Dropbear Solutions Pty Ltd (ABN 00 000 000 000) operates OzBook, an online accounting and practice management platform. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

• We collect only the personal information we need to provide and support the platform.
• We do not sell personal information, and we do not use your accounting data for advertising.
• Customer data you enter into OzBook remains yours — we hold and process it on your behalf.
• Data is stored at rest in Australia and encrypted in transit and at rest.
• You can ask us for access to, or correction of, your personal information at any time.

This summary is provided for convenience only. The sections below set out the full policy.

This policy applies to personal information handled by Dropbear Solutions Pty Ltd in connection with the OzBook platform, including the OzBook website, the entity (organisation) file application, Practice Manager, the Developer Portal, Workbooks, the client portal, and our APIs.

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form.

Third-party websites and services that you reach through OzBook — including any third-party application you connect to your file — are governed by their own privacy policies, not this one.

It matters which kind of information is involved, because our obligations differ.

Account information

Information about you as a user or a subscriber — your name, email address, sign-in credentials, billing details and support history. We determine how this information is handled, and this policy governs it directly.

Customer data

The accounting, payroll, practice and client records that a subscribing organisation enters into or uploads to its OzBook file. That organisation controls this data. We hold and process it on the organisation's behalf and in accordance with our Terms of Service — we do not use it for our own purposes.

If you are an employee, client or contact of an organisation that uses OzBook and you want to access or correct information that organisation holds about you, please contact that organisation directly. If you contact us instead, we will refer you to them, or assist them in responding, as appropriate.

Account and identity information

• Name, email address, and any phone number you provide.
• Authentication information — password hashes, multi-factor authentication settings, registered passkeys, and (where you use single sign-on) the identifier returned by your Microsoft or Google account.
• Your role and permissions within each organisation or practice file you can access.

Subscription and billing information

• Subscription plan, billing contact, billing address, ABN, and invoice history.
• Payment records. Card details are collected and stored by our payment provider — we receive only a token and limited details such as the card brand and last four digits.

Usage and technical information

• IP address, browser and device type, and time zone.
• Pages and features used, API calls made, and error and performance diagnostics.
• Security and audit logs — sign-in attempts, permission changes, and records of who changed what and when within a file.

Support information

• The content of your support requests and our correspondence with you.

Sensitive information

We do not seek sensitive information (as defined in the Privacy Act 1988) about you as a user. Customer data may contain sensitive information — for example, payroll records containing leave details — where the subscribing organisation chooses to enter it. We handle that information under section 2 above.

We collect personal information:

• directly from you, when you register, subscribe, configure a file, or contact support;
• from the organisation that invited you to a file, when it creates your access;
• automatically, as you use the platform, through logs and analytics;
• from third parties you authorise — for example, an identity provider you sign in with, a bank feed you enable, or a system you migrate data from, such as Xero;
• from our payment provider, in relation to your subscription payments.

Where it is lawful and practicable, you may deal with us anonymously or under a pseudonym. In practice, we cannot provide an account, a subscription, or account-specific support without identifying you.

We use personal information to:

• create and administer accounts, and authenticate and authorise access;
• provide, maintain, secure and improve the platform and its features;
• process subscriptions, invoices and payments, and manage plan changes;
• provide support and respond to your enquiries;
• send service communications — invitations, security alerts, billing notices, and notices of material changes to the platform or to these policies;
• detect, investigate and prevent fraud, abuse, security incidents and breaches of our Terms of Service;
• produce aggregated, de-identified statistics about platform usage; and
• comply with our legal obligations and to establish, exercise or defend legal claims.

We do not use customer data to train machine learning models for other customers, and we do not sell personal information to anyone.

We may disclose personal information to:

• Other users of your file. Administrators and staff of an organisation or practice can see the users who have access to that file and the audit record of actions taken in it.
• Your accountant, bookkeeper or advisor where a practice has been granted access to your organisation's file.
• Service providers who help us run the platform — cloud hosting, email delivery, payment processing, document processing, error monitoring, and customer support tooling. They are permitted to use the information only to provide services to us.
• Third-party applications you connect. If you or your organisation's administrator authorises an application through our Developer Portal or API, we disclose the data covered by the scopes you consent to. You can review and revoke connected applications at any time from your file's connected applications page.
• Government agencies and regulators where you direct us to lodge on your behalf, or where we are required or authorised by law.
• Professional advisors, insurers, and prospective purchasers in connection with a sale, merger or restructure of our business, subject to appropriate confidentiality protections.

We store customer data and account information at rest in Australia.

Some of our service providers — for example, providers of email delivery, error monitoring or support tooling — may access or store limited information outside Australia. Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it in a way consistent with the Australian Privacy Principles, including through contractual protections.

You can ask us for the current list of countries in which our service providers may hold personal information by writing to privacy@ozbook.au.

OzBook supports payroll and lodgement features that require government-related identifiers, including tax file numbers (TFNs) and Australian Business Numbers (ABNs), to be stored in a customer's file.

We handle TFN information in accordance with the Privacy (Tax File Number) Rule 2015. TFNs are collected by the subscribing organisation from its own employees and are held by us on that organisation's behalf, solely so that the organisation can meet its taxation, personal assistance and superannuation obligations. We do not use or disclose TFN information for any other purpose, and we do not adopt a government-related identifier as our own identifier for any individual.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Those steps include:

• encryption of data in transit (TLS) and at rest;
• strict tenant isolation, so that no organisation can access another organisation's data;
• role- and permission-based access control, with multi-factor authentication and passkey support for user accounts;
• immutable audit logging of changes made within a file;
• least-privilege access for our personnel, granted only where needed for support or operations;
• regular backups, patching, monitoring and vulnerability management.

Our information security and AI management practices are aligned to ISO/IEC 27001:2022, ISO/IEC 42001 and SOC 2.

No method of transmission or storage is completely secure. You are responsible for keeping your sign-in credentials confidential and for the actions of users you invite to your file. If you believe your account has been compromised, or you have found a security vulnerability, contact us at security@ozbook.au.

We maintain a data breach response plan. If we suspect a data breach, we will investigate promptly and take steps to contain it and reduce harm.

Where a breach is likely to result in serious harm to an individual, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme. Where the breach affects customer data, we will notify the subscribing organisation so that it can meet its own notification obligations.

We retain personal information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it by law.

• Accounting and financial records are subject to statutory record-keeping periods — generally five years under Australian taxation law, and up to seven years for some records.
• OzBook uses an archive (soft-delete) model rather than immediate destruction, so that records can be restored and audit history stays intact.
• When a subscription ends, we retain the file for the period stated in our Terms of Service so that you can export your data, after which it is deleted or de-identified.
• Audit and security logs are retained for as long as needed to meet our compliance and security obligations.

You may request deletion of your user account by writing to privacy@ozbook.au. We will action the request unless we are required to retain the information, in which case we will tell you why.

You can view and update much of your personal information yourself from your account profile.

You may also ask us for access to the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Write to privacy@ozbook.au.

We will respond within a reasonable period, and generally within 30 days. We may need to verify your identity first. There is no fee for making a request, though we may charge a reasonable fee for the cost of providing access in some circumstances. If we refuse access or correction, we will give you written reasons and tell you how to complain.

We use cookies and similar technologies for:

• Authentication — keeping you signed in across the OzBook applications. These are essential; the platform cannot work without them.
• Security — protecting against cross-site request forgery and detecting suspicious sessions.
• Preferences — remembering settings such as your light or dark theme.
• Diagnostics — understanding aggregate feature usage, errors and performance so we can improve the platform.

You can block or delete cookies through your browser settings, but essential cookies cannot be disabled without preventing you from signing in. We do not use advertising cookies and we do not track you across unrelated websites.

We may send you information about features, updates and offers related to OzBook. Every marketing message includes an unsubscribe link, and you can opt out at any time from your notification preferences or by writing to privacy@ozbook.au.

Opting out of marketing does not stop service communications — billing notices, security alerts, and notices of material changes — which we need to send you while you hold an account.

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please tell us first at privacy@ozbook.au. Include enough detail for us to investigate, and tell us how you would like the matter resolved.

We will acknowledge your complaint promptly, investigate it, and give you a written response — normally within 30 days.

If you are not satisfied with our response, you can refer the complaint to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

We may update this policy from time to time to reflect changes to the platform, our practices, or the law. The version and effective date at the top of this page always show the current policy.

Where a change materially affects how we handle your personal information, we will notify you by email or through the platform before it takes effect.

Privacy enquiries, access, correction and complaints

privacy@ozbook.au

Security and vulnerability reports

security@ozbook.au

General support

support@ozbook.au

Postal address

PO Box Unknown

Operator

Dropbear Solutions Pty Ltd · ABN 00 000 000 000