Privacy Notice

Privacy, access and complaints — collection and purposes

the organisation identified on the campaign is the client using this campaign platform and has access to the personal information collected through it. The client determines its purposes of use, authorised personnel, communications and lawful disclosure, subject to applicable law and the consent or permissions relevant to that information.

Depending upon the campaign, information may include your name, email address, telephone number, address or postcode, personalisation text, generated communications and a record of participation or support. Political opinions and affiliations disclosed in that information may constitute sensitive information. Information is processed to administer the campaign, record participation where collection is enabled, prepare communications and facilitate the action you request. Optional fields may be left blank; absence of required information may prevent the requested action.

The client has access to collected contact and participation data, including for its marketing, supporter communications and engagement activities. Such access does not dispense with any consent, purpose limitation, identification or opt-out requirement imposed by applicable law. Agreement to these service terms does not, of itself, constitute consent to unrelated direct marketing.

Privacy — recipients, processing and retention

Access may be provided to the client’s authorised personnel and to service providers and administrators to the extent reasonably necessary to operate, support and secure the service. Technical records may include IP addresses, browser details, timestamps, activity events and consent records. Staff authentication tokens and preferences may be retained in browser storage.

Campaign instructions and personalisation text may be processed by configured AI services, including Google Gemini or OpenAI. Do not include unnecessary information about yourself or another person. Email and social providers, elected representatives, committees and other selected recipients handle material you elect to send or share under their own arrangements; their publication, response and retention practices are not controlled by these terms.

Hosting, database and other service providers may process information outside Australia. The applicable providers and destination countries depend on the service configuration; a complete country list has not yet been verified. Current particulars may be requested at the contact below before submission. No provision of these terms waives an applicable cross-border privacy obligation.

Access controls and other reasonable safeguards are used, but absolute security cannot be warranted. Records are not presently subject to a single automatic deletion period. Retention is to be assessed against the collection purpose, legal obligations and any applicable preservation requirements; information no longer required should be securely destroyed or de-identified. Backup copies and information already supplied to recipients may be subject to separate lawful retention arrangements.

Service provider

Civipen is the technology service supplied by Overton Solutions to the client. Overton Solutions is the platform provider, not the organiser of the client’s campaign, and does not determine the client’s political position or marketing strategy. Provision of the technology does not displace any privacy or other statutory obligation that independently applies to either the client or the provider.

Privacy — access, correction, withdrawal and complaints

Requests concerning access, correction, withdrawal of consent, appropriate deletion or a privacy complaint may be directed to info@overton.solutions. Identify the client and campaign concerned and the email address used. Enquiries concerning the client’s records or communications may need to be referred to that client. Reasonable verification of identity may be required before personal information is released or amended; do not send passwords, authenticator codes or identity documents unless an appropriate secure process has been agreed.

Withdrawal of consent operates prospectively and does not reverse a communication already delivered or processing lawfully undertaken. Access, correction and deletion requests are subject to applicable law, including lawful exceptions and retention requirements. For marketing communications, use the sender’s unsubscribe facility or request that further marketing cease; the client remains responsible for compliance with applicable opt-out requirements.

Complaints should receive a prompt acknowledgement, with an intended substantive response within 30 days. If unresolved, a complaint may be made to the Office of the Australian Information Commissioner where it has jurisdiction. Suspected breaches must be assessed and notifications made to affected individuals and regulators where required by the applicable Notifiable Data Breaches regime.