Version v2.0 · 27 July 2026
Privacy Policy
The short version. We collect the minimum we need to quote, build and support your project. We do not sell personal information and we never have. We use a small number of well-known platforms to run the business, and some of them store data overseas, which we list below. We keep information only as long as we need it or the law requires, then we delete it. You can ask us what we hold, ask us to correct it, or ask us to delete it, and we will respond within 30 days.
1. Who we are, and where we stand legally
1.1 This policy is published by Emerald Websites (Jesse Thomson), ABN 68 410 407 820, of Emerald, QLD.
1.2 We want to be straight with you about this. Under the Privacy Act 1988, most businesses with an annual turnover of $3 million or less are not bound by the Australian Privacy Principles. We are one of them, so we are not legally an "APP entity".
1.3 We have chosen to apply the same standards anyway, because the people we build for include community clubs, disability service providers, health-adjacent organisations and councils, and because it is the right way to run the business. This policy describes what we actually do, not what we would like you to think we do.
1.4 Some work removes the exemption. If we are engaged as a contracted service provider under a Commonwealth contract, or we handle health information, the Privacy Act applies to that work in full. Queensland Government work is separately subject to the Queensland Privacy Principles. Where that happens we agree a written Client Data Handling Schedule with the client, and it overrides this policy for that engagement.
2. Two different kinds of information, kept separate
2.1 Information we collect as a business. Details about you if you enquire, quote with us, or become a client. We decide what happens to it, and this policy governs it.
2.2 Information we handle for a client. When we build or manage a website, app or CRM, that system holds our client's customers' information. That belongs to our client. They decide what is collected and why, we only handle it to provide the service, and their privacy policy governs it, not ours. If you are a customer of one of our clients, contact them first. We will always help them respond.
3. What we collect as a business
- Your name, business name, email, phone and postal locality
- Your ABN and billing details
- What you tell us about your project, including content, images and brand assets you send us
- Logins and access you give us so we can do the work, held in an encrypted password manager
- Our correspondence with you, including emails, messages, call notes and support requests
- Basic analytics about how this website is used, described in clause 8
3.1 We collect this directly from you in nearly every case: through the enquiry form, by email, on the phone or in a meeting. We do not buy contact lists and we do not scrape them.
3.2 We do not collect sensitive information (such as health, racial, religious or biometric information) about you as a client, and we ask you not to send it to us. If a project requires handling sensitive information, that is dealt with in a written schedule.
4. Why we use it
- To answer your enquiry and prepare a quote
- To design, build, deploy and support what you engaged us for
- To host, secure, back up and maintain your site or system under a plan
- To invoice you and keep the accounting records the law requires
- To contact you about your project, or about something affecting your site such as an outage or a security issue
- To meet our legal obligations
4.1 We do not sell personal information, and we do not disclose it for another organisation's marketing.
4.2 We only send marketing to people who have asked for it or who are existing clients, and every message has an unsubscribe link that works.
5. The platforms we use, and which ones store data overseas
5.1 We keep our stack deliberately small. Each of these providers may store or process information as part of running our business.
| Platform | What it handles | Where data may be stored |
|---|---|---|
| Cloudflare | Website hosting and security | Global network, including Australia and the United States |
| GoHighLevel (LeadConnector) | Enquiries, CRM records, email and SMS | United States |
| Google (Analytics, Search Console, Workspace) | Website analytics and email | United States and other countries where Google operates |
| Firebase and Google Cloud | App sign-in, databases and files, where a project uses them | Australia where we can region-pin it, otherwise the United States |
| Stripe | Payment processing, where a project uses it | United States and Australia |
| Microsoft 365 | Email and documents | Australia and other countries where Microsoft operates |
5.2 Overseas disclosure. As the table shows, some of these providers store information outside Australia, mainly in the United States. By using our services or contacting us, you acknowledge that information may be handled overseas, and that overseas providers are subject to the laws of their own country rather than Australian privacy law. We choose established providers with published security and privacy commitments, but we cannot control their internal practices.
5.3 We do not pay for card details to pass through our systems. Card payments go directly to the payment processor and we never see or store full card numbers.
5.4 We may also disclose information where the law requires it, or to our accountant or a professional adviser under a duty of confidence.
6. How long we keep it
6.1 We do not keep things forever. When information is no longer needed and we are not required to keep it, we delete it or de-identify it.
| What | How long |
|---|---|
| Enquiries that do not become a project | Up to 2 years, then deleted |
| Client records and correspondence | 7 years after the engagement ends |
| Invoices and accounting records | 7 years, as tax law requires |
| Project files and code | 7 years after the engagement ends, so we can support or defend the work |
| Site backups | On a rolling cycle, typically 30 days |
| Logins and access credentials | Removed when the engagement or plan ends |
6.2 The 7 year periods exist for a reason: tax records must be kept, and professional claims can be made years after a project finishes. We would rather be able to show what we actually did.
6.3 Backups and archives are deleted on their normal cycle rather than immediately, so a deletion request may take a little longer to flow through everywhere. We will tell you when it is complete.
7. Security
7.1 We take reasonable steps to protect information: encrypted connections, a password manager with multi-factor authentication, access limited to what a job needs, credentials never stored in plain text or in code, and platforms kept up to date.
7.2 No system is completely secure and we will not pretend otherwise. If something goes wrong we will tell you.
8. This website, cookies and analytics
8.1 This website uses Google Analytics to understand how many people visit and which pages they read. It sets cookies and collects your IP address, browser, device type and the pages you view.
8.2 We do not run advertising or retargeting pixels on this website, and we do not build advertising profiles from your visit.
8.3 You can block cookies in your browser settings, or install the Google Analytics opt-out add-on. The website works normally either way.
9. If something goes wrong
9.1 If we become aware of unauthorised access to, or loss of, personal information, we will assess it promptly, contain it, and tell anyone at serious risk of harm, along with what happened and what to do about it.
9.2 Where the Notifiable Data Breaches scheme applies to the information affected, we will notify the Office of the Australian Information Commissioner as that scheme requires.
9.3 Where the breach affects information we hold for a client, we will tell that client promptly so they can meet their own obligations.
10. Your rights, and how to use them
10.1 You may ask us to tell you what personal information we hold about you, correct anything that is wrong, delete what we no longer need to keep, or give you a copy in a portable format.
10.2 Email info@emeraldwebsites.com.au. We will confirm we received it within 5 business days and respond within 30 days. There is no charge. We may need to verify who you are first.
10.3 If we cannot do what you asked, we will tell you why in writing.
11. Complaints
11.1 If you think we have mishandled your personal information, please tell us first: email info@emeraldwebsites.com.au with "Privacy complaint" in the subject line. We will acknowledge it within 5 business days and give you a written response within 30 days.
11.2 If you are not satisfied with our response, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. For a Queensland Government project, you can also contact the Office of the Information Commissioner Queensland.
11.3 You do not have to come to us first. You can go straight to a regulator at any time.
12. Showing our work
12.1 We only publish a client project in our portfolio or a case study if that client has opted in.
12.2 Screenshots of any system that holds personal information use dummy or de-identified data. We do not publish real customer records, real contact details or real CRM entries, ever.
12.3 A client can ask us to take their project down at any time.
13. Changes to this policy
13.1 We may update this policy. The version number and date at the top tell you which one you are reading, and we keep superseded versions on file.
13.2 If we change something that materially affects how we handle your information, we will tell affected clients directly rather than relying on you noticing.
14. Contact us
Emerald Websites (Jesse Thomson), ABN 68 410 407 820, Emerald QLD.
Email info@emeraldwebsites.com.au or call 0408 799 373.
Version v2.0, effective 27 July 2026.