Privacy Policy
WattleKin (we, us) makes Wattlekin, software for NDIS providers. We respect privacy and handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains what we collect, why, and the choices you have.
1. Two kinds of information
Information about our customers. This is information about the organisations that use Wattlekin and the people who sign up or contact us, such as names, work email addresses and billing details. We are responsible for this information.
Information providers put into Wattlekin. NDIS providers use Wattlekin to manage their staff and the participants they support. That information belongs to the provider, and the provider decides what goes in and who can see it. We store and process it on the provider's behalf and only to run Wattlekin for them. If you are a participant, family member or support worker, the provider you deal with is your first contact for questions about your information, and their own privacy policy applies. We will help them respond.
2. What we collect
- Account details: name, work email, organisation name, role and sign-in details (passwords are stored only in a protected, scrambled form).
- Billing details: plan, invoices and payment status. Card payments are handled by Stripe. We do not see or store full card numbers.
- Information providers enter: details of staff (such as contact details, availability, qualifications, checks and pay details) and of participants (such as contact details, NDIS details, plans, support needs and notes). Some of this can be health or disability information, which is sensitive information under privacy law.
- Shift information: rosters, timesheets and, when a support worker clocks in or out, the phone's location at that moment if the worker allows it.
- Messages to us: what you send through our contact form or by email.
- Technical information: IP address, browser and device type, and activity logs we need to keep Wattlekin secure and working.
3. Why we use it
- to provide Wattlekin, including sign-in, rosters, timesheets, pay and notifications;
- to set up and manage plans and payments;
- to answer questions and provide support;
- to keep Wattlekin secure, prevent misuse and fix problems;
- to send service emails, such as confirming an email address, sign-in details and billing notices;
- to meet our legal obligations.
We do not sell personal information, and we do not use the information providers enter into Wattlekin for advertising or marketing.
4. Who we share it with
We share information only with trusted service providers that help us run Wattlekin, such as for secure hosting, sending emails and taking payments, and only as much as they need to do that work. They must protect it and may not use it for anything else. Card payments are handled by Stripe.
If a provider chooses to connect another service to Wattlekin, such as Xero for payroll, we share the information needed for that connection.
Wattlekin's information is stored in Australia. Some of our service providers may handle limited information outside Australia, mainly in the United States. We take reasonable steps to make sure they protect it in line with Australian privacy law.
We may also share information when the law requires it, or to protect someone's safety.
5. Where it is stored and how we protect it
Wattlekin's database is hosted in Sydney, Australia. We protect information with encryption in transit, access controls, separate data for each organisation, and permissions that limit what each person can see. Support workers only see what they need for their own shifts, and only super admins can see plan and billing details.
6. How long we keep it
We keep information while an organisation uses Wattlekin. After a plan ends, we keep the organisation's data for at least 90 days so it can renew without losing anything. After that, we may delete it. A provider can ask us to delete its data sooner. We keep billing records for as long as tax law requires.
7. Data breaches
If a data breach is likely to cause serious harm, we will act quickly to contain it, tell the affected provider without undue delay, and make any notifications the law requires.
8. Cookies and browser storage
Wattlekin uses your browser's storage only for things it needs to work, such as keeping you signed in. We do not use advertising or tracking cookies.
9. Access, correction and choices
You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing us. If the information was entered by an NDIS provider, we will usually refer you to them, as they control it, and help them respond. We will reply within 30 days.
10. Questions and complaints
If you have a question or a complaint about privacy, please email hello@wattlekin.com.au. We will look into it and reply within 30 days.
11. Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If we make a significant change, we will let our customers know by email or in Wattlekin.
12. Contact
WattleKin, Sydney, New South Wales, Australia
hello@wattlekin.com.au