Privacy Policy

Version 1.0 (1 July 2020)

This document outlines how Visual Management Systems Pty Ltd, headquartered at 26/50 Bourke Street, Melbourne, Australia (ABN 39 639 720 148) and affiliates (hereon referred to as “VMS”), handles your data, be it personal or other information. As far as possible, we’ve used plain English to explain how we respect your privacy and why you should trust us with your data.

This Privacy Policy applies to all products, services and websites provided by VMS (collectively referred to as the “VMS Service”), except where otherwise noted. If any services have supplementary privacy statements, we’ll explain in more detail our specific privacy practices in relation to these services.

Firstly, our Service provides a platform and set of tools that enables people, companies and organisations (“app creators”) to create data-driven business apps for mobile and desktop devices. These apps are delivered to the second group, who interact with, and submit data through, the provided apps (“app users”). VMS receives and handles information differently for app creators and app users, so we have split this Privacy Policy into two dedicated sections, one for each group.

SECTION 1: PRIVACY FOR APP CREATORS

Our approach to your data

Your data is yours. VMS regards all content that you create within your account on the VMS Service (forms, data sources, tasks, user accounts, email addresses etc.) as being your private property, owned wholly by you. VMS does not sell your content or data to anyone, and we only process and make your data available as needed to provide the VMS Service, with the exception of a limited set of circumstances (e.g. VMS is compelled by a subpoena, or if you’ve given us permission to do so).

Your data hosting is based on your specified country at account signup. The VMS Platform is hosted on Microsoft’s Azure cloud platform in 3 separate regions (“nodes”) across the world – specifically USA, West Europe and Australia. Customers that identify themselves as being located within Europe, Middle East and Africa are hosted within our West Europe (Amsterdam & Dublin) data centres. Similarly North and South American customers are hosted within our USA data centres, while East Asia and Oceania customers are hosted in our Australia East data centres. Once your account is provisioned on one of these nodes, there is no transfer or cross-population of your data to other nodes.

So if, for example, your account is created on our West Europe node, then that is the only place your data will ever be hosted by us.

VMS is committed to processing and storing your data securely. See our security measures webpage for more information.

Information that VMS collects

VMS collects information relating to you and your use of the VMS Service from a variety of sources which are listed below, along with details of how we use this information.

Information we collect directly from you

Registration information. You need to create a VMS account before you can build apps on the VMS Service. Our account signup collects your name, email address, password, phone number, company name, country and time zone.

Billing information. If you make a payment to VMS, we require that you provide your billing details, including name, address, email address and financial information corresponding to your selected method of payment (e.g. a credit card number and expiration date). If you provide a billing address, we will regard that as the location of the account holder. VMS does not store or log any sensitive cardholder data provided by you or your app users. We use a PCI Level 1 compliant credit card processor which securely stores all card details and processes card payments.

Account settings. You can set various preferences and personal details within the VMS Service. For example, your default language, time zone and other meta-data values can be specified within the Edit User and Organisation Setup pages of our backend web portal.

App data. We store the data you and your app users upload, import and otherwise submit to us.

Other data you intentionally share. We may store or collect your personal information or data if you explicitly send it to us for specified purposes. For example, if you give us a customer testimonial or participate in a VMS sponsored marketing event.

We don’t share, sell or use your app users’ information. VMS will not contact your app users via email or other means unless you specifically request us to do so. We will not sell or make available your app users’ contact or other information to any third parties, aside from what is necessary to provide the VMS Service (e.g. emails that you’ve configured are sent through our email delivery provider).

Information we collect indirectly or passively

Usage data. Like most software services today, VMS collects usage data about you whenever you interact with our services. This can include which VMS areas/pages you visit, what you click on, when you performed those actions, and so on. Additionally our servers may keep short-term log files that record data each time a device accesses the VMS Service. These log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system versions, and timestamps.

Device data. VMS collects data from the device you use to access our services, such as your IP address, operating system version, device manufacturer and model, and browser type. We may also infer your geographic location based on your IP address.

Referral data. If you arrive at a VMS website from an external source (such as a link on another website or in an email), VMS records information about the source that referred you to us.

Information from third parties. VMS may collect your personal information or data from third parties, if you have given permission to those third parties to share your information.

Information from page tags. VMS uses third-party tracking services that employ cookies and page tags (also known as web beacons) to collect aggregated and anonymized data about visitors to our websites. This data includes usage and user statistics. Emails sent by VMS may include page tags that allow us to collect information about who opened those emails and clicked on links in them. We do this to measure the performance of our email messaging and to learn how to improve email deliverability and open rates.

How VMS uses collected information

To VMS, your app data is private and owned by you. VMS does not use your app data other than as described in this Privacy Policy unless we have your written consent. We do not sell or make available your app data to third parties, beyond what is necessary to provide the VMS Service, without your permission.

The specific ways that VMS uses collected information are listed below. See the next part of this Privacy Policy to understand how your information may be shared.

To provide the VMS Service to you

Customer support is the most common reason for us accessing your data, since often VMS will need to view your account, data and app designs in order to provide training, advice and troubleshooting.

A number of features of the VMS Service require use of your app data and/or account information in order to function. The hints and documentation about these features will identify when this is the case. If you want to avoid the use of your data in this way, then simply do not use those specific features. For example, our Process Step feature allows you to send data captured in a Form entry onto another user as a Task for them to complete.

Our various connectors and APIs give you the option to export and import data between the VMS Service and other external applications. When using connectors, you may be disclosing your data to the individuals or organizations responsible for operating and maintaining such third party applications and sites. VMS does not own or operate the external services that you choose to connect with, and you should review the privacy policies of such external services to ensure you are comfortable with the ways in which they may use the data you share with them.

To manage the VMS Service

VMS may use your account information and app data for these limited, internal-only purposes:

To maintain, monitor and enhance the VMS Service. We perform internal statistical and other analyses on data we collect, including usage data, device data, referral data, app data and information from page tags, to measure user behaviour and trends, to understand how people use the VMS Service, and to monitor, troubleshoot and improve the VMS Service, including to prioritise, plan and evaluate new features. VMS may use your data for internal-only purposes designed to keep our services secure and operational, such as for troubleshooting and testing purposes, and for service improvement, marketing, research and development purposes.

To enforce our Terms of Use. Occasionally VMS may need to review data in your account in order to determine whether there is a breach to our contractual terms.

To prevent potentially illegal activities.

To screen for and prevent undesirable or abusive activity. For example, VMS has automated systems that screen content for activities such as, phishing, spam, and fraud.

To create new functionality, services or content. VMS may internally review your app designs and data for the purpose of creating new features, support content or services. VMS may look at related statistics such as app usage, form entry counts, and average number of fields per screen in order to publish interesting observations about these for training or marketing purposes. When VMS does so, neither individual app creators nor app users will be identified or identifiable unless we have obtained their permission.

To contact you about your service or account. VMS may occasionally send you communications of a transactional nature (e.g. service-related announcements, billing-related matters, changes to our services or policies, welcome emails when you first register). You are prevented from opt-out of this type of communication since it is required to provide our services to you.

To contact you for marketing purposes. VMS will send you promotional emails only if you consent to us contacting you for this purpose. You can opt out of these communications at any time by clicking on the “unsubscribe” link in these emails.

To respond to legal requests and prevent harm. If VMS receives a subpoena or other legal request, we may need to inspect the data held to determine the appropriate response.

Who VMS shares your data with

We recognize that you have entrusted VMS with safeguarding the privacy of your information. Because that trust is extremely important to us, the only time VMS will disclose or share your personal information or app data with a third party is when VMS has done one of three things, in accordance with applicable law: (a) given you notice, such as in this Privacy Policy; (b) obtained your express consent, such as through an opt-in checkbox; or (c) anonymised or aggregated the information so that individual persons or other entities cannot reasonably be identified by it. Where required by law, VMS will obtain your express consent prior to disclosing or sharing any personal information.

We may share:

Your data with our sub-processors. We use third-party service providers (“sub-processors”) to help us provide you with the VMS Service. VMS gives these sub-processors access to your data, but only to the extent necessary for them to perform their services for us. VMS also implements reasonable contractual and technical protections to ensure that your personal information and data remains confidential, is used only for the provision of their services to us, and is handled in accordance with this Privacy Policy. Examples of sub-processors include payment processors, hosting services, email providers, and analytics tools. A list of our sub-processors can be found on our sub-processors page.

Your email address with your organization. If the email address under which you’ve registered your account belongs to or is controlled by an organization, VMS may disclose that email address to that organization to assist the organization with its VMS account administration. Don’t use a work email address for the VMS Service unless you are authorized to do so, and are therefore comfortable with this potential disclosure.

Aggregated or anonymised data with third parties to improve or promote the VMS Service. We ensure that no person can be reasonably identified or linked to any data we may share with third parties for the improvement or promotion of VMS services.

A cookie to advertise VMS services. VMS may ask advertising networks and exchanges to display ads promoting our services on other websites. VMS may ask these networks to deliver those ads based on the presence of a cookie, but in doing so will not share any other personal information with the advertiser. Our advertising network partners may use cookies and page tags or web beacons to collect certain non-personal information about your activities on this and other websites to provide you with targeted advertising based upon your interests.

Your data if required or permitted by law. VMS may disclose your information as required or permitted by law, or when VMS believes that disclosure is necessary to protect our rights, protect your safety or the safety of others, and/or to comply with a judicial proceeding, court order, subpoena, or other legal process served on us.

Your information if there’s a change in our business ownership or structure. If ownership of all or substantially all of VMS’s business changes, or if VMS undertakes a corporate reorganisation, including a merger, acquisition or consolidation or any other action or transfer between VMS entities, you expressly consent to VMS transferring your information to the new owner or successor entity so that we can continue providing the VMS Service. If required, VMS will notify the applicable data protection agency in each jurisdiction of such a transfer in accordance with the notification procedures under applicable data protection laws.

Information you explicitly consent to be shared. VMS may occasionally explicitly ask for your permission to provide your contact details to third parties for various purposes, including to allow those third parties to contact you for marketing purposes. You may later revoke your permission, but if you wish to stop receiving communications from a third party to which we provided your information with your permission, you will need to contact that third party directly.

Your data rights

You can exercise the following rights over the data you store or process on the VMS Service:

Update your account details. You can immediately update your account information, and that of your app users, via the provided organisation and user editing pages.

Access and correct personal information. As an account administrator, you may access and correct certain personal information that VMS holds about you by visiting the provided user edit page. Some app users and other individuals may have certain legal rights to ascertain if we hold personal information about them, to access personal information we hold about them, and to pursue its correction, update, amendment or deletion in appropriate circumstances. Depending on the information involved, these rights may be exercised through the user or organisation edit pages previously mentioned. For all other cases, requests to exercise these rights may be directed to our support team. These rights are subject to some exceptions, such as where executing the request would have an unreasonable impact on the privacy of other individuals. VMS will respond to requests to exercise these rights within a reasonable time and, where required by law or where we deem it otherwise appropriate and practicable to do so, we will honour your request.

Download/backup your app data. VMS provides functionality to export your app data in a variety of formats. This allows you to create your own backups or conduct offline data analysis.

Delete your app data. Deleting app data may not permanently delete said data immediately. As long as you maintain an account with VMS, we may retain your deleted data for a limited time, but no longer than 30 days, to cover cases where you accidentally delete data and need to restore it (which you can request by contacting our support team). To the extent permitted by law, VMS will permanently delete your data if you request to cancel your account.

Cancel your account. To cancel and delete your account, please contact our support team. Deleting your account will cause all the data in the account to be permanently deleted from our systems within a reasonable time period, as permitted by law, and will disable your access to the VMS Service. VMS will respond to any appropriate request to access, correct, update or delete your personal information within the time period specified by law, if applicable, or without excessive delay. VMS will promptly fulfil requests to delete personal information unless the request is not technically feasible or such data is required to be retained by law, in which case VMS will anonymise such data instead.

VMS’s data retention timeframes

We retain your data for as long as you have an account on the VMS Service, or to comply with our legal obligations, resolve disputes, or enforce our agreements. Copies of data deleted from our servers may remain on offsite backup media for up to 30 days thereafter. The following specific scenarios and timeframes apply:

Data you delete within your account. You can delete app designs and data from within your account at any time. App data that you delete from your account will be rendered inaccessible but may not be immediately deleted, applicable laws permitting. We may retain your data for up to 30 days to allow restoration of data when deleted accidentally. VMS generally does not use deleted form data for any purpose other than to give you the opportunity to restore it. Sometimes VMS may retain deleted data to comply with legal obligations, resolve disputes, or enforce our agreements. In these cases, VMS ensures that access to such data is blocked except for the purposes for which VMS has been required to retain the information.

Deletion of your VMS Service account. You can request our support team to delete your account and all associated data at any time. After you initiate the deletion of your account, the account is disabled immediately, but the account and associated data may be held in our database for up to 30 days, until our next regularly scheduled deletion cycle, at which point it will be permanently deleted. You can contact our support team within that time frame to request the account be restored. After your account is permanently deleted, VMS won’t be able to restore it or the associated data.

App user account deleted by an account administrator. Your nominated administrator users can delete app user accounts at any time. This disables the target user account immediately, but the user and associated data may be retained by VMS for up to 30 days prior to being deleted. Depending on when you request it, restoration of the user account may be possible by our support team.

Security and other important information

Changes to this Privacy Policy. VMS may modify this Privacy Policy at any time. VMS will notify you by publishing the changes on this website. If VMS determines the changes are material, you will be provided with additional, prominent notice as is appropriate under the circumstances, such as via email or in another conspicuous manner reasonably designed to notify you. If, after being informed of these changes, you do not cancel your subscription and continue to use VMS services beyond the advance-notice period, you will be considered as having expressly consented to the changes in the Privacy Policy. If you disagree with the terms of this Privacy Policy or any updated Privacy Policy, you may close your account at any time.

Security. We provide details on our security measures webpage. VMS takes security seriously and we’re committed to processing your personal information and data with respect and integrity. However, regardless of the protections and precautions undertaken, there is always a risk that your personal information may be viewed and used by unauthorized third parties as a result of collecting and transmitting your data through the Internet. If you have any questions about the security of your personal information, contact our support team.

Data locations. We use Microsoft’s Azure cloud platform to host customer accounts in 3 separate regions (“nodes”) across the world – specifically USA, West Europe and Australia. Depending on your indicated country at account creation, your account will be provisioned and run exclusively within one of these nodes. For example, European country accounts are hosted only within our West Europe data centres. Your personal information may also be accessed from countries in which VMS personnel or affiliates are located (generally for support and maintenance purposes), and may be processed in countries where our sub-processors’ services are located.

Cookie Notification. VMS and our partners use cookies and similar technologies on our websites. Cookies are small bits of data we store on the device you use to access our services so VMS can recognize repeat users. Each cookie expires after a certain period of time, depending on what we use it for. VMS uses cookies and similar technologies for several reasons:

For security reasons. We store your login details in an encrypted cookie to authenticate your identity and to keep you logged into the VMS Service between usage sessions.

To provide you with personalized content. VMS may store user preferences, such as your default language, in cookies to personalize the content you see.

To improve our services. VMS uses cookies to measure your usage of our websites and track referral data, as well as to occasionally display different versions of content to you. This information helps VMS develop and improve our services and optimize the content VMS displays to users.

To advertise to you. VMS, or our service providers and other third parties we work with, may place cookies when you visit our marketing website or when you open emails that are sent to you, in order to provide you with more tailored marketing content (about our services or other services), and to evaluate whether this content is useful or effective. For instance, VMS may evaluate which advertisements are clicked on most often, and whether those clicks lead users to make better use of our tools, features and services. If you don’t want to receive advertisements that are tailored to you based on your anonymous online activity, you may “opt out” of many of the companies that are involved in such tailoring by going to http://optout.aboutads.info. Opting out in this way does not mean you will not receive any advertisements; it just means that you will not receive advertisements from such companies that have been tailored to you based on your activities and inferred preferences.

Google Analytics. In addition to the above, VMS has implemented on our websites and other services certain Google Analytics features that support Display Advertising, including re-targeting. Visitors to our websites may opt out of certain types of Google Analytics tracking, customize the Google Display Network ads by using the Google Ad Preferences Manager and learn more about how Google serves advertisements by viewing its Customer Ads Help Center. If you do not wish to participate in Google Analytics, you may also download the Google Analytics opt-out browser add-on.

We don’t believe that cookies are bad, but you can still choose to remove or disable cookies via your browser. Note that if you choose to disable cookies received from our web backend, you will not be able to log in there, since we require cookies to be enabled for the security reasons above. By using our websites and agreeing to this Privacy Policy, you expressly consent to the use of cookies as described in this policy.

Blogs and Forums. VMS websites may offer publicly accessible blogs and community forums. You should be aware that any information you provide in these areas may be read, collected, and used by others who access them. VMS is not responsible for any personal information you choose to submit in these areas of our site. To request removal of your personal information from our blog or community forum, contact our support team. In some cases, VMS may not be able to fulfil your request and an explanation will be provided. Commenting systems on our blogs may be managed by a third party application that may require you to register to post a comment. Please review that application’s privacy policy to learn how the third party uses your information.

Online Tracking. VMS currently does not process or comply with any web browser’s “do not track” signal or other similar mechanisms that indicates a request to disable online tracking of individual users who visit our websites or use our services, unless otherwise stated in a service-specific privacy statement.

Social Media Features. VMS websites may include social media features or widgets, such as the Facebook Like button. Use of these features may allow them to collect your IP address, detect which page you are visiting on our site, and set a cookie to enable the feature to function properly. Your interactions with these features are governed by the privacy policy of the third party providing it.

Safety of Children and COPPA. VMS services are not intended for and may not permissibly be used by individuals under the age of 16. VMS does not knowingly collect personal information from persons under 16 or allow them to register. If it comes to our attention that VMS has collected personal information from such a person, VMS may delete this information without notice. If you have reason to believe that this has occurred, please contact our support team.

English version only. The English language version of this Privacy Policy is authoritative. Any translations of this policy that we may provide are for convenience only.

Notices for European Union and United Kingdom users

Personal data. For users located in the EU, references to “personal information” in this policy are equivalent to “personal data” as defined in prevailing EU data protection regulations.

IP addresses. Our servers may record the incoming IP addresses of visitors to VMS websites and services, whether or not the visitor has a VMS account, and store the IP addresses in log files. VMS uses these log files for purposes such as system administration and maintenance, record keeping, tracking referring web sites, inferring your location, and security purposes (e.g. controlling abuse, spam and DDOS attacks). VMS may also store IP addresses along with certain actions you take on our system. By agreeing to this Privacy Policy, you expressly consent to VMS using your IP address for the above purposes. If you wish to opt out from the above consent to use your IP address, you must cancel your account (if you have one) and/or not interact with apps created on the VMS Service if requested to do so.

Data controller. VMS is the data controller for registration, billing and other account information that we collect from VMS Service users in the EU. However, the data controller for all app data is us. Us determines how their apps are designed, distributed and used. VMS only processes app data in accordance with the instructions and permissions (including those given under this Privacy Policy) configured by us when they create and administer their apps.

Accessing and correcting your personal data. You have the right to access and correct the personal information that VMS holds about you. This right may be exercised by visiting the provided “edit user” pages or by contacting our support team.

Your responsibilities. By using the VMS Service, you agree to comply with adequate data protection requirements when collecting and using your app data, such as requirements to inform respondents about the specific uses and disclosures of their data.

Your data is hosted within the EU. Provided you have specified the United Kingdom or an EU country as your account’s location at signup for the VMS Service, then your data will be hosted exclusively within our West Europe data centres. Some processing of data may still occur outside the EU by our sub-processors in order to provide aspects of the VMS Service. VMS personnel outside the EU may also access your data for support and maintenance purposes.

You are giving the following express consents

By clicking “I Agree” or any other button indicating your acceptance of this Privacy Policy, you expressly consent to the following:

You consent to the collection, use, disclosure and processing of your personal data in the manner described in this Privacy Policy, including our procedures relating to cookies, IP addresses and log files.

You consent and agree that VMS and our various affiliates and sub-processors may process your data in countries which do not have data protection laws that provide the same level of protection as in European Economic Area countries. VMS commits to having contracts in place with these affiliates and sub-processors that include similar requirements as prevailing EU data protection legislation. Your consent is voluntary, and you may revoke your consent by opting out at any time. If you opt-out, we will no longer be able to provide you with the VMS Service.

You consent to VMS sharing your personal data with relevant persons working for sub-processors and affiliates when necessary to provide the VMS Service.

You consent to our use of cookies as described in this Privacy Policy.

SECTION 2: PRIVACY FOR APP USERS

Information that VMS collects

When you interact with apps powered by VMS, we collect and process information relating to you and your use of the VMS Service from a variety of sources, which are listed below, along with details of how we use this information. All collection and processing of such information is on behalf and upon instructions, including the ones provided in this Privacy Policy, of us.

Information VMS collects directly from you

App data. VMS collects and stores the app data that you interact with, modify or submit. An app may ask you to provide personal information or data.

Information we collect indirectly or passively

User account information. You will usually require a VMS account before you can access apps created on the VMS Service. Your organisation account administrator will normally create your user account, and in doing so will provide us with your name, email address, country and time zone. These details are required in order to provide you with app user access on the VMS Service.

Usage data. VMS collects usage data about you whenever you interact with the VMS Service. This may include which web pages you visit, what you click on, when you performed those actions, and so on. Additionally, as with most websites today, VMS servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system versions, and timestamps. Note that VMS does not link this usage data to your submitted app data.

Device data. VMS collects data from the device you use to access our services, such as your IP address, operating system version, device make and model, performance information, and browser type. VMS may also infer your geographic location based on your IP address.

Referral data. VMS may records information about the source that referred you to an app (e.g. a web link or in an invite email).

Information from page tags. VMS uses third-party tracking services that employ cookies and page tags (also known as web beacons) to collect aggregated and anonymised data about visitors to our websites. This data includes usage and user statistics.

How VMS uses collected information

The data from your app interactions is owned and managed by us, and VMS treats that information as private to us. Please contact us directly to understand how we uses your app data. VMS does not sell or make available app data to third parties, beyond what is necessary to provide the VMS Service, without our instruction and VMS does not use any contact details collected in our apps to contact persons recorded in said app data.

VMS also uses the information collected from you, including usage data, device data, referral data and information from page tags to manage and improve our services, for research purposes, and for the various purposes described in this Privacy Policy.

Who VMS shares your data with

VMS will share your app data and interactions with third parties only as described in this Privacy Policy.

VMS discloses:

We are the controller of all data consumed and collected by the apps they create and provide to you. Your app data and interactions (e.g. form submissions) will be provided to a third party. Contact us directly to understand how they might use your app data.

Your data to third parties as necessary to provide the VMS Service. Please see Section 1 of this Privacy Policy to understand how VMS processes app data on behalf of app creators, and to whom VMS may disclose app data.

Your Data Rights

To access and correct your app data and/or personal information, contact us. VMS does not control your data, we only collect and processes your data on your behalf. VMS provides you with tools to maintain the data we collect through our apps. You may request access to and correction of the personal information we hold about you by contacting customer support, and VMS will respond to your request for access or correction within a reasonable time and, where reasonable and practicable to do so, VMS will provide access to your personal information in the manner requested by you.

Opt out of using VMS-powered apps. Your use of VMS-powered apps is voluntary and can be stopped at any time by you. Note that your employer or organisation may require you to use VMS-powered apps as part of your activities for them, in which case you will need to address your concerns about VMS-powered apps to them.

Security and other important information

Changes to this Privacy Policy. VMS may modify this policy at any time and you will be notified by publishing the changes on this website. If VMS determines the changes are material, you will be provided with additional, prominent notice as is appropriate under the circumstances, such as via email or in another conspicuous manner reasonably designed to notify you. If, after being informed of the changes, you continue to use the VMS Service beyond the advance-notice period, you will be considered as having expressly consented to the changes in our Privacy Policy. If you disagree with the terms of this Privacy Policy or any updated Privacy Policy, you may request your account be deleted by your organisation administrator, or by contacting our support team.