Privacy Policy

ACXPA's main privacy policy (acxpa.com.au/privacy-policy) covers ACXPA membership and our other websites. If you're an ACXPA member, both policies may apply to you.

1. What we collect

If you search the Directory (buyers): you don't need an account to search. We count page views, website clicks, phone-number reveals and downloads for each supplier, but these counts don't identify you.

If you contact a supplier through the Directory: your name, email address, and any company name, phone number and message you choose to add. We also keep a scrambled (hashed) version of your IP address and your browser type, to stop spam.

If you manage a supplier profile: your name and email address, a password if you choose to set one (stored scrambled, never readable), when you sign in, your time zone (from your browser, so reminders arrive in your morning), and the company details you publish.

If you ask to claim a profile or list a business, we also collect your job title, your message and the IP address you sent it from.

If you buy a paid listing: your business's billing name, address, country, ABN (for Australian businesses) and billing email. Card payments are handled by Stripe. We never see or store your card number.

If you upload a certificate: the file you upload and its expiry date.

If you sign in with your ACXPA membership: your ACXPA member ID, name and email address, sent to us by acxpa.com.au.

Cookies and analytics: we use cookies to keep you signed in and to protect forms against misuse. We also use Google Analytics 4 to understand how the Directory is used, such as which pages are viewed and how visitors arrive. It sets its own cookies and doesn't identify you to us. We've turned off Google's advertising features for the Directory. We don't use advertising cookies.

If you're in the EU, the EEA or Switzerland, Google Analytics only runs if you agree to it. Wherever you are, you can turn it off or on at any time with Cookie settings at the bottom of every page.

2. How we use it

• To pass your enquiry to the supplier you contacted.
• To check enquiries, claims and certificates before they're sent or published.
• To sign you in, and to show your company's profile and statistics.
• To take payment for paid listings and send receipts, tax invoices and renewal reminders.
• To send service emails: sign-in links, claim decisions, yearly reminders to confirm your details, and certificate expiry reminders.
• To understand how the Directory is used, so we can improve it.
• To prevent spam, fraud and misuse.

We don't use your information for marketing unless you've agreed to it separately.

3. Who we share it with

• The supplier you contact. When you send an enquiry, we send your details and message to that supplier, after our team checks it isn't spam. The supplier then handles your information under its own privacy policy.
• The public. Information a supplier publishes on its profile is public. Don't include personal details in a profile you don't want published.
• Our service providers: our hosting provider, VentraIP (Australia); our email provider, SendLayer (USA); Stripe (payments); and Google (Google Analytics).
• Authorities, where the law requires it.

We don't sell personal information.

4. Overseas disclosure

Some of our providers store or process information outside Australia, mainly in the USA. Before we use a provider, we take reasonable steps to make sure it protects personal information to a standard similar to the Australian Privacy Principles.

5. How long we keep it

• Enquiries: 1 year, then deleted.
• Supplier accounts and profiles: while the profile is listed, then 1 year.
• Certificates: until replaced or removed, or the profile is removed.
• Payment records: as long as tax law requires.
• Statistics: kept as counts that don't identify anyone.

6. Your rights

You can ask to see or correct the personal information we hold about you, or to have it deleted. Email directory@acxpa.com.au. We'll respond within 30 days.

Suppliers can update or remove most of their information themselves in their account.

7. If you live outside Australia

We're based in Australia and serve buyers and suppliers worldwide. If privacy laws such as the EU or UK GDPR apply to you, you may also have the right to object to or restrict how we use your information, and to receive a copy in a portable format.

We rely on these legal bases: performing our service when you ask us to (enquiries, sign-in, profiles, paid listings); our legitimate interests in running a trustworthy directory (spam checks, statistics, analytics); and meeting legal obligations.

8. Security

We store information on secured servers. Sign-in links work once and expire quickly, certificate files are private, and staff access is limited to what's needed.

9. Complaints and contact

Email directory@acxpa.com.au. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), or to the privacy regulator where you live.

10. Changes

We may update this policy. We'll post the new version here with its date, and tell supplier account holders about significant changes by email.

See also our Supplier Listing Terms.