy laws as your home country.

Where Australian privacy law applies, we take reasonable steps to ensure overseas recipients handle personal information in a manner consistent with applicable privacy obligations.

Where the GDPR, UK GDPR or similar laws apply, we use appropriate safeguards for restricted transfers where required, such as contractual protections, transfer mechanisms, or other legally recognised measures.

By using our services or providing information to us, you acknowledge that cross-border handling may occur as described in this policy, subject to applicable legal requirements.

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to:

• provide the services;
• maintain business and financial records;
• comply with legal, tax, accounting and regulatory requirements;
• resolve disputes; and
• enforce agreements and protect our legitimate interests.

Retention periods may vary depending on the type of information, the sensitivity of the information, the purpose for which it is used, and any applicable legal requirements.

When personal information is no longer required, we will take reasonable steps to delete, destroy, anonymise or de-identify it, unless we are required or permitted by law to retain it.

We take reasonable technical, organisational and administrative measures to protect personal information against misuse, interference, loss, and unauthorised access, modification or disclosure.

These measures may include access controls, encryption in transit where appropriate, secure hosting practices, credential protections, audit logging, vendor controls, staff access limitation, and security monitoring.

No system is completely secure, and we cannot guarantee absolute security. You are also responsible for maintaining the confidentiality of your passwords and account credentials and for using our services securely.

We may send you marketing communications about our products, services, events and updates where permitted by law.

You can opt out of marketing emails at any time by using the unsubscribe link in the message or by contacting us. We may still send you non-promotional service or administrative communications where necessary.

Depending on your location and the applicable law, you may have rights to:

• request access to personal information we hold about you;
• request correction of inaccurate, incomplete or outdated personal information;
• request deletion of certain personal information;
• request restriction of processing in some circumstances;
• object to certain processing in some circumstances;
• request portability of certain personal information where technically feasible and legally required;
• withdraw consent where processing is based on consent; and
• complain to a regulator or supervisory authority.

We may need to verify your identity before responding to a request. In some cases, the law allows us to refuse or limit a request, and if so, we will explain the basis for that decision where required.

If we handle personal information solely on behalf of a customer, we may direct your request to that customer or ask you to contact them directly.

If the Australian Privacy Act 1988 (Cth) applies to our handling of your personal information, you may request access to and correction of your personal information by contacting us using the details in this policy.

If you believe we have interfered with your privacy, you may make a complaint to us. We will review your complaint and aim to respond within a reasonable period.

If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner (OAIC).

If the GDPR or UK GDPR applies to our processing of your personal information, the following also applies:

• you may have the rights described in section 15, subject to applicable limitations;
• where required, you may lodge a complaint with your local supervisory authority; and
• we will rely on a lawful basis for processing as described in section 8.

If you would like more information about a specific transfer mechanism, legal basis, or processing activity, please contact us.

Our services are designed for business and professional use and are not directed to children.

We do not knowingly collect personal information from children in circumstances where parental consent would be required by law. If you believe a child has provided us with personal information unlawfully, please contact us so we can investigate and take appropriate steps.

Our website or platform may contain links to third-party websites, services, plug-ins or integrations. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy notices.

We maintain incident response processes designed to identify, assess, contain and respond to suspected data incidents.

Where required by applicable law, we will notify affected individuals, regulators or other parties in relation to eligible or notifiable data breaches.

We may update this Privacy Policy from time to time to reflect changes in law, technology, our services, or our business practices.

When we make material changes, we will take reasonable steps to notify users appropriately, such as by updating the date at the top of this policy, posting a notice on our website, or providing an in-product or email notice where appropriate.

For privacy questions, requests, complaints or concerns, please contact us via our Contact Us page.