Privacy policy

Scope

What this policy covers

This policy describes the personal information Woosh Cloud Australia Pty Ltd (“Woosh”) collects when you use Woosh Cloud Australia Pty Ltd and the products and services reached through it, and how we handle it.

It applies to the information we collect through our websites, our applications and the merchant portal, and in email, SMS and other electronic communications sent through or in connection with them (together, the Services).

It does not apply to information you give directly to a third party we introduce you to or integrate with — a payment provider, a delivery platform, an accounting package. Those organisations have their own policies, and we encourage you to read them. It does apply to information those organisations send to us, such as the details of an order placed with a venue through a delivery platform.

By using the Services or registering an account you agree to this policy. If you do not provide the information we ask for, we may not be able to provide all of the Services to you.

Who holds your data

The data controller

Woosh Cloud Australia Pty Ltd is the controller of personal data provided to, collected by or for, or processed in connection with the Services. We are registered in New South Wales, Australia.

We store personal information in Australia, on servers in Australian data centres run by hosting providers we have contracts with. We do not store it outside Australia.

Your customers' data

When we process data on your behalf

Where you use Woosh to collect information about your own customers — for example a phone number captured at the terminal for a loyalty program — you are the controller of that information and Woosh is your processor. We handle it on your instructions, to provide the Services to you, and we do not sell it, mine it for our own marketing, or use it to contact your customers on our own behalf.

You remain responsible for having a lawful basis to collect it, and for telling your customers what you do with it.

Delivery platforms

Orders from Uber Eats and other delivery platforms

When a venue using Woosh connects a delivery platform such as Uber Eats, we receive the details of each order placed with that venue on the platform: the items ordered, the customer's name as the platform provides it (usually a first name and last initial), any notes on the order, the temporary contact number the platform issues for that order, and the courier's details where the venue needs them to hand the order over. We do not receive the customer's email address, payment details or platform account.

We use this information only to show the order to the venue, have it prepared and handed over, tell the platform the order's status, and keep the venue's sales records. We handle it on the venue's behalf and in line with the platform's terms.

We do not use delivery platform customers' details for marketing, add them to mailing or loyalty lists, contact them on our own behalf, sell or share them, or use them to develop or train artificial intelligence or machine learning models.

Order records are kept as part of the venue's financial records for as long as tax and corporations law requires. Technical logs of messages from the platform are deleted after 90 days. If a venue disconnects the platform, or our access to it ends, we stop collecting this information and delete the platform data we are not required by law to keep.

The platform remains responsible for its own customers' accounts. For questions about your account on the platform, contact the platform directly.

What we collect

The information we collect, and how

Information you give us

Account and business details — your name, work email, phone number, role, and the trading and legal details of the business you represent, including its ABN and addresses.
Venue and configuration data — the products, prices, staff records, floor plans and settings you enter to run the Services.
Billing details — the card used for subscription payments, and the bank account nominated for settlement. Card numbers are handled by PCI-compliant payment providers; we store a token, never the card number.
Communications — what you tell us in support requests, enquiries and surveys.

Information we collect automatically

Usage — which features you use, when, and for how long; searches you run; errors you hit.
Device and connection — IP address, browser and operating system, device type, and network information.
Cookies and similar technologies — see below.

Information from others — payment providers, credit and identity verification services used at onboarding, and partners who refer you to us.

Why we hold it

How we use the information

To provide, operate and support the Services, and to set up your venues, terminals and users.
To bill you, take payment, and recover unpaid amounts.
To respond to your enquiries and provide support.
To detect, investigate and prevent fraud, abuse and security incidents.
To meet our legal, tax and regulatory obligations, including those of payment providers and financial regulators.
To understand how the Services are used so we can improve them.
To tell you about changes to the Services, and about products and features that are relevant to your business. You can opt out of the marketing messages at any time; you cannot opt out of service and billing notices while you hold an account.

We do not sell your personal information, and we do not disclose it to advertising networks.

Who else sees it

How we share information

Payment providers — to process card payments, settle funds to you and meet their regulatory obligations.
Hosting providers — Vultr and CloudPepper, which run our servers in Australian data centres.
Delivery platforms — when a venue connects one, such as Uber Eats, we send it what it needs to complete that venue's orders: whether an order is accepted, when it is ready, and the venue's menu, prices and opening hours.
Other service providers — communications and support tools, bound by contract to keep it confidential and use it only to provide their service to us.
Professional advisers — lawyers, auditors and accountants, where they need it to advise us.
A buyer or successor — if the business is merged, restructured or sold, information held about users may be among the assets transferred.
Law enforcement and regulators — where we believe in good faith that it is reasonably necessary to comply with the law, respond to a subpoena or court order, or to protect the rights, property or safety of any person.
Anyone else you consent to.

Cookies

Cookies and similar technologies

A cookie is a small text file this site stores on your device so it can recognise you on the next page or the next visit. Similar technologies — local storage, pixels, tags — do much the same job.

What follows is our full cookie policy, shown here so you do not have to go looking for it. It is the same text you will find at /cookie-policy.

What we set

The cookies this site uses

Every cookie in the table is strictly necessary: the site cannot sign you in, keep you signed in, or remember your basic choices without them. They are set by us, not by a third party.

Cookie	What it does	Type	Life
`session_id`	Keeps you signed in and holds your session. Without it you cannot log in or stay logged in.	Essential	Session
`frontend_lang`	Remembers the language you are reading the site in.	Essential	Up to 1 year
`cids`	Remembers which company you are working in, where your login has access to more than one.	Essential	Up to 1 year
`website_cookies_bar`	Remembers that you have answered the cookie banner, so it stops asking.	Essential	Up to 1 year

Because these are strictly necessary, they are set whether or not you accept optional cookies. Blocking them in your browser will stop parts of the site working.

What we do not set

No advertising, no tracking across sites

We do not use advertising cookies. We do not sell your browsing data, we do not run retargeting, and we do not embed ad networks or social tracking pixels. Nothing on this site follows you to another one.

We currently run no analytics cookies either. If that changes, this page changes with it — it is generated from the site’s own settings rather than written by hand.

Your choices

Controlling cookies

We do not show a cookie banner, because the only cookies we set are the ones the site cannot work without. If we ever add optional cookies, a banner will appear and you will be asked first.

Every major browser lets you see the cookies a site has set, delete them, and block new ones. Look under Privacy or Site settings. You will need to do it on each browser and each device you use, and blocking the strictly necessary cookies above will break sign-in.

Elsewhere

Third parties and embedded content

Pages that embed something from another service — a video, a map, a payment form — let that service set its own cookies. We do not control those, and their own policies govern them.

When you pay through a Woosh product, the payment provider handles the card details and may set cookies for fraud prevention. That is part of how card payments are kept safe, and it happens on their systems, not ours.

Security

How we protect it

We use physical, electronic and procedural safeguards appropriate to the sensitivity of the information we hold, and we follow generally accepted industry standards to protect personal information in transit and at rest. Card data is handled by providers validated as PCI DSS compliant.

No system is impenetrable, and we cannot guarantee the security of information transmitted to us. You play a part too: do not share your password or API keys, and tell us immediately if you believe an account has been compromised. Instructions received with your credentials will be treated as yours.

If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and tell any affected partner, such as a delivery platform, promptly.

Your rights

Accessing, correcting and deleting

You can ask us for a copy of the personal information we hold about you, ask us to correct it if it is wrong, and ask us to delete it. Write to privacy@wooshcloud.com.au and we will respond within a reasonable time.

Those rights have limits: we may keep information where we are required to by law — tax and financial records in particular — where it relates to an actual or anticipated legal proceeding, or where a request is unreasonable or would affect another person's privacy. If we refuse, we will tell you why.

If you are unhappy with how we have handled your information or a request, you can complain to us first, and then to the Office of the Australian Information Commissioner at oaic.gov.au.

Retention

How long we keep it

We keep personal information for as long as your account is open, and afterwards for as long as we need it for the purposes described here or to meet a legal obligation. Financial records, including order and payment records, are kept for as long as tax and corporations law requires, generally five to seven years. When we no longer need information we delete it or de-identify it so it can no longer be linked to you.

Other

Age, third-party links and changes

Age. Woosh accounts are for people aged 18 and over acting for a business. Customers of the venues that use Woosh may be younger; their information is handled as described in this policy, on the venue's behalf.

Third-party links. The Services link to sites and tools we do not control. This policy does not cover them, and we are not responsible for their content or their privacy practices.

Changes. We may update this policy to reflect changes in the law, our practices or the Services. Each change is posted here with a new “last updated” date, and we will email account holders about significant changes before they take effect.

Contact

Talk to us about your information

Privacy questions, access and correction requests, and complaints go to our privacy contact at privacy@wooshcloud.com.au.

Postal: Woosh Cloud Australia Pty Ltd, 43 George Street, Parramatta NSW 2150.