Privacy Policy

Zecutiva is a trading name of Bluehawk Aerospace Proprietary Limited (ABN 21 673 288 983) (“Zecutiva”, “we”, “us”), an Australian company. We provide business management software for owner-led businesses: the website at zecutiva.com, the Zecutiva dashboard, the Zecutiva mobile app for iOS and Android, and the customer portals our organisations offer their own customers at portal.zecutiva.com. This policy explains what personal information we handle, why, where it is kept and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Whose information this covers

• People who use Zecutiva — owners, managers and staff of businesses that subscribe to Zecutiva (“organisations”), on the web or in the mobile app.
• Our organisations’ customers and contacts — records an organisation keeps in Zecutiva or brings in from its own business systems.
• People at our organisations’ customers — people an organisation gives access to its customer portal, and people who apply for credit with an organisation or are named in an application: directors, owners, partners, trustees, guarantors, authorised representatives and trade references.
• Visitors — people who take the free Altitude Check or answer a staff survey.

For the records an organisation keeps in Zecutiva — about its staff, its customers and the people who deal with it — we act on the organisation’s behalf and follow its instructions. Questions about that information are best sent to the organisation first.

What we collect

• Account details: your name, email address, phone number, job role, the organisation you belong to and who you report to. Passwords are stored only as a one-way hash. If you use two-step sign-in we store the secret for your authenticator app.
• Employee records: details an organisation keeps about its staff, such as employee number, job title, start date, employment type and hours, employment documents, date of birth, home and postal address, emergency contact, and pay (salary, bonuses and allowances).
• Leave: leave you ask for, its dates, type and reason, and whether it was approved. The type of leave can say something about your health (for example personal or carer’s leave), so only you, your manager, your organisation’s administrators and the people it allows to manage leave can see it. Others see only that you are away.
• Medical information: allergies, medications and medical conditions, if you or your organisation choose to record them so the right help can be given in an emergency. This is sensitive information. We collect it only with your consent, and it is never required to use Zecutiva.
• Qualifications and licences: the licences, tickets and certificates you hold, their expiry dates and any copies uploaded. When you start with an organisation we also record the new-starter checklist, including any vehicle handed over to you with its odometer reading and photos.
• Work you record: tasks and enquiries, notes, comments, photos and documents you attach, job cards, contact logs, schedules and shifts, and policy and procedure acknowledgements and signatures.
• Safety records: the safety checks, Take 5s, risk analyses, hazard reports and safety actions you complete — with the answers, notes and photos you add, who did them and when — and the organisation’s register of vehicles, equipment and facilities, including odometer readings and who looks after each item. These are kept so the organisation can meet its work health and safety duties.
• Business records: customers, contacts, assets, jobs, invoices and sales figures that an organisation connects from its own systems (for example its ERP), and financial statements it uploads.
• Customer portal: for people given access to an organisation’s customer portal, their name, email address, the company account and role they were given, and when, from which IP address and on which device they sign in. See Customer portals.
• Credit applications: the business and personal details in an application for credit with an organisation, and the organisation’s assessment of it. See Credit applications.
• Customer email preferences: which kinds of marketing email a customer has opted in to or out of, and when and how that changed, including the IP address and device used.
• Altitude Check: your name, email, business name, location, business type, size, role and your answers, so we can score them and email your report.
• Staff surveys: answers are collected without your name; we use the invitation only to stop duplicate responses and send reminders.
• Billing: the organisation’s name, billing email and billing address, its plan and payment history. Card details are entered directly with our payment provider, Stripe; we never see or store full card numbers.
• Technical information: sign-in times, IP addresses and an audit trail of changes, kept for security and to resolve disputes.
• Weekly page counts: how many times a week a few pages were opened, counted for the whole organisation and never for a person. Today that’s the aged debtors list (opened by anyone) and the owner’s pinned numbers (opened by the owner or their deputy). The count holds no name or user, so it can’t show who looked.

The mobile app

• Camera and photos: used only when you choose to take or attach a photo. Only the photos you pick are uploaded.
• Notifications: if you allow them, we store your device’s push token, platform (iOS or Android) and app version so we can send you work notifications.
• Stored on your phone: your sign-in token (in the device’s secure storage) and a copy of your work so the app works without signal. Changes made offline are kept on the phone until they are sent. Signing out removes them.
• Face ID and fingerprint: if you turn on biometric sign-in, your phone checks your face or fingerprint itself. Zecutiva never receives or stores your biometric data.
• The app does not collect your phone’s location, your contacts, or advertising identifiers, does not track you across other apps or websites, and contains no advertising or third-party analytics.

Vehicle tracking

An organisation can connect the GPS trackers in its vehicles (through Geotab) to Zecutiva. People it allows can then see on a map where its tracked vehicles are now, the street address, whether each one is driving and its speed. This can show where the person driving a vehicle is. The location is read from the tracking provider when the map is open. Zecutiva does not store it or keep a history of where vehicles have been. An organisation that tracks vehicles is responsible for telling its staff, as workplace surveillance laws require.

Customer portals

An organisation can give people at its customers access to its customer portal. They sign in with their email address and a one-time code we email to them — there is no password — and see their company’s account with that organisation: its details, invoices and what is owing, the items it has bought, and who at the company has access.

• One sign-in for every supplier. If several organisations on Zecutiva give the same email address access, that person signs in once and chooses between them. We never tell one organisation which other organisations someone buys from, and each sees only its own records.
• What the organisation sees: who at your company has access, the role each person has, when they were invited and when they last signed in.
• If you also use Zecutiva at work with the same verified email address, your dashboard can open the portals you have access to without a code. Signing in to a customer portal never opens your own organisation’s Zecutiva.
• Sign-in codes are stored only as a one-way hash and stop working after 10 minutes. Removing a person’s access stops them seeing that organisation’s portal straight away.

Credit applications

An organisation can invite a business to apply for a credit account online. The application, and anything the organisation adds while assessing it, may include:

• The business: its names, ABN, ACN, addresses, phone numbers and the email addresses for accounts, statements and invoices. We check the ABN with the Australian Business Register, an Australian Government service.
• Its people: for each director, owner, partner or trustee — their name, position, email, mobile, date of birth, home address and driver licence number, as the organisation’s form asks — and the details of any guarantors and authorised representatives.
• Trade references: the names and contact details of other businesses given as references.
• Documents and signatures: documents uploaded with the application, and a record of signing: the typed name, the drawn signature, the time, IP address and device, and a fingerprint of the signed copy so it can be shown not to have changed.
• The organisation’s assessment: any credit score or credit report it obtains, the credit limit and payment terms it sets, its decision, and details of any registration it makes on the Personal Property Securities Register.

The organisation is the credit provider. It decides whether to obtain credit reports and is responsible for its credit reporting obligations under the Privacy Act — including telling applicants, before they sign, which credit reporting bodies it uses and where to find its credit reporting policy, which its application form shows. We hold this information on the organisation’s behalf. Zecutiva does not obtain credit reports itself, does not use applications for any purpose of its own, and does not use a driver licence number to identify anyone.

How we use it

• To provide Zecutiva: sign you in, show the right information to the right people, and run the features your organisation uses.
• To send emails and notifications you or your organisation have set up, such as your daily email, decisions waiting on you, portal invitations and sign-in codes, and credit application emails.
• To support workplace safety: asking for approval before risky work starts, telling the right people about hazards and overdue safety work, and reminding people of checks that are due.
• To show a business owner Flight Data beside their own BA-Score answers: totals from their organisation’s records, such as how many scheduled checks were done or how many open tasks have a named person. Flight Data is always a total for the business. It never names or ranks a staff member, and it never changes the score.
• To run an organisation’s customer portal and credit applications on its behalf.
• To bill organisations for their subscription and help them get set up.
• To keep the service secure, prevent misuse and fix problems.
• If you agree when taking the Altitude Check, to include your results, anonymised, in aggregate benchmarking. Your business is never identified individually.

We do not sell personal information, and we do not use it for advertising.

Automated decisions

Zecutiva does not make decisions about people by computer. The closest it comes is the safety risk analysis: the app works out a risk level from the hazards, likelihood and consequences that people enter, and when the level is High or Critical, the work waits until a manager or safety officer approves it or stops it. That decision is always made by a person. Credit decisions, leave approvals and access to Zecutiva are also made by people at the organisation, not by Zecutiva.

Who we share it with

Within an organisation, people see information according to the roles their organisation gives them. Pay and medical details are visible only to you and to people your organisation has given a separate permission for sensitive employee data. We use these service providers to run Zecutiva, and they handle information only to provide their service to us:

• DigitalOcean — servers, database and file storage, in Sydney, Australia.
• Microsoft 365 — sending email.
• Expo, Apple and Google — delivering push notifications to the mobile app. The notification content passes through their services.
• Stripe — taking subscription payments and keeping billing records.
• OpenFreeMap — the map images on the vehicle map. Your browser loads them directly, so OpenFreeMap sees your IP address, but not which vehicles are shown.
• The Australian Business Register — checking an ABN entered in a credit application.

When an organisation connects its own business systems, such as its ERP (for example Ostendo) or its vehicle tracking (Geotab), Zecutiva exchanges information with those systems on the organisation’s instructions. They are the organisation’s providers, not ours.

Members of our onboarding team can see an organisation’s setup details and progress to help it get started. They must use two-step sign-in, and what they change is recorded in that organisation’s audit trail.

We may also disclose information if the law requires it, or to protect the safety of people or the service.

Information sent outside Australia

Our database and stored files are in Australia. Some of our service providers handle information overseas:

• United States: Stripe (billing details), and Expo, Apple and Google (the content of push notifications and the device they go to).
• Microsoft 365 and OpenFreeMap may handle information outside Australia: the content of emails we send, and the IP address of a browser loading the vehicle map.

An organisation’s own business systems may also be overseas — for example, Geotab may store vehicle locations outside Australia. Those are arranged by the organisation, not by us.

Cookies

Zecutiva uses only the cookies it needs to keep you signed in: one for the Zecutiva dashboard, and a separate one for customer portals, so that the two never mix. They are not readable by scripts on the page and are not shared with anyone. We do not use analytics, advertising or tracking cookies.

How long we keep it

We keep information for as long as the organisation has an account with us, or as long as needed for the purpose it was collected for. Safety records, and credit application and credit account records, may be kept longer where the law requires an organisation to keep them. When an organisation leaves, we aim to delete or de-identify its data within 90 days, unless the law requires us to keep it longer. Altitude Check results are kept so you can compare later checks; ask us and we will delete them. Vehicle locations are not stored at all.

Security

All traffic to Zecutiva is encrypted with HTTPS. Personal employee details, pay, medical information, the answers given in credit applications and the keys used to connect other systems are also encrypted in our database. Passwords are hashed. Two-step sign-in is required for anyone who can see pay or medical details or manage credit applications, and for our onboarding team, and is available to everyone else. Access is controlled by role, and changes are recorded in an audit trail. No system is perfectly secure, but if a breach is likely to cause serious harm we will notify you and the Office of the Australian Information Commissioner as the law requires.

Your choices and rights

• You can see and correct your own profile details in Zecutiva, or ask your administrator.
• You can turn notifications off at any time in your phone’s settings.
• You can turn your daily email off, or choose what is in it, under My Profile in Zecutiva or with the link at the bottom of the email.
• Customers can change which marketing emails they receive with the link at the bottom of those emails. Emails needed to use Zecutiva — such as portal invitations, sign-in codes and credit application emails — do not have one.
• Deleting your account: ask your organisation’s administrator to remove you, or email support@zecutiva.com from your account’s email address. We will delete your account and personal details, normally within 30 days of your request. Records your organisation must keep, such as completed work, may stay with your name removed.
• You can ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing support@zecutiva.com. For information an organisation keeps in Zecutiva — including customer portal and credit application records — we may pass your request to that organisation.

Children

Zecutiva is a workplace tool and is not meant for anyone under 16.

Changes to this policy

If we change this policy we will update the date at the top. If a change is significant we will tell users by email or in the app.

Contact and complaints

Bluehawk Aerospace Proprietary Limited t/a Zecutiva, ABN 21 673 288 983. Email support@zecutiva.com with any privacy question or complaint. We will reply within 30 days. If you are not satisfied with our answer you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.