Data processing terms

1. What these terms are for

Your business puts personal information about other people into GoSmoko: your customers, their tenants and site contacts, your suppliers' staff, and your crew. These terms set out how we handle that information for you. They form part of our Terms of service and apply automatically to every GoSmoko account.

In these terms, "customer data" means personal information your business, or GoSmoko acting for you, puts into your account.

2. Who is responsible for what

Your business decides what customer data to collect and why. We hold and process it only to provide GoSmoko to you. Under section 11 of the New Zealand Privacy Act 2020, information we hold solely as your agent is treated as held by your business, and we do not use or disclose it for our own purposes.

In Australian terms, you are the entity that collects and controls the customer data, and we handle it for you under contract, consistently with the Australian Privacy Principles.

For information about you and your crew as GoSmoko users (for example your sign-in and billing details), GOSMOKO LIMITED is responsible directly, under our Privacy policy.

3. Your responsibilities

• Have a lawful reason to collect and use the customer data you put into GoSmoko, and only put in what you need for the work.
• Tell your customers how you use their information, including that you use software providers like GoSmoko that may store it overseas. If you collect someone's details from another person, consider whether you need to let them know (Privacy Act 2020, principle 3A).
• Have the consent or relationship that the Unsolicited Electronic Messages Act 2007 (NZ) or the Spam Act 2003 (Australia) requires before you text or email someone through GoSmoko.
• Answer your customers' requests to see, correct or delete their information. GoSmoko gives you the tools to do it.
• Control who on your crew can sign in, and remove people promptly when they leave.

4. What we do with customer data

• We process it only to provide, secure and support GoSmoko for you, as described in our Privacy policy, and on your instructions. Your use of the app (adding a customer, sending an invoice, using an AI feature, connecting Xero) is your instruction.
• We do not sell it, use it to market to anyone, share it with other businesses on GoSmoko, or use it to train AI models.
• We tell you if we think an instruction from you breaks the law, and we do not have to follow it.
• If the law requires us to disclose customer data, we tell you first unless the law prevents us.

5. Our people

Only our staff and contractors who need it to run GoSmoko can access customer data. They are bound by confidentiality, and they only open a business's records to help that business, to fix a fault, or when the law requires it.

6. Security

We keep reasonable security safeguards in place to protect customer data against loss, unauthorised access, use, change or disclosure, as principle 5 of the Privacy Act 2020 and Australian Privacy Principle 11 require. Our Security page and Privacy policy describe them, including encryption in transit and at rest, per-business data separation, encrypted credentials, and encrypted daily backups.

7. Sub-processors

We use the sub-processors named on our Sub-processors page to help provide GoSmoko. Each is bound by a written contract with data protection obligations appropriate to what it does, and we remain responsible to you for their handling of customer data.

We update that page before a new sub-processor starts handling customer data. If you have a reasonable privacy objection to a new one, tell us; if we cannot address it, you may cancel and we will refund any prepaid fees for the period after the change.

8. Overseas transfers

Your account's database is held in Sydney, Australia. Some sub-processors handle data in other countries, mainly the United States. We only send customer data overseas where principle 12 of the Privacy Act 2020 allows, and we take reasonable steps under Australian Privacy Principle 8 so that overseas recipients handle it consistently with the Australian Privacy Principles.

9. Privacy breaches

If we become aware of a privacy breach affecting your customer data, we will tell your business without undue delay, and in any case within 72 hours of confirming it. We will tell you what happened, what information is involved, what we are doing about it, and what you may need to do.

We will work with you on any notification to the New Zealand Privacy Commissioner, the OAIC, or the people affected. Where the law requires us to notify directly, we will.

10. Helping you meet your obligations

We will give you reasonable help to answer a request from someone to see or correct their information, to respond to a regulator, or to carry out a privacy impact assessment. If someone contacts us directly about customer data in your account, we pass the request to you and do not answer it ourselves unless the law requires it.

On reasonable request, we will give you information that shows how we meet these terms, such as a summary of our security practices.

11. When you leave

You can export your data at any time while your account is open. When you delete your business, customer data is deleted from the live system immediately, and encrypted backups age out within 35 days. If your account closes another way, you have at least 30 days to export before we delete it.

We keep only what the law requires us to keep, such as our own billing records about your business.

12. Questions

If your own client asks how their information is handled, send them this page and our Sub-processors page. For anything else, email our privacy officer at privacy@gosmoko.com.