Privacy Policy

1. About This Policy

This Privacy Policy explains how Armstrong Automations (Tayne Armstrong, sole trader, ABN 61 583 358 292, trading as Armstrong Automations, Perth Western Australia) collects, holds, uses, and discloses personal information in connection with the services we provide.

This Policy covers two categories of people whose personal information we may handle:

• Our business clients — the tradies and small businesses who engage Armstrong Automations for automation services ("Clients"); and
• End customers of our Clients — the customers of Perth tradies who submit job requests or booking enquiries through systems built by Armstrong Automations ("End Customers").

Armstrong Automations aims to handle personal information responsibly and consistently with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth), as well as the spirit of those principles in all our operations.

2. Information We Collect

2.1 Information From Our Clients

When a tradie or business engages Armstrong Automations, we collect the following information directly from them:

• Full name, preferred name, and business name
• ABN and trade licence number
• Mobile phone number and business email address
• Business address and suburbs serviced
• Emergency contact details
• Website domain and Google Business Profile details
• Brand assets (logo, colours)
• Service descriptions and business notes
• Payment information (processed via third-party payment processor)

This information is used to build, configure, and operate the Client's automation system, and to communicate with the Client about their services and account.

2.2 Information About End Customers

Through the systems we build and operate for Clients, Armstrong Automations may receive personal information belonging to the Client's end customers, including:

• Full name
• Email address
• Phone number
• Residential or job site address
• Nature of the job or service requested
• Booking date and time

This information is submitted by End Customers through contact forms or booking systems on the Client's website, and flows into the Client's Google Sheets backend and Google Calendar. Armstrong Automations processes this information solely as a service provider acting on behalf of the Client. The Client is responsible for having appropriate privacy notices in place when collecting this information from their customers.

2.3 Information We Do Not Collect

Armstrong Automations does not collect:

• Sensitive information (health information, financial account details, government identifiers beyond ABN and trade licence)
• Information from individuals under the age of 18
• Unsolicited personal information

3. How We Collect Information

3.1 Direct Collection from Clients

We collect Client information through our onboarding form (hosted on Tally), direct email and phone communication, and the client's Google Business Profile where relevant.

3.2 Collection Through Client Systems

End Customer information is collected through contact forms and booking widgets embedded in the Client's website. This information is captured via automated workflows and stored in the Client's dedicated Google Sheets database. Armstrong Automations handles this data as a processor on behalf of the Client.

3.3 Automated Collection

Our infrastructure may collect limited technical data including IP addresses in access logs, website usage data processed by Cloudflare's network, and system performance data for monitoring purposes. This technical data is not linked to individual identities and is used only for infrastructure security and maintenance.

4. Why We Collect Personal Information

Armstrong Automations collects and uses personal information for the following purposes:

5. Our Role as a Data Processor

Armstrong Automations is a service provider, not an independent data controller for End Customer data.

When we handle personal information about a Client's end customers, we do so as a data processor acting on the Client's behalf and under the Client's direction. This means:

• We do not independently market to End Customers
• We do not contact End Customers for any purpose other than delivering the services the Client has engaged us for
• We do not sell, share, or disclose End Customer data to any third party for independent purposes
• We only process the minimum data necessary to deliver the relevant service

The Client (the tradie) is responsible for their own compliance with privacy obligations when collecting and sharing their customers' personal information with Armstrong Automations.

6. Data Retention

7. Disclosure of Personal Information

7.1 Third-Party Service Providers

Armstrong Automations uses the following third-party platforms to deliver its services. Personal information may be processed by these platforms in accordance with their own privacy policies:

Where personal information is transferred to overseas recipients (including Google, Cloudflare, and Hetzner), Armstrong Automations takes reasonable steps to ensure those recipients handle the information in a manner consistent with the Australian Privacy Principles.

7.2 No Sale or Unauthorised Disclosure

Armstrong Automations will never sell, rent, or trade personal information. We will not disclose personal information to any third party except:

• As described in section 7.1 (service providers engaged to deliver our services)
• Where required or authorised by Australian law or a court order
• With the prior written consent of the individual or Client concerned
• In connection with a sale or transfer of the Armstrong Automations business, where the recipient is bound by equivalent privacy obligations

8. Data Security

Armstrong Automations implements commercially reasonable technical and organisational security measures to protect personal information against unauthorised access, disclosure, modification, and loss. These measures include:

• All data in transit encrypted via HTTPS/TLS enforced through Cloudflare
• Public web traffic routed through encrypted Cloudflare tunnels, minimising direct exposure of server infrastructure
• Geographic access controls restricting traffic to Australian IP addresses
• Rate limiting and bot protection via Cloudflare WAF
• Access credentials stored in environment variables — never hardcoded
• SSH key-only authentication with password authentication disabled
• Automated brute-force protection (fail2ban)
• 24/7 automated uptime and health monitoring

No method of transmission or storage is 100% secure. In the event of a data breach that is likely to result in serious harm, Armstrong Automations will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

9. Your Rights

9.1 Access

You have the right to request access to the personal information Armstrong Automations holds about you. We will respond to access requests within 30 days. In most cases we will provide access free of charge, however we reserve the right to charge a reasonable fee for complex requests.

9.2 Correction

If you believe personal information we hold about you is inaccurate, incomplete, or out of date, you may request that we correct it. We will respond to correction requests within 30 days.

9.3 Deletion

You may request deletion of personal information we hold about you, subject to our obligations to retain certain records for legal and operational purposes. Requests will be assessed individually and we will notify you of the outcome within 30 days.

9.4 Complaints

If you have a complaint about how Armstrong Automations has handled your personal information, please contact us at the details in section 12. We will investigate and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

10. Website and Cookies

The Armstrong Automations website is hosted on Cloudflare Workers. Cloudflare may set technical cookies for security, performance, and bot detection purposes. Armstrong Automations does not use tracking cookies, advertising cookies, or analytics cookies.

Client websites built and hosted by Armstrong Automations operate under this same principle. No third-party advertising or tracking scripts are embedded in client websites without explicit instruction from the Client.

11. Changes to This Policy

Armstrong Automations may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or operational practices. The current version of this Policy is always available at armstrongautomations.com/privacy.

Where changes are material, existing Clients will be notified by email at least 14 days before the changes take effect.

12. Contact Us

For any privacy-related enquiries, access requests, correction requests, or complaints, please contact: