Privacy Policy

1. About this policy

Commerce One Systems Pty Ltd (ABN 90 146 072 308) operates under the master brand Commerce One (“Commerce One”, “we”, “us” or “our”).

This Privacy Policy explains how we collect, hold, use and disclose personal information when you:

• visit or interact with the Commerce One website
• submit an enquiry or a Managed Sales application
• communicate with us by email, phone, video call, meeting or other channel
• participate in a Sales Fit Call or Sales Fit Review
• engage us to provide Managed Sales, implementation, Studio or related services
• are a representative of a business contacted through a client-authorised Managed Sales engagement
• interact with us as a prospective client, client, supplier, contractor, partner or business contact

We aim to handle personal information openly and responsibly and, where applicable, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This policy applies to our website, prospect interactions and general business activities. Additional privacy, confidentiality, security and data-processing obligations may apply under a proposal, statement of work, service agreement or other written agreement.

2. Contact details

Commerce One

Operated by: Commerce One Systems Pty Ltd

ABN: 90 146 072 308

Address: Tower 1, Level 8, 1341 Dandenong Road, Chadstone, Victoria 3148, Australia

Email and privacy enquiries: contact@commerce.one

Phone: +61 3 7058 1328

Website: https://commerce.one

3. What information we collect

The information we collect depends on how you interact with us.

3.1 Contact and identity information

We may collect:

• your name
• job title or role
• employer or organisation
• business email address
• telephone number
• business address or location
• billing or account contact details
• communication preferences

3.2 Business and application information

If you submit an enquiry, apply for Managed Sales or participate in a Sales Fit Call, we may collect:

• business name and website
• industry
• approximate organisation size or revenue range
• operating locations and target markets
• product and service descriptions
• typical transaction values and purchase patterns
• current customer types
• current sales process, team and pipeline information
• sales, CRM and invoicing systems in use
• sales-environment and revenue-visibility responses
• intended outcomes
• information reasonably required to assess fit, prepare a proposal or define scope

3.3 Communications, meetings and transcripts

We may collect:

• information included in forms, emails and messages
• notes from calls and meetings
• meeting recordings or transcripts where recording occurs with appropriate notice or consent
• correspondence history
• proposals, onboarding records and service records
• approvals, feedback and operating decisions

Where a meeting is recorded or transcribed, participants will be informed where required or reasonably appropriate.

3.4 Client service data

During an active engagement, Commerce One may be authorised to access or process information contained in client systems in order to design, implement, test, monitor or operate an approved workflow.

Depending on the client environment, this information may include personal information relating to employees, customers, suppliers, contractors or other individuals.

The categories of information and permitted processing depend on the agreed scope.

Commerce One seeks to minimise access to personal information and confidential data to what is reasonably required for the approved purpose.

3.5 Technical and website-usage information

When you use our website, we may automatically collect information such as:

• IP address
• browser type
• operating system
• device information
• pages viewed
• referring URLs
• campaign parameters
• approximate location derived from technical data
• form and interface interactions
• error, performance and security logs
• cookie, local-storage, session-storage and analytics information

3.6 Sensitive and restricted information

We do not ask website visitors to provide unnecessary sensitive information through public forms.

Please do not submit through public forms or ordinary email:

• passwords
• access credentials
• payment-card or banking details
• API keys or recovery codes
• confidential customer records
• unnecessary health information
• government identifiers unless specifically required and authorised
• other sensitive personal information
• confidential material you are not authorised to disclose

Where restricted information or credentials are required for an approved engagement, they should be provided only through the controlled process specified by Commerce One.

3.7 Managed Sales prospect and attribution information

When delivering Managed Sales for a client, Commerce One may process information about prospective buyers and attributable accounts, including:

• prospective buyer business details
• professional contact details and job titles
• public professional profiles
• contact source
• sales correspondence and reply history
• qualification information
• opt-out and suppression status
• client CRM identifiers and Commerce One account identifiers
• CRM opportunity information
• sales, order and invoice references
• payment status and collected revenue values
• refunds and credits relevant to attribution
• attributable-sales evidence

This information is processed to deliver Managed Sales, measure performance, administer contractual fees, prevent duplicate or inappropriate outreach and resolve attribution questions. Processing is limited to what is reasonably required for the engagement — Commerce One does not require unrestricted access to a client's full financial data.

4. How we collect information

We may collect personal information:

• directly from you
• through website forms
• through email, phone, meetings or video calls
• during discovery and assessment
• during onboarding and service delivery
• from your employer, colleague or authorised representative
• from client systems where access has been authorised
• from public business sources and professional profiles
• from website analytics and security systems
• from service providers that support communications, scheduling, transcription, workflow or service delivery
• from referral partners where collection is authorised or otherwise lawful

Where practical, you may interact with our public website without identifying yourself.

Accurate business and identity information may be required for us to respond to an enquiry, conduct an assessment, prepare a proposal or establish a client relationship.

5. Why we collect, use and disclose information

We may collect, hold, use and disclose personal information to:

• operate, maintain and secure the website
• respond to enquiries, Managed Sales applications and commercial mandate enquiries
• assess prospective-client and mandate fit
• arrange and conduct Sales Fit Calls and Sales Fit Reviews
• conduct client-authorised B2B prospecting and target-company research
• conduct client-authorised buyer, supplier and counterparty research and identification
• identify relevant business contacts
• send lawful, authorised sales and commercial communications
• manage replies, follow-up, commercial qualification and introductions
• maintain suppression and exclusion records
• administer CRM records and pipeline
• attribute accounts and reconcile performance fees
• prepare recommendations and proposals
• design, configure, test and manage approved sales workflows
• connect approved client systems
• provide support, monitoring and reporting
• administer contracts, billing and relationships
• manage suppliers, contractors and professional advisers
• maintain deployment, approval and governance records
• improve our systems, methods and service delivery
• analyse website and campaign performance
• send service-related communications
• send marketing or thought-leadership communications where permitted
• protect systems and detect misuse
• comply with legal, regulatory, tax, accounting and record-keeping obligations
• establish, exercise or defend legal rights
• support a lawful financing, restructuring or business transaction

We will not use personal information for a materially unrelated purpose unless we have an appropriate basis to do so.

6. Commerce One Intelligence and AI-assisted processing

Commerce One Intelligence is Commerce One’s proprietary intelligence layer.

It may combine controlled internal systems, structured workflows, operational information and commercially available AI or machine-enabled tools to support:

• discovery
• process analysis
• classification
• extraction
• summarisation
• process modelling
• solution architecture
• drafting
• testing
• quality assurance
• monitoring
• reporting
• prioritisation
• continuous improvement

Where personal information is involved, we consider the intended purpose, data required, provider controls, access, risk and the level of human oversight appropriate to the task.

Commerce One does not use, permit or opt in to the use of client confidential information, client operational data or personal information to train, fine-tune or improve general-purpose, shared or publicly available AI models.

We do not use one client’s identifiable confidential information, prompts, outputs or personal information to train systems for another client or to create a shared client training corpus.

Where AI or automation providers process client information, Commerce One requires the approved provider and configuration to restrict that processing to delivery of the contracted service, security, authorised support, legal obligations and other strictly necessary service functions.

Where permitted by contract and law, Commerce One may use de-identified or aggregated operational learnings that do not identify the client or individuals to improve Commerce One’s own internal methods, templates, evaluation approaches and the Commerce One Standard. This does not include using identifiable client information to train general-purpose or shared AI models.

AI-assisted systems may produce incomplete, inaccurate or unexpected outputs. Material recommendations, approvals and operating decisions remain subject to the governance defined for the relevant engagement.

7. Client-controlled information and service delivery

When Commerce One processes information from a client environment, the client remains responsible for ensuring it has the authority to provide access to, or permit processing of, that information.

Commerce One uses client information for the purposes authorised under the applicable agreement and approved operating scope.

Depending on the engagement, additional terms may cover:

• confidentiality
• security
• permitted processing
• data location
• retention
• subprocessors
• incident notification
• access control
• deletion or return of data
• audit or assurance information

8. Cookies and website technologies

We may use cookies, pixels, local storage, session storage and similar technologies to:

• operate essential website functions
• remember preferences
• understand website traffic and usage
• measure campaigns and content
• detect security or availability issues
• improve website performance

Where required, we will request consent before enabling non-essential analytics or marketing technologies.

You may manage cookies through available website controls or your browser settings.

Disabling browser storage or cookies may affect some website functions.

9. Direct marketing

We may send updates, insights or promotional material where:

• you have consented
• you have requested information
• you have an existing business relationship with us and the communication is permitted
• another lawful basis applies

Commercial electronic messages will identify the sender and provide an unsubscribe method where required.

You may opt out using the unsubscribe method provided or by contacting contact@commerce.one.

We may still send communications reasonably necessary for an enquiry, assessment, proposal, contract or active client relationship.

10. Who we may disclose information to

We may disclose personal information to:

• employees, contractors and authorised representatives of Commerce One
• professional advisers
• website hosting and cloud infrastructure providers
• workflow, integration and automation providers
• AI and machine-enabled service providers
• document, storage and knowledge-management providers
• communications, email, calendar, transcription and video-conferencing providers
• analytics and security providers
• CRM, form, project and service-management providers
• accounting, invoicing and payment providers
• technical specialists or implementation partners engaged for an approved scope
• a client where information is processed as part of that client’s authorised operating environment
• regulators, courts, law-enforcement agencies or government bodies where required or authorised by law
• a purchaser, investor, financier or adviser involved in a proposed business transaction, subject to appropriate arrangements

We do not sell personal information to advertisers or data brokers.

11. Overseas processing and disclosure

Some service providers used by Commerce One may store or process information outside Australia.

Depending on the systems and providers configured at the relevant time, this may include processing in the United States and other countries in which selected cloud, AI, workflow, communications, security or infrastructure providers and their subprocessors operate.

Where required, Commerce One takes reasonable steps appropriate to the circumstances when selecting and using overseas providers.

Privacy protections and legal rights may differ between countries.

Where a client engagement requires a specific data location or restricts overseas processing, those requirements must be identified and agreed before the relevant system is deployed.

12. Data security

Commerce One takes reasonable administrative, technical and organisational steps designed to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

Depending on the environment, measures may include:

• role-based access
• least-privilege permissions
• separate client environments
• secure credential-management processes
• multi-factor authentication
• encryption in transit where supported
• provider due diligence
• logging
• monitoring
• controlled approval pathways
• data minimisation
• confidentiality obligations
• backup and recovery procedures where appropriate
• incident-response processes

No website, transmission method, AI system or storage environment can be guaranteed to be completely secure.

If we become aware of a data breach, we will investigate and respond in accordance with applicable law and contractual requirements.

13. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, security, operational and dispute-resolution requirements.

Retention periods may differ for:

• enquiries
• meeting records
• assessment materials
• proposals
• client records
• workflow and approval records
• operational logs
• security logs
• billing records
• legal or compliance records

Where information is no longer reasonably required, we take reasonable steps to destroy or de-identify it where appropriate and permitted by law.

Client-specific deletion or return requirements may also be defined in the applicable agreement.

14. Access and correction

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, incomplete, out of date, irrelevant or misleading.

Contact: contact@commerce.one

We may need to verify your identity.

Access or correction may be refused or limited where permitted or required by law.

15. Privacy complaints

If you believe Commerce One has mishandled your personal information, please contact:

• Privacy Contact
• Commerce One Systems Pty Ltd
• ABN: 90 146 072 308
• Tower 1, Level 8, 1341 Dandenong Road, Chadstone, Victoria 3148, Australia
• contact@commerce.one
• +61 3 7058 1328

Please provide sufficient detail for us to understand and investigate the matter.

We will aim to acknowledge, investigate and respond within a reasonable period.

Where the Australian Privacy Principles apply and you are not satisfied with our response, you may have the right to contact the Office of the Australian Information Commissioner or another applicable regulator.

16. International visitors

If you access our website or interact with Commerce One from outside Australia, your information may be collected, stored or processed in Australia and other countries where authorised service providers operate.

Depending on your location, you may have additional rights under local privacy law.

To enquire about applicable privacy rights, contact contact@commerce.one.

17. Changes to this policy

We may update this Privacy Policy to reflect changes to:

• our website
• services
• operating model
• technology providers
• AI systems
• information-handling practices
• security arrangements
• legal or regulatory requirements

The updated version will be published with a revised “Last updated” date.

Material changes may also be communicated through another appropriate channel.