Privacy Policy

1. Policy Scope and Related Entities

This Privacy Policy explains how ProActive QMS Pty Ltd (ABN: 90 695 119 576) (referred to as "we", "us", or "our") manages personal information. It also describes your rights to access and correct personal information we hold about you, and how you can make a complaint about our management of your personal information. This policy applies to personal information collected from clients, prospective clients, subscribers, authorised users, and associated individuals in the course of providing our cloud-hosted Software-as-a-Service (SaaS) platform, ProActive QMS, and related training and support services. This Privacy Policy does not apply to information we collect about businesses, companies, or other institutions, however it does apply to information about the individuals in those businesses, companies, or institutions that we store. Individuals under the age of 18 years must not use our website and services without their parent or legal guardian's consent.

2. Professional and Regulatory Alignment

We have elected to treat all personal information managed across our entire operations as if it were fully subject to the Australian Privacy Principles. This ensures a single, robust, unified data protection standard across our practice, regardless of our annual turnover or the specific purpose of collection. This voluntary commitment aligns with our professional quality management standards and the regulatory standards governing our users (tax practitioners), ensuring that all data (whether standard commercial data or professional records) is handled with the highest level of care, confidentiality, and security.

3. Types of Personal and Sensitive Information Collected

3.1. Standard Personal and Contact Information

In the course of conducting our business and operating our SaaS platform, it is necessary for us to collect personal information. This information allows us to identify who an individual is, contact them in the ordinary course of business, manage their account, and fulfill our professional obligations. The types of personal information we may collect and hold include, without limitation: full name, date of birth, gender, signature, and contact details such as residential, business, and postal addresses, email addresses, telephone numbers, and fax numbers.

3.2. Financial and Professional Information

We may collect financial information, including bank account details, billing information, payment card details, subscription tiers, transaction histories, and tax-related identifiers (excluding Tax File Numbers) where necessary for billing and administration. We also collect professional and business information, including occupation, employer, job title, professional qualifications, business structures, trust arrangements, and business holdings. This includes details of the subscribing firm's quality management policies, procedures, and implementation evidence uploaded by the firm into the ProActive QMS platform.

3.3. Sensitive Information and Technical Data

Where necessary and authorised by law or with your consent, we may collect sensitive information. While ProActive QMS does not actively solicit sensitive information, such data may be contained within documents uploaded by subscribing firms as part of their QMS implementation evidence (such as professional association memberships, disciplinary records, or health information relevant to professional capacity or deadline extensions). We also collect technical website and platform data, including IP addresses, browser types, device information, operating systems, pages visited, access times, and cookies collected during your interactions with our websites, including www.proactiveqms.com.au. This technical data is used for security, audit trails, electronic signatures, and platform optimisation.

4. Methods of Information Collection

4.1. Direct Collection Channels

We collect personal information through lawful and fair means, and generally directly from you, as the individual concerned, unless it is unreasonable or impracticable to do so. Information is typically collected when you register to use our services, complete client onboarding forms, set up user profiles, upload documents to our platform, correspond with us via email or post, speak with us on the telephone, meet with us in person, or generally when dealing with us. When you access our platform or websites, we may collect information using cookies or analytical services to ensure platform security and monitor system performance.

4.2. Indirect and Third-Party Collection

We may collect personal information about you from third parties, including: your employer or the subscribing firm that has authorised you to access the platform; third-party software integrations connected by you; publicly available sources such as corporate registers, professional directories, and the internet; and financial institutions or professional intermediaries who introduce you to us. If you provide us with personal information about another person, you warrant and confirm that you are authorised to do so and have taken all necessary steps to notify that person of the matters set out in this Privacy Policy. Where we obtain personal information without an individual's knowledge, we will, within a reasonable period, determine whether we could have lawfully collected the information. If not, we will securely destroy or de-identify the information as soon as practicable, provided it is lawful and reasonable to do so.

5. Primary and Secondary Purposes of Collection and Use

5.1. Primary Operational Purposes

We collect, hold, use, and disclose personal information for the primary purpose of providing our compliance management platform services, operating our SaaS platform, and managing our business. This includes: verifying your identity and facilitating user onboarding; providing, maintaining, and improving the ProActive QMS platform; facilitating automated workflows, compliance task steps, and reminder systems; maintaining comprehensive audit trails documenting changes, approvals, and updates to policies and procedures; billing, processing payments, and collecting subscription fees; and complying with our legal, professional, regulatory, and insurance obligations. We are not a law practice and do not provide any form of legal services: none of the information we receive from you or provide to you is subject to legal professional privilege.

5.2. Secondary Purposes and Opt-Out Mechanisms

We may also use and disclose personal information for secondary purposes directly related to our primary purposes, including: maintaining and developing our ongoing relationship with you; sending platform updates, newsletters, educational content, and invitations to seminars; conducting internal reporting, business analysis, and quality assurance; coordinating our early access program; improving our services, systems, and software platforms; enforcing our contractual rights and recovering outstanding debts; and managing risks, obtaining professional advice, and maintaining appropriate professional indemnity insurance coverage.

Opting "out" of personal information collection. You may opt to not have us collect your Personal Information or other information. If you do not provide the requested personal information we may be unable to verify your identity, we may be unable to commence or continue providing our services, create or maintain your user account, or we may need to place restrictions on the scope of services and platform features we can provide to you.

Anonymity and Pseudonyms. Wherever it is lawful and practicable, you have the option of interacting with us anonymously or by using a pseudonym. For example, you may make general enquiries about our services or browse our website without identifying yourself. However, please note that once you formally agree to use our platform, we will need to verify your identity, and it will be impracticable for us to assist you without doing so.

6. Cloud Software Integrations and Third-Party Platforms

6.1. Integration with Financial and Cloud Platforms

In providing our SaaS platform and related services, we utilise and integrate with major third-party cloud-based collaboration platforms, including Xero and Microsoft 365. Your personal and financial information may be synchronised, processed, and stored within these third-party cloud environments to facilitate automated billing, workflows, data entry, and QMS management.

6.2. Independent Data Controllers and Platform Policies

We take reasonable steps to ensure that our cloud software partners are reputable and maintain robust security standards. However, these cloud platforms operate as independent data controllers and processors. The storage and processing of data within these platforms are subject to the independent privacy policies, security protocols, and terms of service of the respective platform providers. We strongly advise and encourage you to review the independent privacy policies of these platform providers, including: Xero's Privacy Policy (available on Xero's website); and Microsoft's Privacy Policy (available on Microsoft's website). We are not responsible for the privacy or security practices of these third-party platform providers.

7. Artificial Intelligence and Automated Decision-Making

7.1. Use of Automated Technologies and Analytics

We may utilise artificial intelligence (AI), machine learning, and automated decision-making (ADM) technologies to enhance the efficiency, accuracy, and delivery of our SaaS platform and related services. This includes the use of automated transaction matching, optical character recognition (OCR) for document and receipt processing, automated compliance reminders, and advanced data analytics tools to streamline Quality Management System workflows.

7.2. Data Safeguards and Human-in-the-Loop Verification

We implement strict safeguards to protect client confidentiality and data security when utilising AI and ADM technologies. We do not permit your personal or financial information to be used to train public, open-source, or third-party artificial intelligence models. All AI tools utilised by us are deployed within secure, private enterprise environments where data is encrypted and access is firmly restricted. Furthermore, we do not rely solely on automated decision-making for any outcomes that have significant legal or financial effects on you; all automated analyses and reports are subject to review, verification, and sign-off by a qualified professional within, or engaged by, our business.

8. Disclosure of Personal Information to Third Parties

8.1. Authorised Professional and Operational Disclosures

We may disclose personal information to third parties to facilitate the primary and secondary purposes of collection outlined in this policy. All disclosures are made subject to our strict professional duties of confidentiality, ethical codes, and contractual agreements. We may disclose personal information to: other professional advisers engaged in relation to your matters; service providers who assist us in operating our business, including secure cloud storage providers, IT support vendors, payment gateways, customer relationship management (CRM) platforms, marketing consultants, and customer support systems; our professional indemnity insurers, legal advisers, and auditors; and related entities within our corporate group.

8.2. Compulsory and Statutory Disclosures

There are exceptional circumstances in which we may be required to disclose personal information, including: where required or authorised by law, court order, or regulatory authorities; where we reasonably believe that an individual may be engaged in fraudulent, deceptive, or unlawful activity that a governmental authority should be made aware of; to protect the rights, property, or safety of ProActive QMS, its users, or the public; and in connection with a corporate restructuring, merger, acquisition, or sale of our business (where personal information may be transferred to a new owner).

9. Cross-Border Data Transfers and Offshore Processing

9.1. Overseas Storage and SaaS Server Locations

We may disclose personal information to recipients located outside Australia where it is reasonably necessary, convenient, or efficient to facilitate the purposes of collection, holding, use, and disclosure outlined in this policy. Due to the cloud-hosted nature of our SaaS platform, your personal and financial information may be stored on secure servers located in Australia, as well as in overseas jurisdictions, including the United States, Singapore, Ireland, and the United Kingdom.

9.2. Offshore Administrative and Professional Support

We may utilise offshore administrative, technical, or professional support teams located in Sri Lanka to assist with platform maintenance, data entry, document preparation, and customer support. These offshore personnel access our systems via secure, encrypted connections and are subject to strict security protocols, background checks, and comprehensive data processing agreements that strictly limit their use of personal information and bind them to equivalent data protection standards. We take all reasonable steps to ensure that any overseas recipient handles your personal information in accordance with standards equivalent to the Australian Privacy Principles.

10. Data Security, Retention, and Destruction

10.1. Technical and Physical Security Safeguards

We take all reasonable steps and implement robust technical and organisational measures to protect your personal information from misuse, interference, loss, and from unauthorised access, modification, or disclosure. These measures include: the implementation of advanced cybersecurity protocols, including multi-factor authentication (MFA), secure socket layer (SSL/TLS) encryption, and database encryption for data in transit and at rest; the use of secure client portals for the transmission of sensitive documents, avoiding the use of unencrypted email; restricting access to personal information to authorised personnel who require access to perform their professional duties; the use of secure physical facilities with restricted access control; and regular cybersecurity training and awareness programmes for all personnel.

10.2. Retention Periods and Secure Destruction Protocols

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, to comply with our statutory and professional obligations (which generally require records to be kept for a minimum of 5 years, and up to 7 years), and to ensure that pertinent evidence remains available if reasonably required for professional indemnity or legal dispute purposes. Once personal information is no longer required for any authorised purpose and we are not legally required to retain it, we will take reasonable steps to securely destroy, permanently delete, or de-identify the information in accordance with secure data destruction protocols.

11. Access to and Correction of Personal Information

11.1. Rights of Access and Verification Procedures

You have the right to request access to the personal information we hold about you. To make an access request, please contact our Privacy Officer in writing. We will take reasonable steps to verify your identity before granting access to protect client confidentiality. Subject to applicable privacy laws, we have an obligation to provide you with access to your personal information within 28 days of receiving your written request, subject to successful identity verification. We may charge you a reasonable fee for our administrative costs incurred in meeting your request, and we will inform you of any applicable fees before processing your request.

11.2. Refusal of Access and Correction Rights

We may refuse to grant access to personal information where prohibited by law, court order, or professional duties of confidentiality, or in permitted circumstances such as where providing access would pose a serious threat to safety, unreasonably impact the privacy of others, or reveal commercially sensitive decision-making processes. If we refuse access, we will provide written reasons and details on how to lodge a complaint. You also have the right to request that we correct any errors, inaccuracies, or out-of-date details in your personal information. Where you are unable to make the required correction yourself, we will correct any errors within seven (7) calendar days of receiving written notice from you, subject to successful identity verification.

12. Complaints, Dispute Resolution, and Contact Details

12.1. Internal Dispute Resolution Process

If you have any questions about this Privacy Policy or wish to lodge a formal complaint regarding our handling of your personal information, please address your complaint in writing to our designated Privacy Officer. We handle all complaints through our structured internal dispute resolution process: we will acknowledge receipt of your complaint in writing within five (5) Queensland business days; our Privacy Officer will conduct a thorough investigation into the matters raised; and we aim to provide a comprehensive written response, including our findings and any proposed remedial actions, within 30 days of receiving your complaint.

12.2. External Escalation and Contact Information

Our designated Privacy Officer contact details are as follows:
To: The Privacy Officer, ProActive QMS Pty Ltd (ABN: 90 695 119 576)
Post: C/- CloudTec, Unit D, Level 1, 107 Alfred Street, Fortitude Valley QLD 4006
Email: support@proactiveqms.com.au

If you are not satisfied with our internal response or the resolution of your complaint, you may escalate the dispute to the Office of the Australian Information Commissioner:
To: Office of the Australian Information Commissioner (OAIC)
Email: enquiries@oaic.gov.au
Post: GPO Box 5218, Sydney NSW 2001
Website: www.oaic.gov.au
Phone: 1300 363 992

Policy Last Reviewed: 1 July 2026