Privacy Policy

1. Overview

Protecting your privacy and personal information is important to us.

This Privacy Policy explains how Quality Group Pty Ltd, Australian Company Number 694 377 681 (“Quality Group”, “we”, “us” and “our”) collects, uses, discloses, stores and protects your personal information, your rights in relation to that information, and how to make a complaint if you have any concerns.

The services provided by Quality Group (“Service”) are designed for use by organisations and professional users. We aim to minimise data collection and handle all information with a high degree of confidentiality.

Quality Group is an Australian company. We respect your privacy and are committed to complying with all applicable privacy laws, including the Privacy Act 1988 (Cth). We have also taken steps to ensure that, where our clients are located in the United Kingdom (UK) or the European Union (EU), they are afforded the protections available under the UK GDPR (as implemented by the Data Protection Act 2018) and the EU General Data Protection Regulation (EU GDPR), as applicable. If you are located in the UK or the EU, please refer to Schedule A, which contains additional information that supplements this Privacy Policy.

Where we have Clients located outside Australia, the UK and the EU, we will comply with applicable data protection and privacy laws in those jurisdictions to the extent they apply to our handling of personal information.

2. What is Personal Information

Personal information is any information that can be used to identify you, such as your name, gender, date of birth, address, telephone number or email address.

3. Anonymity and Pseudonymity

Where lawful and practicable, you may contact us anonymously or using a pseudonym, such as when making a general enquiry about our Service.

However, we may require you to identify yourself where it is necessary to provide the Service, verify your authority to act on behalf of an organisation, set up an account, respond to a privacy request, investigate suspected fraud or misuse, or where we are required by law to do so.

4. Personal Information We Collect

We collect only the information necessary to provide and operate the Service.

Account and business information

This may include:

• name
• work email address
• organisation details
• billing information (where applicable)

Usage information

We may collect limited operational data such as:

• login activity
• system interactions
• timestamps and technical logs

This information is used to operate, secure, and improve the Service.

Client materials

Clients may upload reports and supporting materials for analysis. These materials may contain personal or sensitive information.

We do not access or review such materials except as required to provide the Service.

We access and process client materials only to the extent necessary to provide the Service and in accordance with our Data Processing Agreement (“DPA”).

You must only submit personal information about another individual where you are authorised to do so and have provided any required notices and obtained any required consents.

5. Collection of Sensitive Information

We do not generally collect sensitive information directly from individuals. However, sensitive information may be included in client materials uploaded to the Service by our customers.

Sensitive information includes information about a person's health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, criminal record or sexual orientation.

Where sensitive information is included in materials provided to us, we will only process that information as necessary to provide the Service and in accordance with applicable privacy laws. We will only process sensitive information where we have your consent, our customer has obtained any required consent, or another lawful basis applies.

6. How we get your personal information and why we collect it

Most of the personal information we process is provided directly by you when you register for, access or use the Service. We may also collect personal information through digital technologies such as cookies, APIs, tags, pixels and similar technologies.

In some cases, we may collect personal information from third parties rather than directly from you. This may occur where personal information is included in materials uploaded by customers, provided through authorised integrations, obtained from publicly available sources, or generated or inferred through the operation of the Service.

We use information to:

• provide and operate the Service
• process and analyse submitted materials
• maintain system security and performance
• communicate with clients
• manage billing and accounts

We do not sell, trade, or use client data for advertising or marketing targeting.

7. Who may receive personal information?

We may disclose personal information to our employees, contractors and service providers (including cloud hosting, AI, analytics, payment processing and support providers), professional advisers, insurers, auditors, regulators, law enforcement agencies, and other parties where required by law or with your consent.

We take reasonable steps to ensure that any disclosure is limited to the information reasonably necessary for the relevant purpose.

8. Artificial Intelligence

Our Service uses artificial intelligence (AI) to process information provided by users and generate outputs, including recommendations and insights. We may use information processed through the Service to provide, maintain, secure and improve the Service, investigate errors and security issues, and deliver AI-powered functionality. We may engage trusted third-party providers, including cloud hosting and AI technology providers, to process information on our behalf.

We do not use client data, uploaded materials, prompts, responses or personal information submitted through the Service to train, retrain or improve our AI models or those of our third-party AI providers.

AI-generated outputs may contain inaccuracies and must be reviewed before being relied upon. Human review is required when using this Service.

9. Automated Decision-Making

We do not use the Service to make solely automated decisions that produce legal or similarly significant effects on individuals. If this changes, we will update this Privacy Policy and provide any notices required by applicable law.

10. Data Storage and International Transfers

We use trusted third-party infrastructure providers to host and process data.

Personal information may be disclosed to service providers located in the United Kingdom and Australia.

Data is currently stored and processed in the AWS London region (eu-west-2) within the United Kingdom. We may support additional regions in future to meet specific client requirements, subject to appropriate data transfer mechanisms.

We may transfer personal information to Australia. Where personal information is transferred outside the United Kingdom, we will implement appropriate safeguards, such as adequacy decisions, standard contractual clauses, binding corporate rules, or other approved transfer mechanisms, in accordance with applicable data protection laws.

11. Data Retention

We retain personal information and client materials while the Client account is active.

Upon account closure, personal information and client material will be deleted within 30 days, unless retention is required for legal or contractual reasons.

12. Security

We take reasonable technical and organisational measures to protect information, including:

• encryption in transit and at rest
• access controls and system safeguards

No system is completely secure, but we take appropriate steps to reduce risk.

13. Cookies and Analytics

We may use digital technologies such as cookies, APIs, tags, pixels and similar technologies to support the operation of the Service.

Some of these technologies may collect personal information. Where they do, we will handle that information in accordance with this Privacy Policy and applicable privacy laws.

You can manage your cookie preferences through your browser settings and, where available, our cookie settings tool. You can also opt out of Google Analytics using Google's opt-out tool.

Where analytics tools are used, they are applied in a limited manner to understand system performance and usage.

14. Children

The Service is not intended for anyone under the age of 18.

We do not knowingly collect personal data directly from children. However, we may process information relating to children where it is included in data provided by our customers.

If we become aware that we have collected personal information from a child without appropriate authority, we will take steps to delete it, subject to applicable law.

15. Access and Correction

You may request access to the personal information we hold about you and ask us to correct any information that is inaccurate, incomplete or out of date.

Requests can be made using the contact details below. We may need to verify your identity before responding.

We will respond to requests within the time required by applicable law. In some circumstances, we may be permitted or required to refuse a request. If this occurs, we will explain why, unless we are not permitted to do so.

Please let us know if any personal information we hold about you is inaccurate or out of date so that we can keep our records current.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be published on our website.

17. Contact

For questions or requests relating to this Privacy Policy, or to make a complaint, please contact:

Quality Group Pty Ltd
Email: chris.roberts@qualitygroup.ai

Please provide your name and contact details and sufficient information for us to understand and investigate the matter.

We will:

• acknowledge your complaint within a reasonable period;
• investigate it through an appropriate person;
• give you a reasonable opportunity to provide relevant information; and
• provide a written response within a reasonable period.

We will not charge you for making a privacy complaint.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).

OAIC website: www.oaic.gov.au

Schedule A – Residents of the UK and EU

This Schedule applies to individuals residing in the United Kingdom (UK) and the European Union (EU) and supplements the information provided in our Privacy Policy. It outlines additional rights available under the UK GDPR, the EU GDPR and applicable data protection laws.