Privacy Policy

1. Who this policy covers

This policy applies to Local Technology Partners Pty Ltd ABN 66 684 267 909, trading as Local Tech Partners, referred to here as "we", "us" and "our". It covers this website at localtechpartners.com.au, our demonstration environment, and Localtech Core, the local government ERP platform we supply to councils.

We handle personal information in two distinct roles, and the difference matters because it changes who is accountable for what:

• As the entity responsible for our own website and business records. Here we decide what is collected and why.
• As a contracted service provider to a council. When we host or process information inside a council's Localtech Core environment, the council remains the agency accountable for that information. We act on the council's instructions under our agreement with them, and that agreement prevails over this policy.

2. The privacy framework we work within

We handle personal information consistently with the Australian Privacy Principles in Schedule 1 of the Privacy Act 1988 (Cth), and with the Information Privacy Principles in Schedule 3 of the Information Privacy Act 2009 (Qld), which apply to Queensland local governments.

Section 35 of the Information Privacy Act 2009 (Qld) requires a Queensland agency to bind a contracted service provider to the same privacy obligations the agency carries. We accept that binding in our council agreements. Where a council's agreement imposes a stricter standard than this policy, the agreement applies.

We also work within the Right to Information Act 2009 (Qld) and the Public Records Act 2023 (Qld) as they affect information we hold on a council's behalf, including supporting a council to meet its own access, amendment and records-retention obligations.

3. What we collect on this website

We keep website collection deliberately small. We do not require an account to read anything here.

When you use the contact form

• Your name
• Your email address
• The council or organisation you are contacting us from
• The subject and enquiry category you select
• The message you write

When you subscribe to updates

• Your name
• Your email address

Automatically, when you visit

• Standard web server information, including IP address, browser type, the pages requested and the time of the request.
• Information collected through Google Tag Manager, which we use to load analytics tags. See section 5.

We do not collect sensitive information as defined in section 6 of the Privacy Act through this website, and we ask you not to include it in a contact form message. We do not use this website to collect credit card or payment details.

4. Why we collect it, and what we do with it

We collect the information above so that we can respond to you and run the business. Specifically:

• To answer an enquiry, arrange a briefing or provide a demonstration.
• To send updates you have asked to receive, and to stop sending them when you opt out.
• To maintain our own business and account records.
• To understand which pages are read, so we can improve them.
• To meet a legal obligation, or to establish or defend a legal claim.

We do not sell personal information. We do not disclose it to third parties for their own marketing. We do not use it to build profiles for advertising, and we do not make automated decisions about you that produce a legal effect.

5. Cookies and analytics

This website loads Google Tag Manager, container GTM-PF6BJS3C. Tag Manager itself is a delivery mechanism; the tags it loads may set cookies and send usage information to Google, including in countries outside Australia.

You can block or delete cookies through your browser settings, and you can install Google's opt-out browser add-on. Blocking cookies will not stop you reading this site or using the contact form.

We do not use cookies to identify individual visitors, and we do not run advertising or cross-site tracking pixels on this website.

6. Who we share information with

We use a small number of suppliers to operate the website and the platform. Each is engaged under terms that require them to protect the information they handle, and each is assessed under our supplier security procedure before use.

• Amazon Web Services — hosting, object storage and outbound email (Simple Email Service), in the Asia Pacific (Sydney) region.
• Cloudflare — DNS and object storage.
• GitHub — source code and continuous integration. Production personal information is not stored here.
• Google — Tag Manager and the analytics tags it loads.
• Employment Hero — payroll processing, where a council uses the payroll integration.

We may also disclose information where we are required or authorised to do so by law, including to a court, tribunal or regulator.

7. Where information is held

Website enquiry data and council production data are hosted in Australia, in the Amazon Web Services Asia Pacific (Sydney) region.

Two exceptions are worth stating plainly rather than burying. Google Tag Manager and its analytics tags may process usage information outside Australia. Cloudflare operates a global network and may route or cache request data outside Australia. Neither handles council financial records.

Where a council requires data residency commitments beyond this, we can address them contractually. Ask us before you assume.

8. How we protect information

We operate an information security management system aligned to ISO/IEC 27001:2022. We are not currently ISO/IEC 27001 certified, and we will say so plainly rather than imply otherwise. Certification is a separate exercise and we will state the position honestly if you ask where it stands.

Controls we operate

• Transport encryption for data in transit, and encryption at rest for stored data.
• Role-based access control, with access granted on least privilege and reviewed periodically.
• Single-tenant deployment per council, so one council's environment is separated from another's.
• Logging and monitoring of security-relevant events.
• Documented change and release procedures, with peer review before production deployment.
• Backups with tested restoration.

Vulnerability handling

We assess reported and detected vulnerabilities by severity and remediate against defined targets: critical within 48 hours, high within 14 days, medium within 30 days, and low within 90 days.

If you believe you have found a security vulnerability in this website or in Localtech Core, please report it to admin@localtechpartners.com.au rather than disclosing it publicly. We will acknowledge your report and keep you informed. We will not pursue action against a researcher who reports in good faith, acts proportionately, and does not access, alter or exfiltrate other people's data.

No system is completely secure. We do not claim that ours is, and any statement that a system cannot be breached should be treated with suspicion.

9. If something goes wrong

We maintain a documented data breach response procedure that follows the Office of the Australian Information Commissioner's four-stage model: contain, assess, notify, review.

• We contain the incident and begin assessment immediately on becoming aware of it.
• Where a breach involves information we hold for a council, we notify that council promptly so it can meet its own obligations, and we support its assessment.
• Where the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act applies to us, we notify affected individuals and the Information Commissioner as required.
• We conduct a review after every incident and act on what it finds.

10. How long we keep it

We keep website enquiry correspondence for as long as needed to deal with the enquiry and to maintain a record of our dealings with you, then destroy or de-identify it. Newsletter subscriptions are kept until you unsubscribe.

Information held inside a council's Localtech Core environment is retained according to that council's records-retention obligations, including under the Public Records Act 2023 (Qld), and according to our agreement with the council. We do not unilaterally destroy a council's records.

On termination of a council agreement we return or securely destroy council data as that agreement directs.

11. Accessing and correcting your information

You may ask us what personal information we hold about you, ask us to correct it if it is wrong, and ask us to delete it where we are not required to keep it. Write to admin@localtechpartners.com.au.

We will respond within 30 days. We may need to verify your identity first. If we refuse a request we will tell you why in writing, and explain how to complain.

If your request concerns information held inside a council's environment, the council is the right place to direct it, because the council controls that information. Tell us and we will point you to the right contact and assist the council in responding.

12. Marketing and unsubscribing

We only send commercial electronic messages where you have asked to receive them or where consent can properly be inferred from an existing business relationship, consistent with the Spam Act 2003 (Cth).

Every such message identifies us and carries a working unsubscribe facility. We action unsubscribe requests promptly, and in any case within five working days.

13. Complaints

If you think we have mishandled your personal information, tell us first at admin@localtechpartners.com.au. We will acknowledge your complaint within five working days and give you a written response within 30 days.

If you are not satisfied with our response, you can escalate. For matters under the Commonwealth Privacy Act, contact the Office of the Australian Information Commissioner at oaic.gov.au. For matters involving a Queensland council's information, contact the Office of the Information Commissioner Queensland at oic.qld.gov.au.

14. Changes to this policy

We may update this policy. When we do we will change the date shown at the top of this page. Where a change materially affects how we handle personal information we hold for a council, we will notify that council directly rather than rely on you noticing a changed date.

15. Contact us

Privacy enquiries: admin@localtechpartners.com.au. Our privacy officer can be reached at that address. Registered entity: Local Technology Partners Pty Ltd, ABN 66 684 267 909. Postal address: Brisbane, Queensland 4000, Australia.