Privacy Policy

What we collect

Everyone with an account: your name, work email address and phone number, the business you act for and your role in it, and a record of what you do on the platform (we keep an audit trail of actions that change money, stock or permissions). We keep your password only as a secure hash, never as text.

Your business: its legal name, trading name and ABN, which we verify against the Australian Business Register at signup, plus its addresses, delivery or warehouse sites, site contact phone numbers and delivery schedules.

If you buy: your orders, invoices, credit notes, payment records, delivery history, purchase order numbers and any support messages. For card payments we hold only what identifies the card to you (the brand, last four digits and expiry) plus a token from our payment processor. We never see or store your full card number.

If you supply: your products and their information, your stock, your payout statements and recipient created tax invoices, your storage charges, and your bank details for payouts. Where you authorise a direct debit for storage rent, we hold only the last digits of the account, enough to recognise it; the account itself is held by our payment processor.

If you store or deliver: the jobs assigned to you, what you collected and delivered, and your statements.

When you use the site: the technical basics any web service needs to work, such as your browser type and IP address in our server logs, and error reports when something breaks.

What we do not collect

We want to be specific about this, because it is unusual.

• We do not track your location. We use the delivery address you type, and its postcode, to work out who can deliver to you. We do not ask for, collect or use device location, in the foreground or the background.
• We do not run analytics or advertising trackers. There is no Google Analytics, no advertising pixel, no remarketing tag and no third-party tracking cookie anywhere on this platform.
• We do not sell your information to anyone, ever.
• We do not ask for sensitive information (health, race, religion, political or union membership, sexual orientation, criminal record, biometrics). Please do not send it to us. If we ever need it, we will ask for your consent first.

Cookies

We use a small number of cookies, all of them our own and all of them necessary to make the platform work: keeping you signed in, remembering which business you are acting for, remembering which delivery site you are shopping for, and protecting our signup form from bots. There are no analytics or advertising cookies, so there is nothing here to opt out of. If that ever changes, we will update this policy and ask you first.

Why we hold it

To run the marketplace: to give you an account, take and price your orders, hold and move stock, take payment, issue invoices and credit notes, pay suppliers and operators, collect storage rent, tell you what is happening with your orders, answer your questions, keep the platform secure and working, meet our tax and record-keeping obligations, and enforce our terms.

Who sees your information

The businesses you trade with. This is the part worth reading twice.

• The supplier filling your order sees your business name, delivery address, site contact phone and the order's fulfilment timeline. They cannot pack and dispatch it otherwise.
• The storage and delivery operators handling it see the delivery address, the site contact phone (drivers are given it) and what they need to pick, pack and deliver.
• A buyer never sees which warehouse holds the stock, and a supplier never sees another supplier's goods, prices or customers.

Our service providers, each for one purpose:

External couriers, where a delivery is booked with one, receive the delivery address and contact phone.

Others, where we have to: our professional advisers, anyone acquiring our business, debt recovery agents where an account is in default, and courts, regulators or law enforcement where the law requires it or we need to establish or defend a legal claim.

Overseas disclosure

Your information is stored in Australia (AWS Sydney). Some of the providers above process information overseas, including in the United States and the European Union. Where we disclose to them, we take reasonable steps to require them to protect your information consistently with the Australian Privacy Principles.

How long we keep it

• Financial records (orders, invoices, credit notes, payments, statements): 7 years, which meets our obligations under the tax law.
• Account and operational records: while your account is open, and for 2 years after it closes.
• Server and error logs: 12 months.

Because accounts belong to a business, some records must be kept even after an individual login is removed: an order does not stop existing because the person who placed it has left.

Keeping it safe

Access is restricted by role, so people see the parts of the platform their job needs. Passwords are stored hashed and sessions can be revoked. Payment credentials sit with our payment processor, not with us. The platform runs on managed infrastructure in Australia with encrypted storage and backups. No service can promise perfect security, and information sent over the internet always carries some risk.

If something goes wrong

If we have a data breach likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Marketing and email

Most of our email is transactional: orders, invoices, deliveries, statements. Your business can opt out of non-essential lifecycle email from its account settings, and every marketing email has an unsubscribe link. Tax documents and payment notices are sent regardless of that setting, because we are required to give them to you.

Your rights

You can ask us what we hold about you, ask us to correct it, or complain about how we have handled it. Email us at hello@preplocal.com and we will respond. We will not charge you for an access request. If we cannot give you access or make a correction, we will tell you why and how to take it further. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Links to other sites

Where we link to another website, that site has its own privacy policy and this one does not cover it.

Changes

We may update this policy. The current version always lives at preplocal.com/privacy, and we will tell you about material changes.

Contact us

PREPAPP Pty Ltd (ABN 32 644 154 861), trading as Preplocal · hello@preplocal.com