Privacy Policy

Blackbox Australia Pty Ltd ("Blackbox", "we", "us") provides cloud-based monitoring services to construction, mining and government clients, including camera monitoring, timelapse imagery, a mobile app, and related data services. We are committed to protecting personal information and handling it in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to:

• people who use our platform or mobile app (typically our clients' staff and our own field staff);
• individuals who may be captured by cameras deployed at client sites;
• visitors to our website; and
• business contacts of Blackbox.

It explains what personal information we collect and hold, how and why we handle it, who we disclose it to, whether it may be disclosed overseas, how you can access or correct it, and how you can make a privacy complaint.

Platform users — name, job title, business email address, and records of your use of the platform (such as login and activity logs) for security and support purposes.

Mobile app users — if you use the Blackbox mobile app, you may choose to allow the app to access your device's location. Location is used only while the app is open, to position cameras and markers on a site. Blackbox does not receive, record or store your device location. To display the map around your position, the app requests map tiles from a third-party map provider (see sections 6 and 8); those requests include the map area being viewed and your device's IP address, but not your identity or Blackbox account. Where you record a camera's position, the camera's coordinates are stored as site asset information, linked to the account that created the record for audit purposes.

Imagery from client sites — our cameras, deployed at client sites, capture images and video. This may include identifiable individuals (for example, people present on or near a site) and vehicle licence plate information (ANPR). We do not use facial recognition or biometric identification in our platform.

Website visitors — technical information collected through cookies and analytics, such as pages visited, device type, browser and approximate location derived from your IP address. See section 7.

Business contacts — name, role, organisation and contact details of people at current and prospective client organisations, suppliers and partners.

Directly — from platform users when an account is created and used, and from business contacts through ordinary commercial dealings.

Via our mobile app — device location, only where you have granted the app location permission. This is optional; the app functions without it.

Via monitoring services — through cameras deployed at client sites, as part of the services we provide to our clients. We do not solicit personal information from individuals on client sites; imagery is captured in the course of delivering monitoring services to the client operating the site.

Via our website — through cookies and analytics tools when you visit blackbox.au.

We handle personal information to:

• deliver our monitoring services to clients, including site monitoring, security event review, progress imagery and related functions, and to make that information available for authorised use by the relevant client;
• operate, secure and support our platform and mobile app, including assisting with camera placement and site navigation where you enable location;
• manage our relationships with clients, suppliers and partners, including billing and support;
• communicate with clients and business contacts about our services (see section 7);
• improve our website and services; and
• comply with our legal obligations.

For imagery captured at client sites, we handle that information on behalf of, and for the authorised use of, our clients. The client operates the site and determines the purposes for which monitoring is used. Blackbox remains responsible under the Privacy Act for the personal information it holds.

Because we do not control client premises or public spaces, we are not able to directly notify individuals who may be captured by cameras. Our cameras are deployed overtly — visibly mounted on poles and structures — and are readily apparent on site. For security projects, we also supply clients with surveillance signage. Notification of individuals present on a site — for example, through surveillance/CCTV signage — remains the responsibility of the client as the operator of the premises, and clients are responsible for meeting their own privacy and workplace surveillance obligations in relation to their sites.

Authorised client users — information is surfaced for authorised use by the relevant client.

Service providers — we use third-party providers to deliver our services and run our business, including cloud infrastructure, communications and email, customer relationship management, website analytics, and video editing tools. These providers are engaged under our Third-Party Risk Management Procedure and are permitted to use personal information only to provide services to us. A list of our service providers and their hosting locations is available to clients on request.

Map tile provider — our mobile app displays base maps using OpenStreetMap data served by an open-source map tile provider. When the app displays a map, tile requests are sent to that provider. According to its published privacy policy, the provider does not use accounts, API keys or cookies and does not log IP addresses in normal operation. Blackbox does not send your identity, account details or any camera data to the map provider.

Monitoring partners — where a client engages an alarm-monitoring service, relevant event information may be shared with that partner for that purpose.

Where required or authorised by law — we may disclose personal information, including camera imagery and ANPR data, where required or authorised by or under Australian law, including to law enforcement agencies, courts, safety regulators and other government bodies, or where we reasonably believe it is necessary to lessen or prevent a serious threat to the life, health or safety of any individual.

We do not sell personal information.

We may send clients and business contacts information about our services, industry updates and events. You can opt out at any time by using the unsubscribe link in any marketing email or by contacting privacy@blackbox.au. We do not use imagery from client sites for marketing without the client's agreement.

Our website uses Google Analytics to understand how visitors use the site. Google Analytics uses cookies and collects technical information such as pages visited, device and browser type, and approximate location derived from IP address. You can control cookies through your browser settings or use Google's browser opt-out add-on. Blocking cookies will not prevent you from using our website.

Our platform, camera imagery and related data are stored and processed in Microsoft Azure Australian regions. Security footage and ANPR data are not stored outside Australia.

Some of the service providers we use are located, or host data, outside Australia:

• Video editing — low-sensitivity site imagery (such as progress photos and timelapse) may be processed in the United States or Europe using our cloud productivity provider. This does not include security footage or ANPR data.
• Customer relationship management and marketing — names, roles, organisations and business contact details of platform users and business contacts are held by our CRM and marketing provider in the United States.
• Email and productivity — business communications, which may contain personal information, are held by our email and productivity provider in data centres located in the United States and other countries in which it operates.
• Website analytics — analytics data is processed by Google in the United States.
• Map tiles — when you use the map in our mobile app, tile requests (the map area being viewed and your device's IP address) are served from Europe and may be delivered via a content delivery network.

Where we disclose personal information to overseas providers, we take reasonable steps, including contractual terms, to ensure it is handled in a manner consistent with the APPs.

We hold personal information within our secured Azure environment and apply administrative, technical and physical safeguards under our information security management system, which is aligned to ISO/IEC 27001.

We retain personal information for as long as needed for the purposes described in this policy, and then destroy or de-identify it in accordance with our Data Retention and Disposal Policy. In summary:

• Security footage and ANPR data are retained for as long as required to deliver services to the relevant client, unless a longer period is agreed with the client or required by law.
• Progress and timelapse imagery is retained for the duration of the client's engagement and any period agreed with the client.
• Platform user account details are retained while the account is active and for a period afterwards in accordance with our retention policy.
• Device location from our mobile app is not retained by Blackbox.

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.

Our mobile app requests location permission on first use. You can grant access while using the app, or decline. You can change this at any time in your device's settings. Declining location will not prevent you from using the app; the map will simply not centre on your position automatically.

You may request access to, or correction of, personal information we hold about you. Platform users can view and update their own account details within the platform.

Because much of the imagery we hold is handled on behalf of clients, requests relating to imagery may need to be directed to, or coordinated with, the relevant client.

To make a request, contact privacy@blackbox.au. We will respond within 30 days. If we decline a request, we will tell you why in writing and how you can complain.

If you have a privacy inquiry, or wish to make a complaint about how we have handled your personal information, contact us at privacy@blackbox.au. We will acknowledge your complaint promptly, investigate it, and respond within 30 days.

If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.

We may update this policy from time to time. The current version is available on our website, with the "last updated" date shown above.

Privacy Officer privacy@blackbox.au Blackbox Australia Pty Ltd, 23/17 Cairns Street, Loganholme QLD 4129