Privacy policy

ZENSMART™ PRIVACY POLICY

This policy explains how Pictureworks Group Pty Ltd ABN 28 119 011 933 trading as ZenSmart (“ZenSmart”, “we”, “us”, “our”) collects, uses, discloses and otherwise Processes Personal Information when you use our websites, the ZenSmart™ SaaS platform, mobile applications, and related services (together, the Services).

This Policy is designed to comply with the:

• Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs);
• EU & UK General Data Protection Regulation (GDPR / UK GDPR);
• California Consumer Privacy Act 2018 (CCPA) as amended by the California Privacy Rights Act 2020 (CPRA) (together, California Data Privacy Law or CDPA).

Where local law imposes stricter requirements than those set out in this Policy, we comply with the higher standard.

1. Definitions

Personal Information / Personal Data means information or an opinion about an identified or reasonably identifiable individual.

Processing has the meaning given in the GDPR and includes any operation performed on Personal Data.

Controller / Processor are used in the GDPR sense. For most website and marketing activities, ZenSmart acts as a Controller. When we host Customer data inside the

ZenSmart platform, we act as a Processor and our Data Processing Addendum (DPA) governs that Processing.

2. What Personal Information We Collect
We collect and Process the following categories of Personal Information:

1. Account & Identity Data – name, role, company, business contact details, profile photo, login credentials.
2. Usage & Log Data – IP address, device identifiers, browser type, activity logs, workflow metadata (timestamps, job IDs).
3. Billing & Transaction Data – billing contact, purchase history, payment details (processed by our PCI‑DSS compliant payment provider).
4. Marketing Data – newsletter preferences, survey responses, interactions with our emails.
5. Support Data – content of support tickets, call recordings, chat transcripts.

We do not intentionally collect special categories of Personal Data (GDPR Art 9) or children’s data (<16 years). If you believe we hold such data inadvertently, please contact us (see Section 13).

3.  How We Collect Personal Information

• Directly from you when you create an account, contact support, complete forms or upload content.
• Automatically via cookies and similar technologies (see Section 11).
• From third parties: identity providers (e.g., Google, Microsoft, Okta), analytics vendors, channel partners and public sources.

Where we rely on legitimate interests, we balance those interests against your privacy rights and interests.

4. Direct Marketing & Opt‑Outs

We only send electronic marketing with your consent or as otherwise permitted by law. You may opt‑out at any time via the unsubscribe link or by emailing privacy@zensmart.ai.

5. Disclosures to Third Parties

We disclose Personal Information only:

• To authorised Sub‑processors listed in Annex III of our DPA for hosting, support and email delivery;
• To professional advisers, auditors and insurers under confidentiality;
  When required by law or to respond to valid legal process;
• In connection with a business transfer (e.g., merger or acquisition) in accordance with APP 6.2, GDPR Art 6(1)(f) and CDPA §1798.140(t)(2)(D).
• We do not sell or “share” Personal Information as those terms are defined under the CPRA.

6. International Data Transfers

ZenSmart operates in Australia, the United States and the European Union. Where we transfer Personal Information across borders we ensure appropriate safeguards, such as:

• Standard Contractual Clauses (EU GDPR Art 46);
• UK International Data Transfer Addendum;
• Australian APP 8 reasonable steps assessment.

7. Security Measures

We maintain an ISO 27001‑aligned Information Security Management System that includes encryption in transit and at rest, MFA, network segmentation, 24/7 monitoring and regular penetration testing. Details are in Annex II of our DPA. In the event of a breach, notification will be provided within 72 hours.

8. Data Retention & Deletion

We retain Personal Information only as long as necessary for the purposes described in this Policy or as required by law. Personal Identifiable Information (PII) is by default hashed after 14 days unless directed otherwise by the Customer. Platform data is deleted within 30 days after subscription termination unless otherwise agreed. Back‑ups are purged within 90 days. Marketing contacts are removed 2 years after the last interaction.

9. Your Privacy Rights

9.1 Australian Privacy Act

• Access and correct Personal Information (APP 12 & 13).
• Complain to us and, if unresolved, to the OAIC.

9.2 GDPR / UK GDPR

• Right of access, rectification, erasure, restriction, portability, and objection.
• Right to withdraw consent at any time (does not affect prior Processing).
• Right to complain to a supervisory authority (e.g., OAIC, ICO, DPC).

9.3 California Residents (CCPA / CPRA)

• Right to know, correct, delete and obtain a copy of Personal Information.
• Right to opt‑out of sale or sharing of Personal Information (not applicable—see Section 6).
• Right to limit use of sensitive Personal Information (not collected).
  To exercise any right, email privacy@zensmart.ai. We will verify your identity before responding and acknowledge within 10 days (California) or 30 days (GDPR/APP).

10. Cookies & Analytics

We use strictly‑necessary cookies for authentication and security, and optional analytics cookies (e.g., Google Analytics) to improve our Services. You can manage cookie preferences via your browser or our cookie banner.

11. Children

The Services are not directed to children under 16. We do not knowingly collect such data. If you learn that a child has provided us Personal Data, please contact us so we can delete it.

12 Contact & Complaints
Privacy Officer
Pictureworks Group Pty Ltd
Level 2/696 Bourke Street, Melbourne VIC 3000
Email: privacy@zensmart.ai
Phone: +61 3 9999 9999

If you believe we have breached your privacy rights, please contact our Privacy Officer. We will respond within 30 days. If you are not satisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC), your local EU/UK data‑protection authority, or the California Privacy Protection Agency (CPPA).

13. Changes to This Policy

We may update this Policy from time to time. We will post the revised version on our website and, where material changes are made, notify registered users by email at least 30 days before the changes take effect.

14. Relation to Other Documents

This Privacy Policy applies when ZenSmart acts as a Controller.
When ZenSmart processes Customer Personal Data within the ZenSmart platform, the Data Processing Addendum (incorporated into our Subscription Agreement) governs such Processing.

This policy is effective as of 1 July 2025