Policies

• Customer data

  As between you and us, you own the records you and your members keep on the Service ("Customer Data"). You grant us a licence to host, process, copy and disclose Customer Data to our service providers as needed to provide, secure and support the Service and to meet our legal obligations, and for nothing else. We do not sell Customer Data, we do not show it to other customers, we do not use it to train models, and we use only a model provider whose terms do not allow it to train its own models on what we send.

  Each of us must comply with the Privacy Act 1988 (Cth) to the extent it applies to us. You are responsible for the personal information you collect and enter, including giving your clients and others the required notices and having a lawful basis to disclose it to us. The Service and its database are hosted in Sydney, Australia; the countries in which our model, payment and email providers process data are on the Subprocessors page, and you agree to that. You are responsible for telling your own clients, where the law requires, that their information may go overseas.

  We take reasonable steps to protect Customer Data from misuse, interference, loss and unauthorised access, as our Privacy Policy describes. If we become aware of an eligible data breach affecting Customer Data, we will tell you without undue delay and help you meet your own obligations; you are responsible for any notification the law requires of you. We may disclose Customer Data where the law requires it, and will tell you where we are permitted to. Section 10 explains how you export your data and what happens to it when you close.

  Read the full clause
• Subscriptions and billing

  • Plans and prices. Subscriptions are priced per organisation according to the plan you select, as set out on our pricing page or in your order form. Prices are in Australian dollars and exclude GST. Briesa is registered for GST, so GST at 10% is added to every charge; Stripe issues a tax invoice for every charge.
  • The trial. Your organisation's first subscription begins with a free trial of seven (7) days. You enter a card when you create the organisation, and nothing is charged during the trial. Unless you cancel before the trial ends, the first monthly fee is charged to that card on the eighth day and the subscription continues as a paid subscription. If you cancel during the trial, you are not charged.
  • Monthly, in advance. Fees are billed monthly in advance, by card through Stripe, our payment processor, and you authorise us to charge the card you have given. The subscription continues from month to month until cancelled.
  • Cancelling. You may cancel at any time from Settings › Billing. Cancellation takes effect at the end of the current billing period: you keep access until then, and we do not charge you again. Except where the Australian Consumer Law requires it, fees already paid are not refunded.
  • Failed payments. If a payment fails, Stripe retries it and tells you. If the subscription ends because it stays unpaid, the organisation is closed to its members until a card is entered under Settings › Billing, after which it opens again.
  • Changing plans. You may change plans at any time; changing plans may change what the organisation can do or hold.
  • Fee changes. We may change our fees by giving you at least thirty (30) days' notice. A change takes effect from a future billing period named in the notice; until then your existing fee applies. If you do not agree, you may cancel before the change takes effect without penalty. If you keep the subscription after it takes effect, you are billed at the new rate.
  • Disputed invoices. If you dispute an invoice, tell us within 30 days of the invoice date. You must still pay the amounts that are not in dispute.

  Read the full clause
• Term and termination

  These Terms start when you accept them and continue until ended under this section.

  • Closing your organisation. The organisation's owner may close it at any time from the platform. For 30 days after that, the owner can reopen it, and the owner and administrators can export its records; after those 30 days access ends. Cancel the subscription under section 9 as well, or ask us to, so that you are not charged for a period you do not use.
  • Your records after closing. The records a closed organisation kept are held, unchanged and inaccessible to everyone, for the period the law sets for them (seven years for trust, agreement, identity, register and similar compliance records; three years for photographs and other files), after which we delete or de-identify them. The agency may ask us in writing to delete them earlier, once it has exported them, and we do so where the law allows. Copies in backups are deleted when the backups expire on our provider's normal cycle. We may keep information we must keep by law.
  • The audit trail. Every change to your records is kept in an audit trail nobody can edit, so that what happened can be shown. It is held with the records, for the same period.
  • Our termination. We may end these Terms by giving you thirty (30) days' notice; if we do, we refund any fees you have paid for the period after they end. Either of us may end these Terms immediately by notice if the other commits a material breach and does not fix it within fourteen (14) days of being told, or becomes insolvent.
  • Suspension. We may suspend or restrict access immediately, and only as far as reasonably necessary, where your account may be compromised, there is a serious security risk, you use the Service unlawfully, you breach section 8, or a subscription has ended unpaid. We will tell you why and restore access as soon as the problem is resolved.
  • Afterwards. When these Terms end, your right to use the Service ends and any fees owing remain payable. Sections 4, 5, 7, 10, 11, 12, 13, 14, 15, 17, 18 and 19 continue to apply.

  Read the full clause
• Storage and security

  We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Today those steps are:

  • One organisation at a time. Every query the platform runs is scoped to your organisation, and the database enforces the same boundary a second time with row-level security, so one agency can never read another's records.
  • Named accounts and a second factor. Every person signs in with their own account. An authenticator app can be added to any account, an agency can require one of every member, and Briesa's own staff cannot open the staff console without one.
  • Sign-in protection. Passwords are held only as salted hashes by our sign-in provider. Five failed attempts in fifteen minutes lock sign-in for fifteen minutes. A session lasts at most twelve hours, is bound to the address that issued it, and ends everywhere when you sign out everywhere, change your password or close your account.
  • An audit trail nothing can edit. Every change to an organisation's records is written to an audit log that cannot be updated or deleted, and compliance records are closed rather than deleted. Staff who look at an agency's records in the console must give a reason, and the agency's owners and administrators can see that they did.
  • Encryption. Every connection uses TLS, and our providers encrypt the database, files and backups at rest.
  • Backups. Our database provider takes automated backups of the production database.
  • Written policies. We keep written policies for information security, access control, backup and recovery, data handling and retention, and data breach response, and review them at least every year.

  No system is completely secure. You can help by using a strong, unique password with an authenticator, keeping your devices up to date and telling us at once if you think your account has been misused.

  Read the full clause
• Accessing and correcting your information

  • Access. You can ask for the personal information we hold about you. We respond within 30 days. We may refuse in some cases, such as where giving access would affect another person's privacy, and we will tell you why in writing.
  • Correction. If information we hold about you is inaccurate, out of date, incomplete or misleading, you can ask us to correct it. We correct it or tell you why we have not.
  • Deletion and objection. You can ask us to delete your personal information, or to stop using it for marketing. We will do so unless we need to keep it for the reasons in section 12 or because the law requires it, and we will tell you if we cannot.
  • Information held for an agency. If your information is in an agency's records on Briesa, ask the agency. We will help the agency respond within the time the law allows.
  • How to ask. Write to us at the address in section 18. We will ask you to confirm who you are before giving out or changing information. There is no charge to make a request, and we will not charge for giving access except where the law allows a reasonable charge for unusual effort.

  An agency's owner and administrators can export the organisation's records as a file from the platform at any time, and its registers and audit trail as spreadsheets.

  Read the full clause
• Complaints

  If you think we have breached the Australian Privacy Principles or this policy, contact our Privacy Officer using the details in section 18. Tell us what happened and what outcome you want. We will acknowledge your complaint within 5 business days, investigate it, and give you a written reply, usually within 30 days.

  If you are not satisfied with our reply, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, by phone on 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001.

  Read the full clause

For anything about these documents, or to access or correct the personal information we hold about you, write to support@briesa.com.