Privacy

1. Who we are and what this covers

Kit Catalogue is an asset register. You photograph the things your business owns, and we identify them, read their plates and serials, describe them and put a value on them.

This policy is issued by NEWEX GLOBAL PTY LTD (ABN 83 703 303 682), of Level 9, Wyndham Building, 1 Corporate Court, Bundall QLD 4217, Australia, and covers the Kit Catalogue phone app, the web app at app.kitcatalogue.com, and this website. It explains what we collect, why, who else sees it and what you can ask us to do about it.

Where this policy talks about personal information it means the same thing as “personal data” under the UK and EU GDPR and “personal information” under the Australian Privacy Act 1988 and the laws of the other places we operate.

For the register you build, and the photographs in it, you are the one who decides what goes in and why. In UK and EU terms you are the controller of that content and we are your processor. For your own account we are the controller. That means your email address, your sign-in history and what you were charged.

2. What we collect

What you give us. Your email address when you sign in. Your business name, ABN, address and industry if you fill them in. The photographs you take or upload, and anything you type or correct on a record, such as makes, models, serials, registrations, sites, purchase prices and notes.

What the app records as you work. Which records you created and changed and when, how long a capture took, how many photographs you took, the model of phone, and the credits an analysis used.

What we log to keep the service running. IP address, approximate location derived from it, browser or app version, and the requests your device makes to our API, including the time and result.

We do not ask for, and ask you not to send us, government identifiers such as tax file numbers, health information, or payment card numbers. We do not collect your credit information and we are not a credit reporting body.

3. Photographs, and what else is in them

This is the part of the product most likely to surprise you, so it gets its own section.

A photograph of a machine on a factory floor is a photograph of the factory floor. It may also contain a person walking past, another business’s equipment, a street, or a registration plate. We read registration plates and serial numbers as text and store them, because that is what makes a register worth having. In Australia a registration number can identify the registered owner of a vehicle, so we treat it as personal information.

We do not keep photographs of people, and we take active steps to make sure of it. Every photograph is checked, as part of the analysis that identifies the equipment, for whether somebody in it is recognisable. When one is, that photograph is deleted from our storage and removed from your record, and you are asked to retake it with nobody in frame. We keep a count of how many were removed, so we can tell you there is something to retake. We do not keep the photographs, and we do not keep their filenames.

Be clear about what that check is. It tells us that a person is present. It does not tell us who they are. We do not run face recognition, we do not try to identify people in your photographs, and we do not build profiles of anybody who appears in one. No check of this kind catches everything, so it is a safety net and not a substitute for pointing the camera at the machine.

The one thing we do read off a photograph that can identify a person is a registration plate, described above, because a register of vehicles without registration numbers is not a register. If you would rather we did not, do not photograph the plate.

You are responsible for having the right to photograph what you photograph. If you catalogue plant on somebody else’s site, or equipment you hire out, that is a judgement only you can make.

4. Why we use it

We use what we collect to:

• identify, describe and value the assets you photograph, and keep those values moving as the schedule says they should;
• build and show you your register, your exports and your reports;
• sign you in, and tell you when something you started has finished or failed;
• meter and charge for usage, and show you what you have left;
• keep the service up, find and fix faults, and defend it against abuse;
• improve accuracy, subject to the limits set out in the next section;
• meet our legal obligations, and establish or defend legal claims.

Where UK or EU law applies, our lawful bases are: performance of a contract for running the service and billing you; legitimate interests for security, fault-finding and improving accuracy; consent where we ask for it; and legal obligation where we must.

5. Automated processing, and what we do not do with your photographs

Identifying an asset from a photograph is done by a machine-learning model, and the photograph is sent to a model provider to do it. Reading a plate, describing a machine and proposing a value are all automated. Nothing about your register is reviewed by a person at Kit Catalogue in the ordinary course of business.

Every automated answer is editable. Any field the product fills in, you can correct, and your correction wins. Values are estimates with a visible range and a confidence rating, not determinations. No automated decision we make produces a legal or similarly significant effect on anybody within the meaning of Article 22 of the UK and EU GDPR.

We do not sell your data, and we do not give anybody access to it beyond the processors listed below.

We may use it to improve the product. That covers the corrections you make, the fact that a model said one thing and you said another, and it covers your photographs and the records built from them, used to train and evaluate the models that identify, read and value equipment. We do not publish your content and we do not identify your business in it. Tell us if you would rather your account were excluded, and we will exclude it.

6. Who else sees it

We do not describe your data as “never shared”, because running the product means other companies process parts of it on our behalf. They fall into five groups:

• Hosting. Your register, your photographs and your account sit on infrastructure somebody else operates, in Sydney, Australia.
• Analysis. At the moment an asset is analysed, your photographs and its description are sent to an AI model provider in the United States. This is the one that matters most, so it is said plainly rather than left inside a category: identifying and valuing a thing is what the product does, and it cannot be done without showing somebody else the picture.
• Lookups. Search terms built from an asset’s description, such as a make, model and year, and a vehicle identification number when one is decoded. Not your photographs. United States.
• Email delivery. Your address and the message, when we send you a sign-in code or a summary. United States.
• Payments. When you pay for a plan, your email address, your plan and how far your account is over what it includes, so you can be billed. The card and billing details you enter at checkout go to our payments provider directly and never reach us. United States.

Every one of them is named, with what it receives and where it is, on our list of subprocessors. It lives on its own page so that changing a supplier does not mean reissuing this policy, and so you can check the current list rather than a copy of it that was true when this page was last dated. If we add a processor that handles personal information we will update that page, and where the law requires it we will tell you before it takes effect.

We will also disclose information if we are required to by law, to enforce our terms, or to protect the rights and safety of our users or the public. If our business is sold or merged, your information may transfer with it, subject to this policy.

And anybody you publish to. Two features put part of a record in front of people outside your account, and only ever because you switched them on for a particular item. A sale page shows the photographs, details and asking price you chose, your business name, and the contact details you ticked. An instructions page shows the title and text you wrote and the record fields you chose: set to your team it needs a sign-in, set to public it does not, and anybody who scans the label or is sent the link can read it. Registration, serial and VIN are never shown on a public one. Neither kind of page is listed in search engines. Taking a page down stops its link working for everybody, including anyone who already has it.

7. Where it is processed

Your register, your photographs and your account are stored in Sydney, Australia.

Analysis is not. When a photograph is identified, valued or decoded, it is sent to the providers on our list of subprocessors, which process it in the United States. Search terms and vehicle identification numbers go the same way.

Where Australian law applies, this is a cross-border disclosure under Australian Privacy Principle 8, and we take reasonable steps to ensure those recipients handle your information consistently with the APPs. Where UK or EU law applies, we rely on the UK International Data Transfer Addendum and the European Commission’s Standard Contractual Clauses.

8. How long we keep it

Your register stays until you delete it or close your account. We do not quietly expire records: a register you stop paying for is a register you can still get back.

• Assets and photographs, until you delete them, or until you close the account.
• Account and billing records, for seven years after your last transaction, which is how long Australian tax law requires us to keep them.
• Sign-in codes, ten minutes.
• Service logs, up to twelve months.
• Corrections used for accuracy measurement, kept without the photograph, and without anything that identifies you or your business.

9. How we protect it

Your data is encrypted in transit and at rest. Access to production systems is limited to the people who need it. Each organisation’s register is isolated from every other, and that isolation is tested on every route as part of our build.

Signing in uses a single-use six-digit code sent to your email address, which expires in ten minutes. There is no password to steal or reuse.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify you and the relevant regulator as the law requires. In Australia that is under the Notifiable Data Breaches scheme; in the UK and EU, within 72 hours of becoming aware.

10. Your choices

Emails. We send three kinds: getting-started guidance, product updates, and notices about your account. The first two carry an unsubscribe link, and honouring it does not require you to sign in. You can also switch each kind on and off whenever you like, under Email in your profile, so turning one off does not turn the others off with it. Notices about your account, including sign-in codes, are not marketing and cannot be turned off while your account is open.

Marketing. We do not sell your details to anybody and we do not use your register to advertise to you.

Dealing with us anonymously. You can ask us general questions without identifying yourself. You cannot hold a register anonymously, because a register has to belong to somebody.

Cookies. The web app sets one cookie, which keeps you signed in. This website uses Google Analytics to count visits and see which pages are read, which sets cookies that recognise a returning browser. Google discards the full IP address before storing anything, we do not use it for advertising, and we have not linked it to any advertising product. Your browser settings, or any tracker blocker, will stop it, and nothing on this site stops working if you do. The product itself carries no advertising or analytics trackers.

11. Getting at it, correcting it and deleting it

You can see and correct most of what we hold from inside the product: every field on a record is editable, and every export contains what we have.

To ask for a copy of everything, to have something corrected that you cannot correct yourself, or to have your account and its contents deleted, email privacy@kitcatalogue.com. We will respond within 30 days.

Deleting an asset removes its record and its photographs. Closing an account removes its register, its photographs and its users. We may keep billing records for the period set out above, and backups take up to 35 days to age out.

If we refuse a request we will tell you why in writing, and how to take it further.

12. Children

Kit Catalogue is a product for businesses and is not directed at children. We do not knowingly collect personal information from anybody under 16. If you believe a child has given us information, contact us and we will delete it.

13. Your rights where you are

The rest of this policy applies to everybody. This section adds what your own law gives you.

Australia

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may request access to, and correction of, your personal information under APP 12 and APP 13. You may deal with us anonymously or by pseudonym where it is lawful and practicable, as APP 2 requires.

If you are not satisfied with how we have handled a privacy matter, you may complain to the Office of the Australian Information Commissioner: oaic.gov.au, or 1300 363 992. We ask that you raise it with us first so we have the chance to put it right.

United Kingdom and European Economic Area

You have the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it, to portability, and to withdraw consent where we relied on it. Where we rely on legitimate interests you may object, and we will stop unless we have compelling grounds not to.

You may complain to your local supervisory authority. In the UK that is the Information Commissioner’s Office: ico.org.uk.

California

In the twelve months before this policy was issued we collected the categories of personal information described in “What we collect”, for the purposes described in “Why we use it”. We have not sold or shared personal information as those terms are defined by the CCPA, and we do not do so now. You may request access, deletion and correction, and we will not discriminate against you for asking.

Canada

We handle personal information in accordance with PIPEDA. You may request access and correction, and complain to the Office of the Privacy Commissioner of Canada.

South Africa

We handle personal information in accordance with POPIA. You may request access and correction, object to processing, and complain to the Information Regulator.

14. Changes to this policy

We will update this page when the product changes. The date at the top tells you when. If a change materially affects how we handle your information, we will tell you by email or in the app before it takes effect, rather than relying on you to re-read this page.

15. Contact us

For anything in this policy, including access, correction, deletion and complaints, email privacy@kitcatalogue.com, or write to NEWEX GLOBAL PTY LTD, Level 9, Wyndham Building, 1 Corporate Court, Bundall QLD 4217, Australia.

Please do not send sensitive information by email. If we need to verify who you are before acting on a request, we will tell you what we need and why.