1. Who this policy covers
Tomedia Pty Ltd (Tomedia, we, us or our) is responsible for personal information it collects for account administration, sales, billing, service operation, security, support and its own communications. When a customer uses Site Builder, forms, Blog Manager, Commerce or other tools to collect information from visitors to the customer's website, the customer decides why that information is collected and how it is used. Tomedia provides the technology and handles that information on the customer's instructions, except where we must use it for security, billing, legal compliance or another purpose described in this policy. The customer's own privacy notice may also apply.
2. Information we collect
Depending on the services used, we may collect: - account and identity details, including name, business name, role, email, telephone number and login or verification information; - business, domain registrant and eligibility details, including legal entity, address, ABN or other identifiers and authorised contacts; - orders, subscriptions, invoices, payment status and limited payment references supplied by our payment provider (we do not intend to store complete card numbers); - websites, domains, DNS settings, content, media, product information, blog posts, form submissions and support communications that a customer supplies or manages; - technical and usage details, including IP address, device and browser information, timestamps, logs, security events, referral and campaign parameters and interactions with our services; and - information received from customers, authorised team members, registrars, hosting and infrastructure providers, payment providers, public registers and integration providers. Please do not submit sensitive information unless it is necessary for an agreed service and you are authorised to provide it.
3. Why we use information
We use personal information to provide and administer accounts and services; verify authority and domain eligibility; register, renew, transfer and manage domains; publish and operate websites; process orders and billing; route website enquiries to the relevant customer; provide support; communicate service, renewal, security and outage information; detect misuse, fraud and security incidents; maintain records and backups; improve reliability and accessibility; and comply with legal obligations or lawful requests. We may send marketing only where permitted. Marketing choices are separate from essential account, billing, renewal, security and service communications. A person can opt out of marketing using the unsubscribe facility or by contacting us.
4. When information is disclosed
We may disclose personal information as reasonably necessary to: - the customer, account owner and authorised team members responsible for the relevant website, account or enquiry; - domain registries, registrars, registry data services and dispute bodies where required to register or manage a domain; - providers supporting hosting, website delivery, security, DNS, certificates, email, storage, support, analytics, payments and other requested integrations; - professional advisers, insurers, auditors, courts, regulators, law enforcement or government bodies where required or permitted by law; and - a successor or relevant party in a proposed or completed restructure, financing, acquisition or transfer, subject to appropriate confidentiality controls. We do not sell personal information. Domain registration information may be collected, used and disclosed by the relevant registry and registrar under their rules, including through registry data or WHOIS services.
5. Overseas handling and service providers
Information may be stored or processed in Australia and in other countries where our contracted providers or their subprocessors operate, which may include the United States and other service locations. The countries involved depend on the services and integrations a customer enables. We take reasonable steps to select reputable providers, limit access, use contractual and technical safeguards and keep effective control where practicable. Customers can contact us for current information about material service locations relevant to their service before supplying information that has special handling requirements.
6. Cookies, analytics and website forms
Our services may use essential cookies or similar storage for authentication, security, preferences, load balancing and service operation. Optional analytics, advertising or embedded services may use additional technologies where enabled and must be described in the applicable cookie or collection notice. Site owners are responsible for providing an appropriate collection notice on their forms and for configuring consent where their chosen analytics, marketing or embedded services require it. A form submission may include the information entered, landing and referral URLs, campaign parameters, IP address and technical data used for routing, attribution and abuse prevention.
7. Security, retention and data incidents
We use reasonable administrative, technical and organisational safeguards designed to protect information from misuse, interference, loss and unauthorised access, modification or disclosure. No online service can guarantee absolute security. We keep information only as long as reasonably required for the service, legal and tax records, security, backups, dispute resolution and enforcement. We then take reasonable steps to delete or de-identify it. Backup copies may remain until the relevant backup cycle expires. If a data breach is likely to cause serious harm and notification is required, we will assess and notify affected people and the relevant regulator as required by law. Where we process information for a customer, we will also support the customer's reasonable incident obligations.
8. Access, correction, complaints and contact
You may ask to access or correct personal information we hold about you or raise a privacy concern by emailing [email protected]. We may need to verify your identity and authority. If the information is controlled by one of our customers, we may refer the request to that customer or assist them to respond. We aim to respond within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au. Privacy Officer: Tomedia Pty Ltd, Gold Coast, Queensland, Australia; [email protected].
9. Changes to this policy
We may update this policy when our services, providers or legal obligations change. We will publish the updated version and effective date. If a change materially affects an active service or how we use personal information, we will provide additional notice where reasonably required.