The Australian Privacy Principles apply to us
VariationFlow Ltd is incorporated in the United Kingdom, but the Privacy Act 1988 (Cth) reaches an overseas organisation that carries on business in Australia and collects personal information here. We do not treat our incorporation as a reason the Australian Privacy Principles do not apply to you. They do, and we handle Australian personal information accordingly.
Where your data is stored — and what APP 8 means here
Structured records and uploaded evidence are stored in the United Kingdom or the European Economic Area, not in Australia. From your point of view that is a cross-border disclosure under APP 8, and APP 8.1 makes us accountable for what an overseas recipient does with your information as though we had done it ourselves. We accept that. The full list of service providers, what each one receives and where it processes, is on the sub-processors page.
The United Kingdom and the EEA are not on any Australian “prescribed country” list — that mechanism has never been activated — so we rely on contractual obligations with each recipient rather than on a government finding, and we remain answerable for them.
Notifiable data breaches
If a data breach involving Australian personal information is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and the individuals at risk as required by Part IIIC of the Privacy Act. Where you are the APP entity and we are handling information on your behalf, we will tell you first and fast enough for you to meet your own obligation — the statutory clock is yours, and we are not going to be the reason you miss it.
Your rights
Under APP 12 and APP 13 you can ask for access to the personal information we hold about you and ask us to correct it. You can do both yourself in the app at any time, without asking us and without an active subscription — an account export and account deletion are both self-service. Or email info@variationflow.com and a person will handle it.
If you are not satisfied with how we handle a privacy complaint, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au. We would rather you came to us first, but we will not stand in the way.
Where we are not the entity that decides
For most of what passes through VariationFlow — site photographs, voice notes, signatures, the names of people on a project — your employer is the organisation that decides why it is collected, and we handle it on their instructions. If your information reached us through your employer's account, ask them first; we will help them respond.
Direct marketing and the Spam Act
We send transactional email — deadline alerts, sign-off requests, invoices — because you or your employer asked us to run the account. Any commercial electronic message we send carries accurate sender details and a functional unsubscribe, as the Spam Act 2003 requires. Unsubscribing from marketing never stops a deadline alert, because those are the thing you are paying us for.
Retention
Content is kept while the subscription is active and is deleted 30 days after cancellation, with a warning email 7 days before. Billing records are kept for 6 years to meet tax and accounting obligations. The full detail is in the Privacy Policy.
Artificial intelligence
Two features use AI, both optional and both disclosed before use: reading dates out of a payment schedule you choose to upload, and the assistant on our public website. Where AI is involved you are told so before it runs, not after. See the Privacy Policy and the sub-processors page.
Contact
VariationFlow Ltd, Scar Close Farm, Feizor, Austwick, Lancaster LA2 8DF, United Kingdom · info@variationflow.com