Effective: 15 July 2026
Your privacy is important to us, and so is being transparent about how we collect, use and share information about you. In this policy, OriginsNext, we and us refer to OriginsNext Pty Ltd (ACN 680 701 357) and our corporate affiliates. We offer a range of products through the OriginsNext platform, which together with our related services and websites we call the Services.
This policy explains what information we collect, how we use and disclose it, how we store and secure it, how long we keep it, how you can access and control it, and how we transfer it internationally. It also explains the privacy rights available to you and how to contact us.
OriginsNext is based in Australia, and we handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we handle information about individuals in other regions, we also aim to comply with the laws that apply there, including the European Union and United Kingdom General Data Protection Regulation (GDPR), the Brazilian Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018), and applicable United States state privacy laws. References to personal information in this policy include personal data as defined under those laws.
Where we provide the Services under a contract with an organisation (for example, your employer or a client), that organisation controls the information processed through the Services and we act as its processor. In that case this policy does not apply to that processing; please see Notice to end users below and the organisation's own privacy policy. If you do not agree with this policy, please do not access or use the Services.
We collect information about you when you provide it to us, when you use the Services, and when other sources provide it to us.
Information you provide to us
Account and profile information: We collect information when you register for an account, create or modify your profile, set preferences or make purchases. This may include your name, display name, profile photo, job title, contact details and account settings.
Data you provide through the Services: We collect and store the data you add, send, receive and share through the OriginsNext products you use, including files and links you upload and any information you choose to include.
Information you provide through our websites: We collect information you submit through our websites, including through forms and any social media features.
Information you provide through support: When you contact our support team or open a support ticket, you may provide contact information, a description of your issue, and any documentation, screenshots or information that helps us resolve it.
Payment information: When you register for paid Services, we collect billing details such as your billing contact and, where relevant, payment card details, which are collected through secure third-party payment processors.
Information we collect automatically
Your use of the Services: We keep track of information about how you use the Services, including the features you use, links you click, the type, size and file names of attachments you upload, forms you submit, search terms, and how you interact with others on the Services.
Device and connection information: We collect information about the devices you use to access the Services, including connection type and settings, operating system, browser type, IP address, referring and exit pages, device identifiers and crash data. We may use your IP address to approximate your location to improve your experience.
Cookies and similar technologies: We and our partners use cookies and similar technologies to provide functionality and recognise you across devices. For details, including how to control or opt out, see our Cookie Policy at www.originsnext.com/cookies.
Information we receive from other sources
We receive information about you from other users of the Services, from third-party services you link to your account, from our corporate affiliates, and from business partners and publicly available sources. We may combine this with information we collect through other means to keep our records accurate and to improve the Services. Where we do so, we handle that information in accordance with this policy and applicable law.
How we use information depends on which Services you use, how you use them, and the preferences you have communicated to us. We use the information we collect to:
Where the GDPR (EU and UK) or the LGPD (Brazil) applies, we collect and process personal information only where we have a legal basis to do so. Depending on the Services and how you use them, our legal bases are:
In Australia, we collect personal information for the purposes described in this policy and use and disclose it for those purposes or a related purpose you would reasonably expect, or as otherwise permitted under the Privacy Act 1988 (Cth). We collect sensitive information only with your consent or where otherwise permitted by law.
We disclose the information we collect in the ways described below.
To other users of the Services: When you use the Services, certain information about you (such as profile information and data you create or share) is disclosed to other users based on the settings you or your administrator select.
Managed accounts and administrators: If you access the Services using an email address with a domain owned by your organisation, that organisation's administrator and other users sharing the domain may be able to access certain information about you, and the administrator may assert control over your account.
Service providers and partners: We disclose information to third parties that help us operate, provide, improve and support the Services, including hosting, storage, payment processing, analytics and implementation partners. They may access information only to perform services on our behalf, under contract and appropriate security and confidentiality obligations.
Third-party sites and services: The Services may link to or integrate with third-party websites and services whose privacy practices differ from ours. Information you provide to them is governed by their privacy policies, not this one.
Legal and safety reasons: We may disclose information where we believe it is reasonably necessary to comply with a law, regulation, legal process or governmental request; to enforce our agreements and policies; to protect the security and integrity of the Services; or to protect OriginsNext, our customers or the public from harm or illegal activity.
Corporate affiliates and business transfers: We disclose information to our corporate affiliates to operate and improve the Services, and we may transfer information in connection with a merger, financing, acquisition or sale of assets. We will notify you of any such transaction that affects your information.
We do not sell your personal information for monetary consideration.
We operate globally and may transfer, process and store your information outside your country of residence, including in Australia, wherever we or our service providers operate. Whenever we transfer personal information across borders, we take steps to ensure it is protected.
For information about individuals in the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), or another lawful transfer mechanism. For disclosures of personal information overseas from Australia, we take reasonable steps to ensure the overseas recipient handles the information consistently with the Australian Privacy Principles. Details of our sub-processors and the safeguards for client personal data are set out in our Data Processing Addendum at www.originsnext.com/dpa.
We use industry-standard technical and organisational measures to protect the information we store. No security system is impenetrable, and because of the inherent nature of the internet we cannot guarantee that information is absolutely secure during transmission or storage.
If we become aware of a data breach that is likely to result in serious harm, we will assess it promptly and, where required, notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme, and any other regulators as required by applicable law.
We keep information for as long as needed to provide the Services and for the purposes described in this policy, and for a reasonable period afterwards to comply with our legal obligations, resolve disputes, enforce our agreements and support our business. Where information is held on the immutable distributed ledger underlying the Platform, or has been shared with other users as permissioned data, we may be unable to amend or delete it; in that case we continue to protect it and isolate it from further use where possible. When information is no longer required, we delete or de-identify it.
Depending on where you live, you may have rights to access, correct, update, delete or restrict our use of your personal information, to object to certain processing (including marketing), to request a copy of your information in a portable format, to opt out of the sale or sharing of personal information and targeted advertising, and to withdraw consent. You can exercise many choices through your account settings, or by contacting us as set out in Contact us and complaints below. Where the Services are administered by an organisation, you may need to contact that organisation first.
Opt out of marketing: You can opt out of promotional communications using the unsubscribe link in each email or by contacting us. You will still receive transactional messages about the Services.
Cookies: You can control cookies through the browser-based controls described in our Cookie Policy at www.originsnext.com/cookies.
Australia
You may request access to, and correction of, the personal information we hold about you under the Australian Privacy Principles. If you have a privacy concern, please contact us first (see below). If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
European Union and United Kingdom
If you are in the EEA or the UK, you may exercise the rights described above under the GDPR. You also have the right to lodge a complaint with your local data protection or supervisory authority.
Brazil
If you are in Brazil, you have the rights set out in Article 18 of the LGPD, including confirmation and access, correction, anonymisation or deletion of unnecessary data, portability, information about our data sharing, and withdrawal of consent. You may also contact the Brazilian National Data Protection Authority (ANPD) at www.gov.br/anpd.
United States (California)
If you are a California resident, the California Consumer Privacy Act (CCPA) gives you rights to know, access, correct and delete the personal information we hold about you, and to opt out of the sale or sharing of personal information. We do not discriminate against you for exercising these rights, and you may use an authorised agent to make a request. To exercise these rights, contact us as set out below.
Many of our products are used by organisations. Where the Services are made available to you through an organisation (for example, your employer or a client), that organisation is the administrator and controls the accounts and sites it manages. Your use of the Services is subject to that organisation's policies, and you should direct your privacy questions to your administrator. We are not responsible for the privacy practices of an administrator's organisation. An administrator may, for example, access information in your account, restrict or suspend your access, change your account details, or enable or disable integrations. If you use an organisation email address to access the Services, the owner of that domain may assert administrative control over your account.
The Services are not directed to individuals under 18, and we do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete it. If you believe a child has provided us with personal information, please contact us.
We may update this policy from time to time. We will post any changes on this page and, where the changes are significant, provide a more prominent notice (such as a notice on the Services or an email). We encourage you to review this policy periodically.
Your information is controlled by OriginsNext Pty Ltd. If you have any questions, concerns or complaints about how we handle your information, or if you wish to exercise your privacy rights, please contact us:
OriginsNext Pty Ltd
Sydney, NSW, Australia
Email: support@originsnext.com
We will acknowledge and respond to your request within the timeframes required by applicable law. If you are not satisfied with our response, you may contact the relevant data protection authority for your region (in Australia, the OAIC; in Brazil, the ANPD; in the EEA or UK, your local supervisory authority).
.svg)
.svg)
