01About this policy
This Privacy Policy explains how XTO Pty Ltd (XTO, we, us or our) handles personal information. We are committed to protecting your privacy and to handling personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs), whether or not we are strictly required to by law.
This policy applies to personal information collected through our website at www.xto.au (the Site), by email, and in the course of our business, including from clients, partners, suppliers and job applicants.
"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable.
02Personal information we collect
The personal information we collect depends on how you interact with us. It may include:
- Contact details: your name, email address, phone number, organisation and job title;
- Enquiry content: the content of messages you send us and any information you choose to include;
- Business information: details needed to provide and invoice services to our clients, or to engage suppliers and partners;
- Recruitment information: if you apply to work with us: your CV, work history, qualifications, referees and any other information you provide;
- Technical information: when you visit the Site, our hosting provider automatically records standard server log data such as your IP address, browser type, device information, the pages requested and the date and time of the request.
We do not intentionally collect sensitive information (such as health information or information about racial or ethnic origin). If we need to collect sensitive information (for example, in a recruitment process), we will only do so with your consent, or where required or authorised by law.
03How we collect it
We collect personal information:
- directly from you: when you email us, call us, meet with us, apply for a role or engage our services;
- through the Site's contact form: the form does not transmit or store anything on our servers. It prepares an email in your own email application, which you then choose to send to us. We receive the information only if and when you send that email;
- automatically: through server logs maintained by our hosting provider for security and operational purposes; and
- from third parties: such as recruiters, referees you nominate, your employer (if you are a client contact), or publicly available sources like professional networking sites, where it is unreasonable or impracticable to collect the information directly from you.
04How we use it
We collect, hold and use personal information for the following purposes:
- to respond to your enquiries and communicate with you;
- to provide, manage and improve our products and services, and to administer our relationship with clients, partners and suppliers;
- to assess applications for employment or engagement;
- to operate, maintain and secure the Site and our systems, including detecting and preventing fraud, abuse and security incidents;
- to comply with our legal and regulatory obligations; and
- with your consent, to send you updates about XTO. You can opt out of marketing communications at any time, and every such message will include a way to unsubscribe, consistent with the Spam Act 2003 (Cth).
We will not use personal information for a purpose other than the purpose for which it was collected, unless you consent, the secondary purpose is related and you would reasonably expect it, or it is otherwise permitted under the Privacy Act.
05Personal information and AI
We build AI systems, so we hold ourselves to a clear standard:
- We do not use personal information you send us through the Site or by email to train, fine-tune or evaluate AI models.
- Data provided by clients in the course of a project is handled strictly according to the relevant client agreement. We never use client data to train models for any other party, or for our own general-purpose models, without explicit written permission.
- Where we use third-party AI services to process personal information on behalf of a client, we select providers with appropriate contractual, security and privacy protections.
See our Responsible AI Policy for more detail.
06Who we disclose it to
We do not sell, rent or trade personal information. We may disclose personal information to:
- service providers who help us run our business (such as website hosting, email and productivity, cloud infrastructure, accounting and IT security providers), who are required to handle it only for the services they provide to us;
- our professional advisers, such as lawyers, accountants and auditors;
- a prospective purchaser or investor in connection with a sale, merger or restructure of our business, subject to confidentiality obligations; and
- government authorities, regulators, law enforcement or other parties where required or authorised by law.
07Overseas disclosure
Some of our service providers (for example, cloud, email and productivity providers) may store or process personal information outside Australia, including in the United States, the European Union, the United Kingdom and Singapore. The locations may change as our providers change.
Before disclosing personal information overseas, we take reasonable steps in accordance with APP 8 to ensure that the recipient handles it in a manner consistent with the APPs, for example through contractual privacy and security commitments. Where a client requires data to remain in Australia, we can design deployments that keep that data onshore.
09How we protect it
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our measures include encryption in transit, access controls based on least privilege, multi-factor authentication for business systems, and careful selection of service providers.
No method of transmission over the internet or electronic storage is completely secure. If we experience a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) where required under the Notifiable Data Breaches scheme.
10How long we keep it
We keep personal information only for as long as it is needed for the purposes described in this policy, or as required by law (for example, tax and corporate record-keeping obligations). When personal information is no longer needed, we take reasonable steps to securely destroy or de-identify it.
Unsuccessful job applications are generally retained for up to 12 months so we can consider you for future roles, unless you ask us to delete your information sooner.
11Anonymity and pseudonymity
Where lawful and practicable, you may deal with us anonymously or using a pseudonym, for example when making a general enquiry. However, we may not be able to provide services or respond fully if you do not identify yourself.
12Accessing and correcting your information
You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, email support@xto.au. We may need to verify your identity before responding.
We will respond within a reasonable period, and generally within 30 days. We do not charge for making a request. If we refuse access or correction, we will tell you why in writing (unless it would be unreasonable to do so) and how you can complain.
13Children
The Site and our services are intended for businesses and adults. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.
14Complaints
If you have a concern or complaint about how we have handled your personal information, please contact us first at support@xto.au with details of your complaint. We will acknowledge your complaint promptly, investigate it, and aim to respond in writing within 30 days.
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:
Office of the Australian Information Commissioner (OAIC)Website: www.oaic.gov.au
Phone: 1300 363 992
15Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in the law, our practices or our services. The current version will always be available on this page, with its effective date shown at the top.
16Contact us
For privacy questions, requests or complaints, contact our privacy team:
XTO Pty LtdEmail: support@xto.au
Website: www.xto.au