Privacy Policy

1.1 About this Policy

OZIBUS PTY LTD (ABN 29 680 267 083) ("Ozibus", "we", "us" or "our") provides business communications and customer-engagement services including SMS, email delivery, WhatsApp Business messaging, webchat, broadcasts, scheduling, verification and OTP services, contacts and audiences, analytics, APIs, webhooks and related services.

This Privacy Policy explains how Ozibus collects, holds, uses, discloses and protects personal information.

Where applicable, we manage personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Other privacy, health-information, communications or data-protection laws may also apply depending on the information, customer, service and jurisdiction involved.

1.2 Our role

Ozibus processes two broad categories of information:

Ozibus account information

Information Ozibus collects directly for its own business purposes, including account administration, billing, security, support and service operation.

Customer Data

Information submitted to or processed through Ozibus by a business customer, including information about that customer's customers, users, employees, recipients or other contacts.

For Customer Data, the Ozibus customer generally determines why the information is collected and how it is used. Customers are responsible for ensuring they have authority to provide that information to Ozibus and to communicate with their recipients.

Ozibus processes Customer Data to provide the contracted Services and for limited security, compliance, fraud-prevention and operational purposes.

1.3 Information we may collect

Depending on the Services used, we may collect or process:

• names, usernames and organisation details;
• email addresses and telephone numbers;
• billing, Ozibus Account Balance, top-up and transaction information;
• customer and recipient contact records;
• SMS, email, WhatsApp Business, webchat and broadcast content;
• chat transcripts and attachments;
• booking and scheduling information;
• sender identities, WhatsApp Business account identifiers, messaging profiles and verified domains;
• marketing consent, opt-in, opt-out and suppression records;
• OTP and verification events;
• IP addresses and device/browser information;
• API requests, webhook events and integration logs;
• delivery events, timestamps, bounce information, WhatsApp status events and carrier/provider responses;
• email open and link interaction information where tracking is enabled;
• browser push notification identifiers;
• support communications;
• security, fraud and abuse signals; and
• other information a customer chooses to submit through the Services.

Customers should not provide sensitive information unless doing so is authorised, necessary for their use of Ozibus, and permitted under their agreement with Ozibus and applicable law.

1.4 Health and sensitive information

Some Ozibus services, including scheduling, messaging and customer chat, may be used by organisations operating in healthcare, disability, aged-care or similar sectors.

Health or other sensitive information must only be processed through Ozibus where the customer has lawful authority to process that information and the relevant Ozibus service and contractual arrangements permit it.

Additional terms may apply through the Ozibus Health & Sensitive Data Addendum.

1.5 How information is collected

Information may be collected:

• directly from account holders and users;
• when a customer uploads or submits information through Ozibus;
• through APIs, SDKs, webhooks and widgets;
• through SMS, email, WhatsApp Business, chat, booking and broadcast activity;
• automatically through security and operational logs;
• from Stripe for payments, Twilio for SMS and WhatsApp communications, Namecheap-hosted private email infrastructure for email services, and other telecommunications, hosting or service providers; and
• when someone contacts Ozibus for sales, support, privacy or other enquiries.

1.6 How we use information

We may use personal information to:

• provide and operate the Services;
• authenticate accounts;
• route and deliver communications;
• manage bookings and customer interactions;
• provide reporting and analytics;
• provide customer support;
• process Stripe payments, top-ups, invoices, refunds, transaction reconciliation and Ozibus Account Balance administration;
• maintain consent and suppression records;
• secure accounts and infrastructure;
• detect spam, fraud, abuse and misuse;
• investigate incidents;
• comply with legal and regulatory obligations;
• improve reliability and performance; and
• communicate with customers about their accounts and Services.

We do not sell Customer Data to data brokers or advertisers.

1.7 Marketing communications

Ozibus will send its own commercial marketing communications only where permitted by applicable law.

Customers using Ozibus to send commercial electronic messages are responsible for ensuring they have the required consent or other lawful authority to contact recipients.

Commercial communications must accurately identify the sender and contain any unsubscribe or opt-out mechanism required by applicable law.

Ozibus may maintain suppression information after an unsubscribe request where this is reasonably necessary to prevent further prohibited communications.

Where a customer uses WhatsApp Business messaging, the customer is responsible for obtaining and recording any recipient permission required by law and by the WhatsApp Business Messaging Policy before initiating communications.

WhatsApp recipients must be able to stop or opt out of further communications as required by applicable law and platform rules. A request to stop WhatsApp communications may be made on WhatsApp or through another channel and must be honoured where applicable.

For Australian recipients, commercial instant messages may be regulated as commercial electronic messages under the Spam Act 2003 (Cth). Customers remain responsible for consent, sender identification and a compliant unsubscribe or opt-out process.

1.8 Overseas hosting and processing

Ozibus is an Australian company, but its Services are not currently hosted exclusively in Australia.

Ozibus's primary hosting infrastructure is located in Phoenix, Arizona, United States.

As a result, personal information and Customer Data processed through Ozibus may be stored or processed in the United States.

Ozibus currently relies on Twilio as an underlying provider for SMS and WhatsApp Business messaging, Namecheap-hosted private email infrastructure for Ozibus email delivery, Stripe for payment processing, telecommunications carriers, Meta/WhatsApp infrastructure and other subprocessors. Depending on the service, provider configuration and recipient destination, information may be processed or transmitted in Australia, the United States and other countries involved in delivering the requested communication or service.

Where applicable, Ozibus takes reasonable steps to ensure overseas recipients handle personal information consistently with applicable Australian privacy requirements. These measures may include contractual confidentiality and data-protection requirements, security reviews, access controls and provider due diligence.

Foreign service providers may also be subject to lawful disclosure obligations under the laws applicable in their jurisdiction.

Current categories and locations of material subprocessors are published in the Ozibus Data Hosting & Subprocessor Notice.

Communications processing: Ozibus uses Twilio to support SMS delivery and the connection of Ozibus WhatsApp Business messaging to the WhatsApp channel. SMS and WhatsApp processing may involve telephone numbers, sender and recipient identifiers, message content and media, templates, delivery/status metadata, account or business-profile information, routing data and security or abuse signals. Twilio processing is not represented as occurring only in Australia; the applicable location depends on the service and regional configuration, and telecommunications or Meta/WhatsApp infrastructure may involve additional countries.

Email processing: Ozibus uses a private email service hosted through Namecheap for Ozibus email delivery. Email processing may involve sender and recipient email addresses, message content and attachments, message headers, authentication information, delivery and bounce metadata, and security or abuse signals. Namecheap-supported processing may occur outside Australia depending on the configured private email service and supporting infrastructure.

Payment processing: Ozibus uses Stripe as its payment processor for customer top-ups and other approved payments. Depending on the payment method and Stripe service used, Stripe may collect and process payment credentials, billing details, transaction information, fraud and risk signals, refund information and related payment records. Stripe may process information in Australia and other countries in accordance with its applicable privacy and data-transfer arrangements.

1.9 Security

Ozibus uses administrative, technical and organisational controls designed to protect information against misuse, interference, loss, unauthorised access, modification and disclosure.

Depending on the system, controls may include:

• encryption of network connections;
• encryption at rest for designated systems;
• authentication and access controls;
• role-based permissions;
• secrets and API-key controls;
• logging and monitoring;
• rate limiting;
• abuse and fraud controls;
• backups and recovery procedures;
• vulnerability management; and
• incident-response procedures.

No internet-based service can guarantee absolute security.

Ozibus does not represent that ordinary SMS communications are end-to-end encrypted.

WhatsApp applies its own security and encryption controls to the WhatsApp service. Ozibus does not represent that Customer Data remains end-to-end encrypted after it is received, processed, logged, stored or otherwise handled by Ozibus, the customer, Meta/WhatsApp or another authorised provider outside the protected WhatsApp message transport.

Customers should not use WhatsApp or any other messaging channel to transmit information that is prohibited by applicable law, the applicable channel provider rules or the relevant Ozibus service terms.

1.10 Data retention

Ozibus retains information only for as long as reasonably necessary for the relevant purpose, contractual requirements, security, dispute management or applicable legal obligations.

Retention periods vary by service, account and record type.

Message content may be retained for the period associated with the applicable service or package.

Operational metadata may be retained for longer periods where necessary for billing, deliverability, security, fraud detection, legal compliance or dispute resolution.

Financial and corporate records may be retained for periods required under applicable law.

Suppression records may be retained after other information is deleted where necessary to honour opt-out requests.

When information is no longer required, Ozibus will take reasonable steps to delete or de-identify it, subject to legal and technical requirements.

1.11 Access and correction

Individuals may request access to personal information about them held by Ozibus or request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests may be sent to privacy@ozibus.com.au.

We may need to verify the identity of the requester before providing information.

Where the information is Customer Data controlled by an Ozibus customer, we may refer the request to that customer or assist the customer in responding.

1.12 Privacy complaints

Privacy complaints should be sent to privacy@ozibus.com.au and include enough information for us to understand and investigate the concern.

Ozibus will:

acknowledge the complaint;

investigate the circumstances;

request additional information where reasonably necessary; and

provide a response within a reasonable period.

We aim to respond to privacy complaints within 30 days where practicable.

Where the Privacy Act applies, an individual who is dissatisfied with our response may have the right to complain to the Office of the Australian Information Commissioner.

Other regulators may have jurisdiction depending on the type of information involved.

1.13 Data breaches

Ozibus maintains an incident-response process.

Where the Notifiable Data Breaches scheme or another applicable notification regime applies, Ozibus will assess suspected breaches and make required notifications where the relevant legal threshold is met.

Customers will be notified of confirmed incidents affecting their Customer Data where required by law or contract.

1.14 Cookies and tracking

The Ozibus websites and applications may use essential cookies and similar technologies required for authentication, security, preferences and operation.

Analytics technologies may also be used to understand service performance and website usage.

Additional information is contained in the Ozibus Cookie & Tracking Notice.

1.15 AI and automated systems

Some Ozibus features may use automated tools for functions such as abuse prevention, fraud detection, risk signals, routing, analytics or AI-assisted content creation.

Ozibus will maintain appropriate human oversight and transparency appropriate to the function involved.

Where applicable law requires specific disclosure about automated decisions that substantially and directly affect an individual's rights or interests, Ozibus will provide the required information about those decisions and the personal information used.

1.16 Children

Ozibus's business Services are not directed primarily to children.

Customer Data may nevertheless relate to children where an Ozibus customer lawfully provides services to them.

Customers are responsible for obtaining any consent or authority required to process children's information through Ozibus.

1.17 Changes

We may update this Privacy Policy to reflect changes to law, technology, our Services or our data-handling practices.

Material changes will be communicated where reasonably appropriate.