1. Introduction
Strataverra is committed to protecting the privacy and security of personal information. This policy explains how we collect, hold, use and disclose personal information in connection with our website and services.
We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we interact with individuals located in the European Economic Area (EEA) or the United Kingdom, we also take reasonable steps to comply with applicable requirements under the General Data Protection Regulation (GDPR) and the UK GDPR.
By using our website or providing your personal information to us, you acknowledge that you have read and understood this policy.
2. About Strataverra
Strataverra is an Australian-based software company developing a project management platform for asset-intensive industries. We are currently in a pre-launch phase, during which we use our website to share information about our platform, gauge market interest and build relationships with prospective clients and partners.
3. Information We Collect
We collect two distinct categories of information:
3.1 Personal Information (Provided by You)
When you voluntarily submit a form, complete an assessment, register your interest or contact us, we may collect:
- Contact and identification information - name, job title, company name, email address, phone number and business address.
- Enquiry and registration information - details you provide when submitting a form, requesting a demo, completing an assessment or registering your interest.
- Communications - records of correspondence between you and Strataverra.
This personal information is stored securely in our application database and synchronised with our customer relationship management system (currently HubSpot) for the purposes of communication, service delivery, and internal analytics. It is only collected when you actively choose to provide it.
3.2 Anonymous Usage Data (Collected Automatically)
We collect anonymous, non-personal usage data to understand how visitors interact with our website and to improve our services. This data cannot identify you individually and includes:
- Assessment interaction data - which steps of our assessment tool are completed, selected industry, and aggregated scores. This is linked to a randomly generated session identifier that cannot be traced back to any individual.
- Content engagement data - how far visitors read our articles, tracked via a random session identifier.
- Page and free tool usage - which pages are opened, how long they stay open, the referring website, and which buttons are pressed in our free tools (for example, downloading the Excel or PDF). We never record what you type or enter into a tool.
This anonymous data does not include your IP address, name, email or any other personal identifier. It is used solely for internal analytics, such as understanding assessment completion rates and content engagement, and is not shared with any third party.
3.3 Technical Information (Analytics and Marketing Cookies)
When analytics or marketing cookies are in use, third-party tools may collect technical information including IP address, browser type, device information, operating system, pages visited, referring URLs and session duration. See Section 8 for full details on cookies and how to manage your preferences.
We do not intentionally collect sensitive information (as defined under the Privacy Act) unless it is reasonably necessary and we have obtained your consent.
4. How We Collect Information
We collect personal information:
- directly from you, when you complete a form on our website, request information, complete an assessment, register your interest or communicate with us;
- through cookies and third-party analytics tools, as described in Section 8, which you can switch off at any time (and which, for visitors in Europe and the United Kingdom, are only used with consent); and
- from publicly available business sources, including professional networking platforms and company websites.
Anonymous usage data (described in Section 3.2) is collected automatically without the use of cookies or personal identifiers. This data is generated server-side using random session identifiers that expire when you close your browser and cannot be linked to any individual.
Where practicable, we will collect personal information directly from you. We will not collect personal information by unlawful or unfair means.
5. Purposes of Collection and Use
We collect and use personal information for the following purposes:
- to respond to your enquiries and provide information about Strataverra and our platform;
- to deliver services you have requested, including assessments and related outputs;
- to keep you informed about our progress, product developments and launch plans where you have expressed interest or consented to receiving communications;
- to understand market needs and evaluate demand for our platform, including through analysis of enquiry data and website usage patterns;
- to build and maintain a register of prospective clients and partners who may wish to be contacted when our platform becomes available;
- to provide, maintain and improve our website and services;
- to administer accounts, deliver platform access and provide customer support once our platform is operational;
- to comply with applicable laws and regulatory obligations; and
- to protect our legal rights, prevent misuse and ensure the security of our systems.
We will only use or disclose personal information for the purpose for which it was collected, a related purpose that would be reasonably expected, or as otherwise permitted or required by law.
6. Consent
Where you register your interest, request a demo or submit an enquiry through our website, we will ask for your explicit consent before adding you to our communications register or sending you marketing communications. Consent is obtained through a clear opt-in mechanism on our website forms.
Where you complete an assessment or request a specific service, your information will be used to deliver that service. If we wish to use your information for any additional purpose, such as marketing communications, we will seek your separate consent.
You may withdraw your consent at any time by contacting us at privacy@strataverra.com or by using the unsubscribe function in any communication you receive from us.
7. Lawful Basis for Processing (GDPR)
Where the GDPR applies to our processing of your personal information, we rely on the following lawful bases:
- Consent - where you have given clear consent for us to process your personal information for a specific purpose, such as receiving communications about our platform.
- Legitimate interests - where processing is necessary for our legitimate business interests, such as understanding market demand and maintaining a register of prospective clients, provided those interests are not overridden by your rights and freedoms.
- Contractual necessity - where processing is necessary for the performance of a contract with you or to take pre-contractual steps at your request, including delivering an assessment you have requested.
- Legal obligation - where processing is necessary to comply with a legal obligation to which we are subject.
8. Cookies and Analytics
8.1 Anonymous Server-Side Analytics (No Consent Required)
We collect anonymous, aggregated data on our own servers to understand how visitors use features such as our assessment tool and blog articles. This data uses randomly generated session identifiers and does not involve cookies, IP address collection, device fingerprinting or any technology that can identify you. Because this data is truly anonymous and non-personal, it does not require your consent under the Privacy Act, GDPR or ePrivacy Directive.
8.2 Third-Party Cookies and Tracking
Our website may load the following third-party analytics and marketing tools, which use cookies and similar technologies:
- Google Analytics (GA4) - to understand website traffic, visitor behaviour and page performance. IP addresses are anonymised.
- LinkedIn Insight Tag - to measure the effectiveness of LinkedIn advertising campaigns and understand professional demographics of visitors.
- HubSpot - to track website interactions in connection with our customer relationship management system and to support marketing communications.
These tools may collect information such as IP address, device type, browser information and browsing behaviour. Some of this information may be processed outside Australia, including in the United States. See Section 11 for further details on overseas disclosure.
How we ask depends on where you are visiting from, which we work out from your browser's time zone. In Europe and the United Kingdom (or where we cannot tell), no third-party analytics or marketing scripts are loaded until you accept them in the cookie banner. Elsewhere, including Australia, they are used from your first visit, a short notice tells you so, and you can switch them off at any time. The categories are:
- Necessary - required for the website to function. These are always active and do not include any tracking technologies.
- Analytics - used to understand how visitors interact with the website (Google Analytics).
- Marketing - used by LinkedIn and HubSpot to measure campaign effectiveness and support communications.
If you reject or switch off these categories, no third-party tracking scripts will be loaded. Our anonymous server-side analytics (described in Section 8.1) will continue to operate as they do not use cookies or collect personal information.
You can change your preferences at any time by clicking the "Manage Cookie Preferences" link in the footer of any page, which will reopen the cookie settings and allow you to update your choices. If you switch a category off, the page reloads without those scripts.
8.3 Free Tools and Verra Suggestions
Our free tools, such as the risk assessment template and the ITP template, save your work in your own browser. We do not receive or store the registers you create.
If you choose to switch on Verra suggestions in the risk tool, we collect your name, work email and company and add you to our early access list (and our customer relationship management platform). While suggestions are on, the risk and control text you type is sent through our servers to our AI classification provider, currently TypeSafe AI, so it can suggest common causes, consequences and controls. We do not store or log that text, and our provider does not use it to train AI models. Avoid entering personal information about individuals in risk descriptions. Suggestions stay on in that browser once switched on; to stop them, clear this site's data in your browser settings.
9. Data Hosting and Storage
Strataverra uses Australian-based cloud infrastructure where available. We implement reasonable technical and organisational measures to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.
Some services we use, including our customer relationship management platform (currently HubSpot), may store or process data in overseas locations including the United States. We are in the process of transitioning to Australian-hosted services where commercially practicable. See Section 11 for further details on overseas disclosure.
10. Disclosure of Personal Information
We may disclose personal information to:
- our employees, contractors and advisers who require access in connection with their duties;
- IT, hosting and software service providers who assist with the operation of our website and systems, including HubSpot;
- AI service providers that classify text you choose to submit through our free tools (currently TypeSafe AI);
- analytics and marketing service providers;
- professional advisers, including legal, accounting and auditing professionals; and
- government or regulatory authorities where required or authorised by law.
We do not sell personal information.
11. Overseas Disclosure
Some of the third-party service providers we use may store or process personal information in overseas locations, including the United States. This includes our customer relationship management platform and certain analytics and marketing tools.
Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient complies with the Australian Privacy Principles or is subject to a law or binding scheme substantially similar to the APPs, or we obtain your consent. Where the GDPR applies, we ensure appropriate safeguards are in place for any transfer of personal data outside the EEA.
12. Enterprise Client Data and Third-Party Information
When our platform becomes operational, enterprise clients may upload or input information, which may include personal information relating to their employees, contractors or other third parties.
In these circumstances, the client is responsible for:
- ensuring it has lawful authority to collect and provide that information;
- providing any required privacy notices to affected individuals; and
- complying with all applicable privacy laws.
Strataverra will process such information on behalf of the client as a service provider, in accordance with our contractual arrangements and applicable law.
13. Data Retention
We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, or as required by law. When personal information is no longer needed, we will take reasonable steps to securely delete or de-identify it.
If you registered your interest during our pre-launch phase and we have not been in contact within 24 months, we will securely delete your information unless you have opted in to continued communications.
14. Your Rights
Under the Privacy Act, you have the right to:
- request access to the personal information we hold about you;
- request correction of inaccurate, out-of-date, incomplete or misleading information; and
- make a complaint about our handling of your personal information.
Under the GDPR (where applicable), you may also have the right to:
- request erasure of your personal information;
- request restriction of processing;
- object to processing based on legitimate interests;
- request data portability; and
- lodge a complaint with a supervisory authority.
To exercise any of these rights, contact us at privacy@strataverra.com. We will respond within a reasonable timeframe and in accordance with applicable law.
15. Direct Marketing
We may send you marketing communications about Strataverra and our platform where you have provided your explicit consent through our website forms or where we are otherwise permitted to do so under the Spam Act 2003 (Cth) and applicable law.
Every marketing communication will include a clear and easy way to opt out. You may also opt out at any time by contacting us at privacy@strataverra.com.
16. Notifiable Data Breaches
In the event of an eligible data breach, we will comply with our obligations under the Notifiable Data Breaches scheme established by Part IIIC of the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.
Where the GDPR applies, we will also notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, where required.
17. Communications and Data Management Systems
Strataverra currently uses the following third-party platforms to manage communications and data:
- Microsoft 365 - for business communications and productivity;
- HubSpot - for customer relationship management, form submissions and marketing communications.
If additional platforms are implemented, this policy will be updated accordingly. A current list of sub-processors is available on request.
18. Children's Privacy
Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take reasonable steps to delete it promptly.
19. Complaints
If you believe your privacy has been breached, please contact us at privacy@strataverra.com. We will investigate your complaint and respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with:
- the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au; or
- where the GDPR applies, the relevant data protection supervisory authority in your jurisdiction.
20. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices, technology or legal requirements. The current version will always be available on our website. Where changes are material, we will take reasonable steps to notify you.
21. Contact Us
If you have any questions about this policy or how we handle personal information, please contact us:
Privacy Officer
Strataverra
Email: privacy@strataverra.com
Website: www.strataverra.com