Privacy notice

1. Who we are and what this notice covers

OERC is operated by Ambidex R&D Pty Ltd ("Ambidex", "we"), a small business based in Perth, Western Australia. This notice explains how we handle personal information in connection with the OERC website (oerc.com.au) and the OERC beta. We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We apply the APPs whether or not the Act currently requires us to, and this notice is written to remain accurate if it does.

OERC serves environmental and regulatory reference data: rows from the NOPSEMA EP register and spatial intersects with protected-matters layers. That data is about activities, places and organisations. We do not sell personal information. Where a Commonwealth source record names an individual (for example a nominated environment plan contact), OERC reproduces it as published by the source and adds nothing to it.

2. What we collect and how (APP 3, APP 5)

We collect personal information directly from you, or from a colleague who nominates you for the beta. If you nominate someone, please tell them and point them to this notice.

• Beta applicants - your name, employer, role, work email address and what you intend to use OERC for. This arrives by email to [email protected] when you use the "request beta access" link, which opens a pre-filled email in your own mail client.
• Key holders - your name and organisation, recorded in a private access register so we know who each beta key belongs to.
• Service logs - when your agent calls OERC, we log the key identifier, the tool called, timing, and content hashes. These logs contain no names or email addresses. Because a key identifier can be matched to a name through the access register, we treat these logs as personal information and protect them accordingly.
• Feedback - notes from the beta feedback call, held in our email and document system.

The website sets no cookies, runs no analytics, loads no third-party scripts and has no forms. It is delivered by Cloudflare, which processes connection data (such as your IP address) to serve the pages under Cloudflare's own terms; we do not collect that data into our own records or use it to identify anyone.

3. Why we collect it (APP 6)

We use personal information to assess beta applications; issue, administer and revoke keys; operate and secure the service; hold the feedback call; improve the product; and meet our legal obligations. We do not use it for marketing, we do not build marketing lists, and we do not use it for any purpose you would not reasonably expect from the above.

4. Who can see it (APP 6, APP 8)

Access is limited to the people running the beta at Ambidex. We do not disclose personal information to anyone else, except to the service providers below or where the law requires or authorises it, and we do not sell it.

Our service providers hold data on our behalf:

• Microsoft 365 - email and documents, held in Microsoft's Australian data centres.
• GitHub - the private access register, hosted in the United States.
• Cloudflare - website hosting and delivery over a global network; connection data may transit or be processed outside Australia.

Where a provider holds or processes data outside Australia, that is a service arrangement on our behalf rather than a disclosure to a new recipient. We will notify you if this changes.

5. How we protect it (APP 11)

We keep the access register in a private repository, limit access to the people running the beta, and can revoke any key at any time. Service logs carry key identifiers, not names. We do not claim any certification or security standard; the measures above are what we do.

6. How long we keep it (APP 11.2)

Beta applications, the access register and feedback notes are deleted or de-identified within three months after the beta ends, unless we must keep them to meet a legal obligation. Service logs are kept for beta evaluation and security during the beta, then aggregated or deleted on the same schedule. If you join a later paid service, we will publish a new notice covering it.

7. Access and correction (APP 12, APP 13)

You can ask to see the personal information we hold about you, or ask us to correct it, by emailing [email protected]. We respond within a reasonable period. If we decline a request we will tell you why.

8. Complaints

If you have a concern about how we have handled your personal information, please email [email protected] first and we will look into it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

9. Data breaches

If personal information we hold is lost or accessed without authorisation and this is likely to result in serious harm, we will notify you and the OAIC where the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988) requires it, and we will tell you what happened and what you can do.

10. Changes to this notice

If we change this notice we will publish the new version, with its date, on this page.

11. Contact

Ambidex R&D Pty Ltd (ABN 16 696 857 995) Email: [email protected] Postal address: [ADDRESS - Matt to confirm]

OERC is an independent reference layer. It is not endorsed by or affiliated with NOPSEMA and is not a substitute for the EP content requirements. Beta - not for use in a regulatory submission.