Privacy Policy

FormaOS Pty Ltd is the data controller for personal information processed through the FormaOS platform. For personal information that customers upload about their own staff and participants, the customer is the controller and FormaOS acts as processor under the Data Processing Agreement.

Privacy enquiries go to privacy@formaos.com.au.

Information you provide

• name, email address, and phone number
• organisation and role
• account credentials and multi-factor enrolment
• support requests and other correspondence

Usage data

• sign-in timestamps and session activity
• audit log entries for actions taken in the platform
• feature usage patterns
• IP address and device metadata

Customer data

Data your organisation uploads, including compliance records, evidence files, task and incident records, and organisational structures. Some of this can include sensitive information about participants or clients; treat the platform as an in-scope system when you complete your own privacy assessments.

We use information to:

• provide and operate the platform
• authenticate users and secure accounts
• generate audit logs and compliance records
• respond to enquiries and provide support
• diagnose faults and improve performance

We do not sell personal information and we do not disclose it for advertising.

Where the GDPR or an equivalent regime applies, we rely on one of the following:

• Contractual necessity: providing the service you signed up for
• Legal obligation: regulatory record-keeping and audit trails
• Legitimate interest: securing the platform, preventing abuse, and improving the product without undue impact on your privacy
• Consent, where required, for example analytics cookies or marketing email

Customer data is hosted in Australia by default on Supabase managed PostgreSQL and object storage, delivered through Vercel. Protections include AES-256 encryption at rest, TLS 1.3 in transit, tenant isolation enforced by database row-level security, role-based access control, and append-only audit logging that a database trigger prevents from being altered.

Administrative access to production is restricted and security-relevant actions are recorded. The full technical description is on the security page and in the data handling document.

We share information only with:

• sub-processors that host, secure, or support the platform, each listed on the sub-processors page
• legal or regulatory authorities where required by law

We never share data for advertising or resale. Advance notice of new sub-processors is given in accordance with the applicable customer agreement.

We retain personal information only as long as it is:

• necessary to provide the Services
• required for a legal or regulatory obligation, including sector retention rules our customers are subject to
• permitted under the applicable customer agreement

Retention periods are configurable per organisation. On termination, customer data can be exported before deletion, and written confirmation of deletion is available on request.

You can ask us to:

• give you access to the personal information we hold
• correct information that is inaccurate or out of date
• delete information, where deletion is lawful
• provide your data in a portable format
• withdraw consent you previously gave

Send requests to privacy@formaos.com.au. If your information sits inside a customer organisation's workspace, we will refer the request to that organisation as controller and support them in answering it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.

We maintain a documented incident response process covering detection, containment, assessment, and disclosure. Where an eligible data breach is likely to result in serious harm, we notify affected customers and the Office of the Australian Information Commissioner in line with the Notifiable Data Breaches scheme, and support customers with their own notification obligations.

The process, including severity classification, is described in the incident response document. Specific notification timeframes are set in your executed agreement rather than promised generally on this page.

Data is processed in Australia by default. Where a transfer outside Australia occurs, for example through a sub-processor, it is covered by Standard Contractual Clauses or an equivalent safeguard, and the receiving party is listed on the sub-processors page with its region.

We use a small number of cookies for:

• authentication
• session management
• performance monitoring

No third-party advertising trackers are used. You can review and change your analytics preference at any time on the privacy settings page.

We may update this policy to reflect regulatory, technical, or operational change. The effective date at the top of the page records the current version, and material changes are announced on the website before they take effect.

Privacy enquiries: privacy@formaos.com.au. General enquiries: support@formaos.com.au or +61 469 715 062.

Related documents: Terms and Conditions, Data Processing Agreement, and the Trust Center.