Privacy Policy

Last updated: 23 August 2026 · Version 1.0

    LPO Manager is committed to protecting your privacy. This policy explains what information we collect, how we use it, and your rights regarding your data. We comply with the Australian Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme.
  

1. Who We Are

LPO Manager is operated by Evolve AI Pty Ltd, based in Tasmania, Australia. For privacy matters, contact us at admin@lpomanager.com.au.

2. Information We Collect

Category	Data Collected	Purpose
Account information	Full name, email address, phone number	Account creation and communication
Business information	LPO/business name, Work Centre Code, ABN, billing address	Account setup, invoicing, identity verification
Operational data	Stock records, sales data, orders, parcel/delivery entries	Providing the core Service features
Commission data	Commission reports uploaded by the Subscriber, including commission line items, product categories, revenue figures, and statement periods	Generating commission insights, trend analysis, and financial summaries within the Service
Usage data	Activity logs, timestamps, actions performed within the portal	Security, troubleshooting, and audit trails
Consent records	Terms acceptance timestamp and version	Legal compliance
Technical data	IP address (captured by hosting infrastructure on form submissions)	Security and fraud prevention

We do not collect payment card details directly. Payments are handled by external providers with their own privacy and security standards.

Commission report data is uploaded voluntarily by Subscribers who opt into the commissions insights feature. This data is stored solely for the purpose of generating insights for that Subscriber's own use and is never shared with, disclosed to, or accessible by any other Subscriber or third party. The commission report data is supplied directly by the Subscriber from their own records.

3. How We Use Your Information

We use your information solely to:

Provide, operate, and maintain the LPO Manager Service
Communicate with you about your account, billing, and important updates
Verify your identity and business credentials during onboarding
Maintain security and investigate unauthorised access
Comply with our legal obligations under Australian law
Improve the Service based on usage patterns (anonymised where possible)

We do not sell, rent, or share your personal or business data with third parties for marketing purposes.

4. Data Storage and Security

Important: All Subscriber data is physically stored and managed by reputable third-party cloud infrastructure providers. The Provider does not operate its own servers and does not have physical custody of your data. By using the Service, you acknowledge and accept that data storage is delegated to these external providers.

The Provider selects infrastructure providers that implement industry-standard security controls including encryption at rest and in transit (TLS). These external providers maintain their own security certifications and compliance programmes independent of the Provider.

Within the application layer, the Provider implements the following measures:

Row-level security ensuring each LPO can only access their own data
Encrypted connections (HTTPS/TLS) for all data in transit
Activity logging for all significant data changes
Access limited to authorised personnel only
Session timeouts and re-authentication requirements

No security system is infallible. While the Provider takes reasonable application-level measures, it has no control over the underlying infrastructure security of external providers, and cannot guarantee absolute security of data stored with those providers. Subscribers use the Service acknowledging this inherent risk.

5. Data Breach Response

In the event of a data breach that is likely to result in serious harm to individuals, we will comply with the Notifiable Data Breaches (NDB) scheme under the Australian Privacy Act 1988.

Our data breach response procedure:

Detection: Upon becoming aware of a suspected breach, we will assess whether it constitutes an "eligible data breach" under the NDB scheme
Containment: Immediate steps will be taken at the application layer to contain the breach and prevent further unauthorised access where within the Provider's control
Notification to OAIC: If an eligible data breach is confirmed, we will notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and no later than 30 days after becoming aware
Notification to affected individuals: Affected Subscribers will be notified directly by email as soon as practicable, with details of what data was involved, what happened, and what steps are being taken
Remediation: We will take reasonable steps within our control to prevent recurrence and will cooperate with any regulatory investigation

Where a breach originates from or is caused by an external infrastructure provider, the Provider's response obligations are limited to notification and cooperation — the Provider bears no financial or legal liability for such breaches. Subscribers are encouraged to review the security and privacy policies of any external providers used by the Service.

To report a suspected security vulnerability or breach, contact us immediately at admin@lpomanager.com.au.

5A. Limitation of Liability for Data Breaches and Privacy Incidents

To the maximum extent permitted by Australian law, the Provider is not liable for any loss, damage, cost, expense, or claim arising from or in connection with:

A data breach, security incident, or unauthorised access caused by or originating from any external infrastructure or cloud provider used to deliver the Service
A breach resulting from a Subscriber's failure to maintain the security of their own login credentials
A breach resulting from a Subscriber sharing access with unauthorised persons
Loss or exposure of data caused by a Subscriber's own actions or negligence
Any indirect, consequential, special, or punitive loss arising from a privacy incident, including loss of business, loss of revenue, reputational damage, or regulatory fines imposed on the Subscriber
Incidents arising from vulnerabilities in third-party software, libraries, or services used by the Provider that were not known to the Provider at the time
Force majeure events including cyberattacks, government action, or infrastructure failure outside the Provider's reasonable control

The Provider's maximum total liability in connection with any privacy or data security incident is limited to the subscription fees paid by the affected Subscriber in the 3 months preceding the incident. Nothing in this section limits the Provider's obligations under the Notifiable Data Breaches scheme to notify affected individuals and the OAIC.

6. Data Retention

We retain your data for as long as your account is active. Upon cancellation:

Your data remains accessible for 30 days after your subscription ends so you can export it
After 30 days, your data may be permanently deleted from our systems
Activity logs may be retained for up to 12 months for security and legal compliance purposes
Records of Terms acceptance are retained indefinitely for legal compliance

7. Your Rights

Subscribers may submit requests regarding their personal data by contacting us at admin@lpomanager.com.au. We will assess and respond to requests within a reasonable timeframe. Requests are subject to verification of identity and may be declined where they conflict with the Provider's legal obligations or operational requirements. The Provider's response to any request is final and at the Provider's sole discretion.

8. Cookies and Tracking

LPO Manager uses browser local storage (not third-party cookies) to maintain your session and remember your preferences. We do not use advertising cookies, tracking pixels, or third-party analytics that track you across websites.

9. External Service Providers

The Service relies on reputable external cloud infrastructure and service providers to deliver its functionality. Each external provider operates independently under its own terms and privacy policy, and is solely responsible for the privacy and security of data within their own systems. The Provider has no control over external systems and accepts no liability for any privacy incident, data breach, or loss caused by or attributable to any external provider.

By using the Service, Subscribers acknowledge that their data passes through and is stored by external providers, and that the Provider's liability for any act or omission of those providers is excluded to the fullest extent permitted by law. A current list of external providers used by the Service is available upon request by contacting admin@lpomanager.com.au.

10. Children's Privacy

The Service is intended for use by business operators aged 18 and over. We do not knowingly collect personal information from minors. If you believe a minor has provided personal information, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify Subscribers of material changes by email at least 14 days before the changes take effect. Continued use of the Service after notification constitutes acceptance of the updated policy.

12. Contact Us

For privacy queries or data requests, contact us at:

LPO Manager — Evolve AI Pty Ltd
Email: admin@lpomanager.com.au
Tasmania, Australia

All privacy matters must first be directed to the Provider via the contact above before any other action is taken. The Provider will make reasonable efforts to resolve any concern directly and in good faith.