Privacy Policy

1. About this Policy

1.1 This Privacy Policy describes how Feezy Pty Ltd (ACN 661 267 385), trading as HE Comply ("HE Comply", "we", "us", "our"), collects, holds, uses, discloses, and otherwise handles personal information in connection with our website at hecomply.com (Website), the HE Comply platform at app.hecomply.com (Platform), and related services.

1.2 HE Comply is a contract management and compliance platform used by universities, colleges, and other education providers (Institutions) and by education recruitment agencies (Agencies).

1.3 Depending on where you are located, different data protection laws apply. This Policy covers our obligations under:

(a) the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), which apply to all users;

(b) the General Data Protection Regulation (EU) 2016/679 (GDPR), for users in the European Economic Area (EEA);

(c) the UK GDPR and the Data Protection Act 2018, for users in the United Kingdom; and

(d) applicable US state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), for users in those states.

2. Key Terms

Personal information or personal data means information about an identified or reasonably identifiable individual, as defined in the applicable law.

Customer means an Institution or Agency that has an account on the Platform.

Platform User means an individual who uses the Platform on behalf of a Customer.

Customer Data means the contracts, extracted contract data, signing records, imported records, and other information that a Customer or its Platform Users upload to, import into, or create in the Platform.

DPA means our Data Processing Agreement, which forms part of our Platform Terms of Use.

3. Who We Are and Our Role

3.1 We act in two roles:

(a) we are the controller (or APP entity, under Australian law) of the personal information we collect for our own purposes, such as account, billing, support, Website, and marketing information; and

(b) we are a processor of Customer Data. Each Customer is the controller of its Customer Data, and we process it only on the Customer's instructions under the DPA.

3.2 If your personal information is contained in a Customer's contracts or records (for example, as a signatory or contact), please direct requests about it to that Customer. We will assist them as the DPA requires.

3.3 For users in the EEA and the UK, we are established outside the EU and the UK. We are in the process of appointing representatives under Article 27 of the GDPR and the UK GDPR. In the meantime, please direct EEA and UK data protection queries to privacy@hecomply.com, and we will respond within the timeframes the law requires.

3.4 Contact us about privacy at privacy@hecomply.com, or by post to: Privacy Officer, Feezy Pty Ltd, Level 1, 63–73 Ann Street, Surry Hills NSW 2010, Australia.

4. What Personal Information We Collect

4.1 Information you provide directly

When you use the Website or register for or use the Platform, we may collect:

(a) account and contact information: name, email address, job title, organisation name, telephone number, and country;

(b) professional information: organisation details, business address, and registration or accreditation numbers;

(c) Customer Data, including the content of contracts uploaded, imported, or signed through the Platform, which we process for the Customer under the DPA; and

(d) communications: enquiries, support requests, and other correspondence you send us, including through forms on the Website.

4.2 Information we collect automatically

When you use the Website or the Platform, we may automatically collect:

(a) usage data: log files, access times, IP addresses, approximate location, browser type, operating system, pages visited, and features used;

(b) device information: device type, screen resolution, and language settings; and

(c) information from cookies and similar technologies (see section 10).

4.3 Information from third parties

We may receive personal information about you from:

(a) Customers that invite you to co-manage or sign a contract through the Platform;

(b) DocuSign, for signature events (including timestamps and IP addresses) on contracts signed through the Platform; and

(c) verification services we may use from time to time, with appropriate notice.

4.4 AI-assisted contract reading

Where a Customer selects AI-assisted reading for an upload, the contract is read using Amazon Bedrock, within the AWS regions described in the DPA. The AI model provider does not receive the contract. We do not use identified Customer Data or personal information to train AI models.

4.5 Sensitive information

We do not intentionally collect sensitive information (such as health or biometric data). Please do not upload sensitive information to the Platform unless you have a lawful basis to do so and have our prior written agreement. If sensitive information has been uploaded by mistake, contact us at privacy@hecomply.com.

5. Why We Collect Personal Information and Our Lawful Bases

We use personal information for the purposes below. Where the GDPR or UK GDPR applies, the lawful basis is shown.

We may use anonymised, aggregated data, from which no individual or organisation can be identified, for the purposes set out in clause 3.2 of the DPA.

6. Who We Disclose Personal Information To

We do not sell personal information. We may share it with the following.

6.1 Service providers

We use the service providers below under written agreements. For Customer Data, Annex C of the DPA is the authoritative list.

6.2 Other Customers

When a Customer shares a contract for co-management or signing, contact and professional information in it is shared with the other party. This happens only when a Platform User chooses to share.

6.3 Advisers and regulators

We may share personal information with lawyers, accountants, auditors, or regulators where needed to meet legal obligations or to establish, defend, or enforce legal claims.

6.4 Business transfers

If we merge with, acquire, or are acquired by another entity, personal information may be transferred as part of that transaction. We will notify affected individuals where the law requires.

6.5 Law enforcement

We may disclose personal information to law enforcement or government authorities where required by law, court order, or other lawful demand.

7. International Transfers

7.1 We are based in Australia. Where Customer Data is stored and processed, including the use of AWS regions in Australia and the EEA, is set out in clause 13 of the DPA.

7.2 Some of our service providers process personal information in the United States and other countries, as shown in section 6.1.

7.3 For transfers of personal information from the EEA, we rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914). For transfers from the UK, we rely on the UK International Data Transfer Addendum. For Customer Data, these are incorporated in the DPA.

8. How Long We Keep Personal Information

At the end of the retention period, we delete or de-identify personal information unless the law requires us to keep it longer.

9. Security

9.1 We take reasonable technical and organisational measures to protect personal information from unauthorised access, disclosure, misuse, loss, and alteration, including:

(a) encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);

(b) role-based access controls limiting access to those who need it;

(c) multi-factor authentication on our cloud infrastructure accounts, and two-factor sign-in available to all Platform Users;

(d) encrypted backups and disaster recovery procedures; and

(e) annual independent penetration testing and staff training on data handling.

9.2 Our security measures for Customer Data are described in Annex B of the DPA. No system is completely secure. If you suspect a security incident, contact us immediately at privacy@hecomply.com.

9.3 If a data breach is likely to result in a risk to your rights and freedoms (under the GDPR or UK GDPR), or meets the threshold for notification under the Notifiable Data Breaches scheme (Privacy Act), we will notify you and the relevant regulator as the law requires: within 72 hours to the regulator under the GDPR, and as soon as practicable under the Privacy Act.

10. Cookies

10.1 We use cookies and similar technologies as follows:

10.2 You can control or delete cookies through your browser settings. Disabling some cookies may affect how the Website or Platform works.

11. Your Rights

11.1 Australia

Under the Privacy Act and the APPs, you have the right to:

(a) access the personal information we hold about you;

(b) request correction of inaccurate, incomplete, or out-of-date information; and

(c) complain to us and, if you are not satisfied with our response, to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

11.2 EEA

If you are in the EEA, you also have the following rights under the GDPR:

(a) access (Article 15): to obtain a copy of your personal data and information about how it is processed;

(b) rectification (Article 16): to have inaccurate data corrected and incomplete data completed;

(c) erasure (Article 17): to request deletion of your personal data in certain circumstances;

(d) restriction (Article 18): to restrict our processing in certain circumstances;

(e) portability (Article 20): to receive your data in a machine-readable format, where processing is based on consent or contract;

(f) objection (Article 21): to object to processing based on legitimate interests; and

(g) withdrawal of consent (Article 7(3)): to withdraw consent at any time, without affecting earlier processing.

You may also complain to your national supervisory authority. A list is available at https://edpb.europa.eu.

11.3 United Kingdom

UK users have equivalent rights under the UK GDPR and the Data Protection Act 2018, and may complain to the Information Commissioner's Office (ICO) at www.ico.org.uk.

11.4 California

If you are a California resident, you have the right to:

(a) know what personal information we collect, use, and disclose;

(b) request deletion of personal information we hold about you, subject to exceptions;

(c) correct inaccurate personal information;

(d) opt out of the sale or sharing of personal information (we do not sell personal information); and

(e) not be discriminated against for exercising these rights.

11.5 Customer Data

Where your personal information is in Customer Data, please direct rights requests to the relevant Customer, as the controller. We will help Customers respond as the DPA requires.

11.6 How to exercise your rights

To exercise any of these rights for personal information we control, email privacy@hecomply.com. We will respond within 30 days, or any shorter period the law requires (such as one month under the GDPR). We may ask you to verify your identity. There is no charge, unless a request is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or decline it.

12. Third-Party Links and Integrations

The Website and Platform may link to, or integrate with, third-party services such as CRM systems. We are not responsible for their privacy practices. Please review the privacy policy of any third party you connect.

13. Children

The Website and Platform are for education professionals and organisations, and are not directed at anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor has given us personal information, contact privacy@hecomply.com and we will delete it. Customers that upload data about students under 18 are responsible for having a lawful basis and appropriate safeguards.

14. Complaints

14.1 If you have a concern about how we have handled your personal information, please contact us first at privacy@hecomply.com. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

14.2 If we cannot resolve your complaint, you may contact:

(a) Australia: the Office of the Australian Information Commissioner, www.oaic.gov.au;

(b) EEA: your national supervisory authority, listed at https://edpb.europa.eu; or

(c) UK: the Information Commissioner's Office, www.ico.org.uk.

15. Changes to this Policy

We may update this Policy from time to time. When we do, we will update the effective date below, post the revised Policy at hecomply.com/privacy-policy, and, where the change is material, notify Customers by email or in the Platform.

16. Contact Us

See also our Website Terms of Use, Platform Terms of Use, and Data Processing Agreement.