1. Definitions

1. “Customer” means an individual or organisation that holds an Account and uses the Platform, as defined in our Terms and Conditions.
2. “Customer Data” means data uploaded, imported, entered, or generated within a Customer’s Account, as defined in our Terms and Conditions.
3. “Personal Information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, as defined in the Privacy Act 1988 (Cth).
4. “Platform” means the PragmaCRM software, website, applications, APIs, integrations, and supporting infrastructure.
5. “we” / “us” / “our” / “LumexVentures” means LumexVentures Pty Ltd (ABN 81 698 002 256), trading as PragmaCRM.

2. Purpose of this Policy and Our Commitments

We are committed to protecting privacy. This Privacy Policy applies to the personal information, including Customer Data, that we collect and process in the course of our business. Our practices are designed to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We commit to:

1. Only collecting personal information in accordance with the APPs.
2. Being fair and open about the way we collect personal information.
3. Retaining personal information in a secure environment.
4. Binding our staff, contractors, and service providers to confidentiality obligations consistent with this Policy.
5. Not selling personal information, and not sharing it with third parties for their own marketing purposes.
6. Giving individuals access to the personal information we hold about them, and inviting them to tell us if it is incomplete, inaccurate, or out of date.
7. Correcting personal information we hold where reasonably possible, on request.
8. Explaining why we collect personal information, how we use it, and what happens if it isn’t provided.

3. Information We Process on Behalf of Customers

The Platform allows our Customers to manage their own business, sales, and marketing activities. When a Customer uses the Platform, they may enter or import personal information about their own leads, contacts, and other individuals (such as names, email addresses, phone numbers, and addresses) as part of their Customer Data.

We generally store and process this Customer Data on our servers as a service provider, based on the Customer’s instructions and in accordance with our Terms and Conditions. Each Customer is responsible for the personal information it processes using the Platform, and for complying with any law that requires giving notice, making disclosures, or obtaining consent before providing that personal information to us.

We do not share, sell, rent, or disclose Customer Data other than as described in this Policy. If you have questions about personal information a Customer has entered into the Platform about you, please contact that Customer directly.

4. Personal Information We Collect Directly

We collect personal information you provide directly to us, including when you register for an Account, express interest in the Platform, contact us, or otherwise interact with us. The personal information we collect may include your name, phone number, email address, mailing address, job title, username, contact preferences, and billing address.

Sensitive Information

Where necessary, with your consent or as otherwise permitted by law, we may collect sensitive information, primarily financial and billing information — for example, a billing address or billing contact for your Account. Where you provide payment information, we use it solely as authorised by you and in accordance with this Policy.

5. Information from Third-Party Integrations

You may connect third-party integrations to your Account, which may request permission to access data in, or send data to, your Account. It is your responsibility to review the permissions you grant to any third-party integration — granting access may allow that third party to view, store, or modify your Customer Data. We are not responsible for the practices of third-party integrations; please review their own privacy practices before connecting them.

Where we use Google APIs as part of an integration, our use and transfer of information received from those APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

6. Information from Social Media and Public Sources

Where you engage with us on marketplaces, review sites, or social media (such as Facebook, X, LinkedIn, or Instagram) — for example, by leaving feedback or a review — we may collect publicly available information from that interaction, including profile information, to respond to you, improve the Platform, and, where appropriate, republish your feedback with attribution. This information may remain with us even if you later delete it from the relevant platform. We may also update information about you from other publicly available sources.

7. Information We Collect Automatically

We automatically collect certain information when you visit or use the Platform. This information does not by itself reveal your identity, but may include your IP address, browser and device characteristics, operating system, language preferences, referring URLs, approximate location, and information about how you use the Platform. We use this information to maintain the security and operation of the Platform and for internal analytics and reporting, including:

• Log and usage data — service, diagnostic, and performance information recorded automatically when you access the Platform, such as timestamps, pages viewed, searches, and the features you use.
• Device data — information about the computer, phone, or tablet you use to access the Platform, such as device identifiers, browser type, hardware model, and operating system.
• Location data — approximate location inferred from your IP address, used to support security and service delivery.

8. How We Use Your Information

We use personal information for purposes including:

1. Creating and authenticating your Account, and keeping it in working order.
2. Providing and delivering the Platform to you.
3. Requesting feedback and contacting you about your use of the Platform.
4. Sending marketing and promotional communications, where you have not opted out.
5. Developing and displaying advertising relevant to your interests.
6. Protecting the Platform, including fraud monitoring and prevention.
7. Understanding usage trends so we can improve the Platform.
8. Assessing the effectiveness of our marketing activities.
9. Protecting the vital interests of an individual, such as preventing harm.

We rely on your consent, the steps necessary to provide the Platform under our Terms and Conditions, our legitimate business interests (balanced against your rights), and, where applicable, our legal obligations, as the basis for these uses. Where we rely on consent, you may withdraw it at any time by contacting us; this does not affect the lawfulness of processing carried out before you withdrew consent.

9. How We Share Your Information

Our staff may access Customer Data and other personal information as needed to perform their duties and provide the Platform. We may also disclose personal information to:

1. Contractors and service providers with whom we have a commercial relationship, where this relates to the services they provide to us or our Customers.
2. Any organisation, for any purpose, where you or the relevant Customer has given consent.
3. A person or authority, where this is required or authorised by law, including the Privacy Act.

We may also share personal information with vendors, consultants, and other service providers who perform services on our behalf, drawn from categories such as: cloud computing and hosting providers; data storage providers; payment processors; data analytics services; communication and collaboration tools; finance and accounting tools; sales and marketing tools; advertising and retargeting platforms; performance monitoring tools; and government entities, where required by law.

Business Transfers

We may share or transfer personal information in connection with, or during negotiation of, a merger, acquisition, financing, or sale of some or all of our business to another company.

Affiliates

We may share personal information with our affiliates — our parent company, subsidiaries, and companies under common control with us — who are required to honour this Policy.

10. Cookies and Tracking Technologies

We use cookies and similar technologies (such as web beacons and pixels) when you interact with the Platform or our website. Some of these help us maintain security, prevent errors, remember your preferences, and support core site functions. We also permit trusted third parties to use tracking technologies on our website for analytics and advertising, including to tailor advertising to your interests.

We use Google Analytics to understand how the Platform and our website are used, which may include remarketing and demographic reporting features. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout, and out of Google’s advertising features through Ads Settings; other opt-out mechanisms are available at optout.networkadvertising.org.

Most browsers accept cookies by default; you can usually configure your browser to remove or reject them, though this may affect some Platform features. We do not currently respond to browser “Do Not Track” signals, as no common industry standard for responding to them has been finalised.

11. How Long We Keep Your Information

We keep personal information only for as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by law (such as tax or accounting requirements). Where we no longer have an ongoing need to process personal information, we delete or de-identify it or, where that isn’t practicable (for example, because it sits in backup archives), we securely store it and restrict any further processing until deletion is possible.

For Customer Data specifically, this is consistent with our Terms and Conditions: following termination of a Customer’s Account, we retain Customer Data for up to 30 days to allow the Customer to request an export, and delete it, including backups, within 60 days of termination, unless we are required or permitted by law to retain it for longer.

12. How We Keep Your Information Safe

We maintain technical and organisational security measures designed to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure, including:

1. Storing personal information securely, at a level appropriate to its sensitivity.
2. Storing personal information only in jurisdictions with data protections at least equivalent to the Australian Privacy Act.
3. Transmitting personal information securely.
4. Hosting data with reputable cloud infrastructure providers using geo-redundant replication, and encrypting data in transit and at rest using industry-standard protocols.
5. Applying role-based access controls so only staff and contractors with a legitimate need can access personal information, with audit trails for sensitive data.
6. Training staff on privacy obligations, and maintaining processes to audit, investigate, and address inappropriate access.

No method of transmission or storage is 100% secure, and we cannot guarantee that unauthorised third parties will never defeat our safeguards. Transmission of personal information to and from the Platform is at your own risk.

13. Data Breach Notification

We are required to report an eligible data breach to the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme in the Privacy Act. Staff must promptly and confidentially report any suspected data breach internally so we can assess it and, where required, notify the OAIC and affected individuals without undue delay. Where a Customer’s Customer Data is affected, we will also notify the Customer in accordance with our Terms and Conditions.

14. Children and Minors

The Platform is not directed at, and we do not knowingly collect personal information from, individuals under 18 years of age, consistent with the eligibility requirement in our Terms and Conditions. If we learn that we have collected personal information from someone under 18, we will deactivate the associated Account and take reasonable steps to delete that information. If you believe we may hold information about a child under 18, please contact us at privacy@pragmacrm.io.

15. Your Privacy Rights

You may request access to, or correction of, the personal information we hold about you by contacting us at privacy@pragmacrm.io. We will respond in accordance with the Privacy Act.

You may opt out of marketing and promotional communications at any time using the unsubscribe link in those communications, or by contacting us; we may still send you service-related communications necessary for your Account. You may review, update, or close your Account, and request deletion of your personal information, by contacting us, subject to the retention exceptions described in clause 11.

If you believe we have handled your personal information in a way that breaches the Australian Privacy Principles, you may lodge a complaint with us at privacy@pragmacrm.io, or with the Office of the Australian Information Commissioner (oaic.gov.au).

16. Updates to this Policy

We may update this Privacy Policy from time to time, indicated by an updated “last updated” date at the top of this Policy. Where we make a material change, we will notify you by prominently posting a notice or contacting you directly. We encourage you to review this Policy periodically.

17. How to Contact Us

If you have a question, complaint, or request relating to this Policy or your personal information, please contact us at privacy@pragmacrm.io, or by post at LumexVentures Pty Ltd, Unit 6, 5 School Street, Mudgeeraba, Queensland, 4213, Australia.

If you make a complaint, we will respond in writing within 30 days, setting out any action we will take or, if we consider there has been no breach of the law, our reasons.