Privacy Policy

1. Introduction

TorqueOS Pty Ltd (ABN [ABN to be inserted]) ("TorqueOS", "we", "us", or "our") operates the website torqueos.net and the TorqueOS cloud platform at app.torqueos.net (collectively, the "Services"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you access or use our Services.

We are committed to complying with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). By using our Services, you consent to the practices described in this Privacy Policy.

Our role. For personal information you upload about other people (such as your staff, drivers, and your own customers) that you record in the Platform ("Customer Data"), you are the organisation responsible for that information and we act as your service provider, processing it only on your instructions. For the account, billing, and security information we collect to run the Services, we act as the responsible entity. Our processing of Customer Data is governed by our Data Processing Agreement. A request from an individual to access or correct personal information held within a customer’s account should be directed to that customer, not to TorqueOS.

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, phone number, business name, ABN/ACN, and billing address when you sign up or subscribe to our Services.
• Fleet & workshop data: vehicle registrations, VINs, service histories, work orders, inspection records, and photographs uploaded to the platform.
• Payment information: credit or debit card details and billing information processed through our third-party payment processor (Stripe). We do not store your full card number on our servers.
• Communications: any messages, support tickets, or feedback you send us via email, phone, or in-platform messaging.
• Employee & contractor data: names, roles, and contact details of staff added to your account for workforce management.

2.2 Information Collected Automatically

• Device & browser data: IP address, browser type, operating system, screen resolution, and device identifiers.
• Usage data: pages visited, features used, click-stream data, date and time of access, referring URLs, and session duration.
• Cookies & similar technologies: we use cookies, local storage, and pixel tags to improve functionality, analyse usage, and personalise your experience. See our Cookie Policy (Section 8 below) for details.
• Location data: approximate geographic location derived from your IP address. We do not collect precise GPS data unless you explicitly enable location services for mobile inspection features.

2.3 Information from Third Parties

• Integration partners: if you connect third-party services (e.g. accounting software, telematics providers), we may receive data from those platforms in accordance with their privacy policies.
• Publicly available data: business registration details available from ASIC or state vehicle registries where necessary to verify account details.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the TorqueOS platform and Services.
• Process subscriptions, payments, and invoicing through our payment processor.
• Send transactional communications including service reminders, maintenance alerts, inspection due dates, and account notifications.
• Provide customer support, respond to enquiries, and troubleshoot issues.
• Improve our Services through analytics, usage trends, and feature utilisation data.
• Detect, prevent, and address security incidents, fraud, and technical issues.
• Send marketing communications (with your consent) about product updates, industry news, and promotions. You may opt out at any time.
• Comply with legal obligations, including tax and record-keeping requirements under Australian law.
• Enforce our Terms of Service and protect the rights, property, and safety of TorqueOS, our users, and the public.

4. Legal Basis for Processing

Under the APPs and, where applicable, the EU General Data Protection Regulation (GDPR), we process your personal information on the following bases:

• Contractual necessity: to perform our obligations under the subscription agreement between you and TorqueOS.
• Legitimate interests: to improve our Services, prevent fraud, and ensure platform security, balanced against your privacy rights.
• Consent: for marketing communications and non-essential cookies. You may withdraw consent at any time.
• Legal obligation: to comply with applicable laws, regulations, or court orders.

5. Disclosure of Information

We do not sell your personal information. We may share your information with the following categories of recipients:

• Service providers (sub-processors): trusted third parties who help us operate the Services, including cloud hosting and storage (Amazon Web Services, Sydney), payment processing (Stripe), transactional email (Resend), address lookup and analytics (Google), and ABN/business-name verification (Australian Business Register). These providers are contractually required to protect your data and to handle it consistently with the APPs. A current list of sub-processors is maintained in our Data Processing Agreement, and we will give at least 30 days’ notice before engaging a new sub-processor that handles Customer Data.
• Your organisation: if you use TorqueOS as part of a workshop or fleet account, account administrators and other Users in your account may access data within that organisation’s account according to the roles you assign.
• Fleet-workshop sharing: when you accept a link between a fleet operator and a workshop, certain Customer Data is shared between the two organisations so the workshop can service the fleet’s vehicles. The sharing is limited as follows:
  • A linked workshop can see, for the vehicles covered by the link: vehicle and asset details; service and maintenance history; work orders (including notes, labour time, parts, and photos); inspections and prestart checks; defects and their photos; quotes; fuel entries; odometer and engine-hour readings; the fleet’s business contact details; and the fleet’s staff user accounts (name, email, phone, and role).
  • A linked workshop cannot see the fleet’s parts inventory or stocktakes, its private templates, its sticker orders, its other workshop relationships, or any billing and subscription information. User passwords and security credentials are never shared.
  • If the link is cancelled, the workshop immediately loses access to any new data and retains read-only access only to records created during the period the link was active.
• Business transfers: in connection with a merger, acquisition, reorganisation, or sale of assets, your information may be transferred to the successor entity.
• Legal requirements: where required by law, regulation, subpoena, court order, or government request.
• Protection of rights: where necessary to protect the rights, property, or safety of TorqueOS, our users, or the public.

6. Data Storage & Security

Your data is stored on servers located in Australia (AWS ap-southeast-2 — Sydney). We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256) for all data.
• Role-based access controls for internal staff and customer accounts.
• Regular security audits and vulnerability assessments.
• Automated backups with point-in-time recovery.
• Multi-factor authentication available for all accounts.
• Incident response procedures to detect, contain, and notify affected parties of any data breach in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988.

If a data breach affects your Customer Data, we will notify you without undue delay and in any event within 72 hours of confirming the breach, with the information you need to meet your own obligations under the Notifiable Data Breaches scheme. See our Data Processing Agreement for details.

While we take reasonable steps to protect your personal information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as necessary to:

• Provide our Services and maintain your account.
• Comply with legal, tax, and accounting obligations (generally 7 years for financial records under Australian tax law).
• Resolve disputes and enforce our agreements.

When you close your account, we will delete or anonymise your personal information within 90 days, except where retention is required by law. Fleet and workshop operational data (e.g. service histories, inspection records) may be retained in anonymised form for industry benchmarking and analytics.

8. Cookies & Tracking Technologies

We use the following categories of cookies:

You can manage your cookie preferences at any time using the cookie settings banner or by adjusting your browser settings. Note that disabling certain cookies may affect the functionality of our Services.

9. Your Rights

Under the Privacy Act 1988 and, where applicable, the GDPR, you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request deletion of your personal information, subject to legal retention obligations.
• Data portability: request your data in a structured, machine-readable format.
• Restriction: request that we limit processing of your data in certain circumstances.
• Objection: object to processing based on legitimate interests or direct marketing.
• Withdraw consent: withdraw consent for marketing communications or non-essential cookies at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@torqueos.net. We will respond within 30 days.

10. International Data Transfers

Our primary data storage is in Australia. However, some of our service providers (e.g. email delivery, support tooling) may process data in jurisdictions outside Australia. Where this occurs, we ensure appropriate safeguards are in place, including:

• Contractual obligations requiring the recipient to comply with the APPs or an equivalent standard.
• Standard Contractual Clauses (SCCs) where data is transferred to the EU/EEA or UK.
• Assessment of the recipient country’s data protection laws.

11. Children's Privacy

TorqueOS is a business-to-business platform and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly.

12. Third-Party Links

Our Services may contain links to third-party websites or integrations. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policy of any third-party service you interact with.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on our website with a revised "Last updated" date and, where appropriate, by email or in-platform notification. Your continued use of the Services after such changes constitutes acceptance of the updated policy.

14. Complaints

If you believe we have breached the APPs or mishandled your personal information, you may lodge a complaint with us at privacy@torqueos.net. We will investigate and respond within 30 days.

If you are not satisfied with our response, you have the right to complain to the Office of the Australian Information Commissioner (OAIC).

15. Contact Us

For privacy-related enquiries, please contact us: