Privacy Policy
Privacy, scientific data and digital services
DIVERSITY ARRAYS TECHNOLOGY PTY LIMITED
ACN 097 662 514 | ABN 47 097 662 514
Version 2026 v0.27 (draft for review, supersedes v0.7)
Last updated: 18 September 2026
Effective date: September 30, 2026
Privacy at a glance
What we collect. Your name, email, organisation and the details you give us when you order, ask a question or use our services. In our field apps: the observations, photos, audio and GPS locations you record.
Why. To run your account, deliver the services you or your organisation ordered, keep our systems secure and improve our apps.
What we do not do. We do not sell your information. We do not use it for advertising.
Who sees it. The organisation that owns the project you work on, and the providers that help us run our services (listed in Appendix B).
Where it goes. Mostly Australia. Some providers are in the United States, New Zealand and Europe. We use standard contract clauses to protect it.
Your choices. Manage app permissions in your device settings. Unsubscribe from any email. Delete your account at www.diversityarrays.com/corporate-information/privacy-policy-delete/.
Questions. privacy@diversityarrays.com.
1. Who we are and what this policy covers
We are Diversity Arrays Technology Pty Limited (DArT, we, us), a Canberra company. We run laboratories and build software for plant and animal breeding, ecology and biosecurity.
This policy explains how we handle personal information across:
• our websites, online ordering and customer support;
• the OneDArT platform, including sign-in and the Engagement Hub;
• our laboratory, sequencing and data-processing services;
• our web applications, including NatureIQ and the Ecologue web app;
• our mobile apps, Ecologue and KDSmart (see Appendix A); and
• our newsletters and customer communications.
We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the GDPR, the UK GDPR or another privacy law applies to you, section 15 explains the extra rights you have.
2. Some words we use
Personal information is information about a person who is identified or could reasonably be identified. Under the GDPR the term is “personal data”; we use the two interchangeably.
Sensitive information means information about health, genetics, race, religion, politics, sexuality or criminal record. We do not ask for it and we do not need it. Our sequencing and genotyping services work on plants, animals, insects and other non-human organisms. We do not process human genetic data.
Scientific data means the observations, samples, sequences, measurements and results that our services produce or store. Most of it is not about people. Where a record can be linked to a person, for example a GPS point tied to the person who recorded it, we treat that part as personal information.
Your organisation or project owner means the customer, research body or agency that owns the project you work on and gave you access to our services.
3. Information we collect
3.1 Information you give us
- Your name, email, phone number, organisation and role.
- Your OneDArT account details.
- Orders, delivery and billing details, and the samples and projects they relate to.
- Questions, support requests and other messages you send us.
- Newsletter sign-ups and communication preferences.
- In our apps: field observations, measurements, notes, barcodes, photos, video, audio recordings and the GPS position of each record.
3.2 Information collected when you use our services
- Sign-in events, session details and your IP address.
- The pages and screens you use, and the path you take through a service.
- Browser, operating system, device type and screen size.
- Error, crash and performance reports.
- In our apps: GPS accuracy, timestamps, app version and, if you turn it on, your survey track while the screen is locked (Appendix A).
3.3 Information from other sources
Your organisation may give us your details when it sets up your access. Sequencing facilities and scientific partners send us results for the samples we process. Our own systems pass information between each other, for example from ordering to the laboratory to invoicing, so that we can deliver what you asked for.
4. Why we use information, and our legal basis
In Australia, we collect personal information only where it is reasonably necessary for our functions, and we use and disclose it for the purpose we collected it for, for related purposes you would reasonably expect, with your consent, or where the law requires (Australian Privacy Principles 3 and 6). Direct marketing always carries an opt-out (Principle 7).
We use information only for the reasons below. The right-hand column is the legal basis where the GDPR or UK GDPR governs your data; Australian law does not require a basis to be named for each purpose.
| Purpose | Legal basis |
|---|---|
| Deliver the services you or your organisation ordered, including processing samples, storing results and running the apps | Contract |
| Create and manage your account, sign you in and control what you can access | Contract; legitimate interests (security) |
| Answer questions and provide support | Contract; legitimate interests |
| Invoice, collect payment and keep financial records | Contract; legal obligation |
| Keep our systems secure, detect misuse and investigate incidents | Legitimate interests; legal obligation |
| Understand how our services are used and fix problems | Legitimate interests; consent for non-essential cookies |
| Send newsletters and marketing | Consent, or legitimate interests for existing customers with an easy opt-out |
| Use device location, camera or microphone in an app | Your permission on the device; contract |
| Meet legal, tax, regulatory and biosecurity obligations | Legal obligation |
5. Our systems and what they hold
Most of the software that handles your information is built or hosted by us. This section describes each system: what it is, what it holds and what we use it for. Appendix B lists the same systems in one table.
5.1 Website enquiries
When you contact us through a website form we record your name, email, organisation and message so we can reply. Enquiries are logged in Zammad, our support system (section 5.6), and may be added to HubSpot, our customer relationship system (Appendix B), so that the right person follows up. Sending an enquiry does not sign you up to marketing.
5.2 Sign-in (Keycloak)
OneDArT uses Keycloak, an open-source identity service that we host on our own servers, so that one account signs you in to every DArT application.
It holds: your name, email address, username, organisation, and the roles, groups and permissions that decide what you can see and do. It also keeps sign-in and access logs.
We use it to: sign you in once for all DArT applications, give each application only the details it needs, administer accounts, keep audit records, and block unauthorised access. Access is controlled by role and, where needed, by attributes such as your organisation or project.
5.3 OneDArT Engagement Hub
The Engagement Hub is the web portal through which you reach DArT applications and services. Depending on what you use, it handles identity, organisation, customer, order, project, scientific, technical and usage information. It passes information between DArT systems only where needed to sign you in, run the feature you asked for, fulfil an order, provide support or deliver results. Moving information between our own systems is not a disclosure to anyone else.
5.4 Online ordering
Our ordering system is built and run by us and is connected to our laboratory and accounting systems.
It holds: name, email, phone number, organisation, account identifiers, billing and delivery details, order and project details, the services you selected, and the sample details needed to do the work.
We use it to: process and deliver orders, communicate with you about them, deliver results, issue and reconcile invoices, provide support, and meet tax, accounting and contract obligations. Orders flow to dartDB (section 5.5) for laboratory processing and to Xero (Appendix B) for invoicing. If you pay by card, the card details go straight to the payment provider and we never see them.
5.5 Laboratory system (dartDB)
dartDB is the laboratory information management system we built and run ourselves. It tracks every order, sample and result through the laboratory.
It holds: customer and contact details, orders, sample identifiers and sample details, laboratory workflow records, results, quality records and links to sequence data.
We use it to: manage customer relationships and orders, receive and track samples, run laboratory and scientific services, deliver results, keep quality and operational records, provide support, and meet scientific, financial and regulatory requirements. Some sequencing is done by partner facilities, and results may pass through a sequencing platform before reaching our storage; Appendix B names them.
5.6 Support and project systems
We track support requests, projects, incidents, bugs and change requests in systems we host ourselves: Zammad for support tickets, and Redmine and OpenProject for projects and issues. Some software issues are also tracked in Atlassian Jira (Appendix B).
They hold: your contact details, correspondence, support requests, issue descriptions, project details, and whatever you attach, such as screenshots, exported files, logs or diagnostic details.
We use them to: answer your requests, fix problems, plan and deliver work, and keep a record of what was done. We avoid putting personal, scientific or customer information in a ticket unless it is needed to resolve the issue, and we ask you to do the same when you attach files.
5.7 File storage (Nextcloud)
We store customer, scientific and project files on file servers and Nextcloud services that we run ourselves, not in third-party file-sharing products.
They hold: files you send us, scientific and research data, project information, reports, sequence-related files and the documents needed to deliver our services.
Access is limited to the DArT staff and systems that need it for their role, and access is audited.
6. Scientific data and who can see it
Scientific data belongs to the project it was collected for. Your organisation and its project administrators can see, export, edit and delete the records collected under that project, including the photos, audio and GPS points that field workers record.
Our apps require a precise GPS position on every record because a scientific record is only useful if its location is accurate.
Contracts with customers, research partners and data providers may set further rules about ownership, sharing and retention of scientific data. Where they do, those rules apply alongside this policy.
7. Our mobile apps
Ecologue and KDSmart are field data collection apps. They use your device’s location, camera and microphone only for the records you create, and only after you grant permission. Appendix A describes each app in full: what it collects, which permissions it asks for and why, what leaves your device, which third-party components it contains, and how to turn features off.
In short:
- Precise GPS is captured when you save a record. Optional background tracking during surveys is off by default.
- Photos, video and audio are attached to records only when you add them.
- Records stay on your device until they sync to your project.
- The apps contain no advertising components and do not track you across other apps.
8. Cookies and analytics
Our websites and web apps use cookies and similar storage for three things:
- Essential: keeping you signed in, remembering preferences and protecting against misuse. These always run.
- Analytics: a self-hosted copy of Matomo that shows us which pages are used and where people get stuck. Data stays on our servers. IP addresses are shortened before storage. It is not shared with Matomo or anyone else.
- Marketing: on our public website, HubSpot tracking links your visits to your contact record so our team can follow up on enquiries. This runs only after you accept it in the cookie banner. It does not run inside OneDArT or the apps.
You can change your choice at any time from the “Cookie settings” link in the website footer. Our mobile apps do not use cookies. Crash reporting in the Android app is covered in Appendix A.
9. Marketing and newsletters
We send newsletters and product news through Listmonk, a mailing system we host on our own servers. We record your name, email, organisation, subscription status and whether you opened an email or clicked a link.
Every marketing email has an unsubscribe link. Unsubscribing does not stop service messages such as order confirmations, security alerts or account notices.
10. Who we share information with
We do not sell personal information, and we do not share it for advertising.
We share information only with:
- Your organisation and project owner, as described in section 6.
- Service providers that host, store, transport or process information for us. They may use it only to provide their service to us. Appendix B lists them, what they do for us, and where they are.
- Authorities where the law requires us to disclose information, for example under biosecurity or tax law.
- Professional advisers such as lawyers, auditors and insurers, under confidentiality.
Every third party that receives personal information from us must protect it to at least the standard described in this policy, and we put that in writing through contracts or data-processing terms.
11. Where information is stored and sent
Most of our systems run in Australia. The OneDArT platform runs on Amazon Web Services in Sydney, and our scientific data storage with Wasabi is also in Sydney. Some providers and deployments store or process information overseas:
- United States: Mapbox, HubSpot, Atlassian and Google (Firebase, Android only).
- New Zealand: Xero.
- Germany (Frankfurt): some KDDArT deployments, the platform behind KDSmart and KDManage, run on Amazon Web Services in the EU where a customer’s project or data-residency agreement requires it.
- Illumina BaseSpace region.
When personal information leaves Australia, the EU or the UK, we protect it with standard contract clauses. These are the European Commission’s Standard Contractual Clauses or the UK Addendum. We add security measures suited to the data.
12. How we protect information
We use controls appropriate to the sensitivity of the information, including:
- sign-in with role-based access, so people see only what their role needs;
- customer and project files kept in Nextcloud storage on our own servers, not in third-party file-sharing services;
- encryption in transit (HTTPS/TLS) for all traffic between your device and our services;
- encryption at rest for sign-in tokens on mobile devices, for cloud storage and for backups;
- network separation, firewalls, logging, monitoring and alerting;
- vulnerability management and regular patching;
- staff access limited to those who need it, with access audited; and
- a tested incident-response process.
No system is perfectly secure. If a breach is likely to cause serious harm, we will notify you and the regulator as the law requires (section 18).Most of our systems run in Australia. The OneDArT platform runs on Amazon Web Services in Sydney, and our scientific data storage with Wasabi is also in Sydney. Some providers and deployments store or process information overseas - United States: Mapbox, HubSpot, Atlassian and Google (Firebase, Android only).
- New Zealand: Xero.
- Germany (Frankfurt): some KDDArT deployments, the platform behind KDSmart and KDManage, run on Amazon Web Services in the EU where a customer’s project or data-residency agreement requires it.
- Illumina BaseSpace region.
When personal information leaves Australia, the EU or the UK, we protect it with standard contract clauses. These are the European Commission’s Standard Contractual Clauses or the UK Addendum. We add security measures suited to the data.
13. How long we keep information
Information | How long |
Account details | While your account is active, then 2 months |
Enquiries and support tickets | 3 years after the matter closes |
Orders, invoices and payment records | 7 years, as Australian tax law requires |
Sign-in and security logs | 365 days (user events) |
Website analytics | 3 months, with IP addresses shortened on collection. |
Newsletter subscriptions | Until you unsubscribe; your address then stays on a do-not-send list |
Android crash reports (Firebase) | 90 days |
Scientific data and results | Archived and kept indefinitely, unless your organisation asks us to remove it |
Sequence data in cloud storage | Archived and kept indefinitely, unless the customer for that project asks us to remove it |
Scientific data, results and sequence data are archived and kept indefinitely because they underpin published research, breeding programs and long-term ecological monitoring. The organisation that owns a project can ask us to remove its data at any time, and we will do so unless a contract or the law requires us to keep it.
Personal information is different. Where a personal-information period above ends, we delete the information or remove anything that identifies you. Where a person’s details are attached to a scientific record, for example the name of the person who recorded an observation, we remove or replace the personal details when the period ends and keep the scientific record. Backups are overwritten on a rolling cycle.
14. Deleting your account and your data
You can ask us to delete your OneDArT account and the personal information linked to it at any time:
• in the Ecologue or KDSmart app, open About and tap Request account or data deletion; or
• go to the privacy policy delete page and follow the steps.
We confirm the request by email and complete it within 30 days (Canberra, Australia), or sooner where the law requires. We remove your name, email, phone number and account. We keep only what the law or a contract requires, such as invoices for tax records and security logs, and we tell you what that is.
Records you created for a project, such as observations, photos and tracks, belong to that project and stay with it. We remove your name from them. If you want those records removed, ask your project owner.
If you only want some data deleted, for example one project’s records or your marketing profile, tell us and we will do that instead.
15. Your rights and choices
Things you can do yourself
Turn location, camera, microphone or photo access on or off in your device settings. Features that need a permission will stop working until you turn it back on.
- Turn background survey tracking off in the app’s Preferences.
- Turn Mapbox telemetry off by tapping the (i) button on any map.
- Unsubscribe from any marketing email.
- Change your cookie choices from the website footer.
Things you can ask us for
- A copy of the personal information we hold about you.
- Correction of anything that is wrong or out of date.
- Deletion (section 14).
- To stop or limit how we use your information, or to object to a use based on our legitimate interests.
- A copy of your data in a portable format.
- To withdraw consent you gave earlier. Email privacy@diversityarrays.com. Withdrawing consent does not affect what we did before, and it may mean a feature no longer works.
We may ask you to confirm your identity first. We answer within 30 days. If we cannot do what you ask, we tell you why.
If your organisation is the controller of your data, for example for records in a project it owns, we may refer your request to it and help it respond.
If your organisation needs a data processing agreement with us, or a list of the providers we use, contact the Privacy Officer. Appendix B is our current provider list.
Extra rights in the EU and UK
Where the GDPR or UK GDPR applies, you also have the right to complain to your local data protection authority. Our representative for privacy matters in the EU and the UK is Gavin Tomlins, who can be contacted at privacy@diversityarrays.com.
16. Children
Our services are not directed to children under 16, and we do not knowingly collect personal information from them. Project owners must not give app access to anyone under 16 without appropriate consent from a parent or guardian. If you believe a child has given us personal information, contact us and we will delete it.
17. Automated decisions
We do not use computer programs to make decisions about you that significantly affect your rights or interests. If that changes, we will update this policy and tell you before it happens.
18. Data breaches
We have a process to detect, assess and respond to suspected breaches. Where a breach is likely to result in serious harm, we notify affected people and the Office of the Australian Information Commissioner, and any other regulator the law requires, without undue delay.
19. Links to other websites
Our services link to sites we do not run, for example a courier’s tracking page or a partner’s portal. Their privacy policies apply once you leave our service.
20. Changes to this policy
We update this policy when our services, providers or the law change. The current version, with its effective date, is always at www.diversityarrays.com/corporate-information/privacy-policy/. If a change materially affects how we handle your information, we tell you by email or in the app before it takes effect, and we ask for consent where the law requires it.
21. Questions and complaints
Privacy Officer Diversity Arrays Technology Pty Limited LPO Box 5067, Bruce ACT 2617, Australia Email: privacy@diversityarrays.com Phone: +61 2 6122 7300
If you have a complaint, tell us what happened and what you would like us to do. We acknowledge your complaint, investigate it, and give you a written response within 30 business days (Canberra, Australia). If we need longer, we tell you why and when to expect an answer.
If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au or 1300 363 992. In the EU or UK, you can contact your local data protection authority.
Appendix A: Our mobile apps
A1. Ecologue
Ecologue is a field app for ecological surveys, trapping and biodiversity records. It is available on Android and iOS. The information below describes the current version.
What the app collects
Information | When | Where it goes |
Your name, email and OneDArT user ID | When you sign in | DArT servers and your project |
Precise GPS position and accuracy | When you save a record | Stored with the record; visible to your project |
Survey track (continuous GPS) | Only during a survey, and only if you turn on background tracking | Stored with the survey; visible to your project |
Photos and video | When you attach them to a record | Stored with the record |
Audio recordings | When you record a note | Stored with the record; transcribed if you tick “generate transcript” |
Observations, notes, barcodes | When you enter them | Stored with the record |
App version, device model, OS version, crash reports | Automatically, Android only | Google Firebase (see below) |
Permissions and why we ask
- Location (while using the app). Every record needs a GPS position. We ask for precise location because coarse location is only accurate to several kilometres, which is not acceptable for scientific records.
- Location (always / all the time). Optional. If you turn on “Background location during surveys” in Preferences, the app keeps recording your survey track while the screen is locked or the app is in the background, so long surveys are not cut short. A notification shows while this is running. It uses more battery. It is off by default and you can turn it off at any time in Preferences or in your device settings.
- Camera. To scan barcodes and take photos or video for a record.
- Microphone. To record audio notes for a record. Asked for the first time you tap record.
- Photos. To attach an existing photo or video from your library. The app does not scan or upload your library.
- Notifications (Android). To show the survey-in-progress notice while background tracking runs.
Third-party components in the app
- Mapbox (Android and iOS) draws the maps. To show a map, the app sends Mapbox the map tiles requested, your IP address and basic device details. Mapbox also collects anonymised location and usage data to improve its maps (“telemetry”). To turn this off, tap the (i) button on the map and switch off Mapbox Telemetry. Mapbox’s privacy policy: www.mapbox.com/legal/privacy.
- Google Firebase Crashlytics and Analytics (Android only) report crashes and the screens used just before a crash, so we can fix them. This sends crash logs, device model, operating system version, app version and a Firebase installation ID to Google. We have turned off collection of the Android advertising ID. Reports are kept for 90 days. Google’s privacy policy: policies.google.com/privacy. Not used on iOS.
- Google Play services barcode scanner (Android only) reads barcodes on your device. Barcode contents are not sent to Google.
Advertising and tracking. The app contains no advertising components and does not track you across other apps or websites.
Sign-in. You sign in with your OneDArT account in a secure browser window. You can create a OneDArT account yourself from the sign-in screen, or your organisation can create one for you. Sign-in tokens are stored in the device’s secure keystore.
Privacy policy and deletion in the app. Open About for this policy and for Request account or data deletion.
A2. KDSmart
Information | When | Where it goes |
Your KDDArT username and password | When you sign in to your organisation’s KDDArT server | Sent to that server. The app keeps the server address and a session token on your device, not your password |
Trial scores, notes, tags, barcodes, measurements | When you enter them | Stored on your device until you export or upload them |
Photos, video and audio notes | When you attach them to a plot or specimen | Stored with the record |
GPS position | Only if you choose to record a plot position while scoring | Stored with the plot |
App version, device model, OS version, crash reports, screens used | Automatically | Google Firebase (see below) |
A push-notification token | Automatically | Google Firebase Cloud Messaging, so the app can tell you when a trial import or export has finished and, occasionally, deliver service messages |
Permissions and why we ask
- Camera. To scan barcodes and take photos or video for a record.
- Microphone. To record audio notes for a record.
- Photos (iOS). Only when you attach an existing photo or video from your library. The app does not scan or upload your library.
- Location (while using the app). Optional. Used only when you choose to record a plot’s GPS position. Android also requires it on some versions for Bluetooth scanning. The app never collects location in the background.
- Bluetooth and nearby devices. To connect barcode scanners and to transfer trials directly to another device. On iOS the app asks the first time you connect a scanner.
- Notifications. To show progress while a trial imports or exports (the app keeps running in the foreground with an ongoing notice), to tell you when it has finished, and occasionally to deliver service messages.
- Files. Imports and exports use the system file picker on both platforms, so you choose the folder or cloud drive each time. The app does not read your other files.
Where your data goes
- Your organisation’s KDDArT server. You or your organisation choose the server. It may be run by DArT in Sydney or Frankfurt (section 11) or by your organisation itself. Once uploaded, the data is governed by that organisation.
- Files you export. Exported trial files go to the location you pick, which may be a cloud drive. Those files are then under that service’s terms.
- Direct device transfer (KDXchange). You can share a trial with a nearby device running KDSmart or KDXplore over the local network or Bluetooth. The transfer is not encrypted and runs only while you have it switched on. Use it only on networks you trust.
- Backups. We do not back up KDSmart data. The data on your device is the only copy until you upload it to KDDArT or export it. You can export all trials, or the database files themselves, from the Manage Devices screen at any time. Your phone’s own Android backup may include your KDSmart trials if you have device backup turned on. That backup belongs to your Google account and is encrypted with your screen lock; we do not have access to it, and it does not include your KDDArT sign-in. Android only backs up small amounts of app data, so do not rely on it for large trials. Export or upload instead.
- Beta testing (iOS). If you join the TestFlight beta, Apple collects crash logs, basic usage statistics and any feedback or screenshots you send through TestFlight, and shares them with us. Apple’s TestFlight terms and privacy policy apply to that collection.
Third-party components in the app
- Google Firebase Crashlytics and Analytics report crashes and the screens used just before a crash. This sends crash logs, device model, operating system version, app version and a Firebase installation ID to Google. We have turned off collection of the Android advertising ID.
- Google Firebase Cloud Messaging delivers the import and export finished notices and occasional service messages. Google holds a push token for your installation.
- Google Firebase Remote Config fetches app settings, such as how often you must sign in to KDDArT again. It sends Google basic device and app details.
- Google barcode scanning runs on your device. Barcode contents are not sent to Google.
Advertising and tracking. The app contains no advertising components and does not track you across other apps or websites.
Accounts and deletion. KDSmart does not create accounts. To delete data you have uploaded, ask the organisation that runs your KDDArT server. To delete the data on your device, delete the trial in the app or uninstall it. For anything else, use Request account or data deletion in the xapp’s About screen.
Privacy policy in the app. Open About for this policy and the deletion link.
Appendix B: Service providers
Providers that receive personal information from us, what they do for us, and where they process it. Software that we run on our own servers is listed separately below, because no information is disclosed to its developers.
Provider | What they do for us | Information involved | Location | Privacy policy |
Amazon Web Services | Cloud hosting, storage and audio transcription (Amazon Transcribe) | Any information in our hosted systems; audio recordings sent for transcription | Australia (Sydney); Germany (Frankfurt) for some KDDArT deployments | aws.amazon.com/privacy |
Wasabi Technologies | Cloud object storage for scientific and sequence data | Customer, project and sample identifiers; sequence data | Australia (Sydney) | wasabi.com/legal/privacy-policy |
Mapbox | Maps in NatureIQ, Ecologue web and mobile | IP address, device details, map requests, telemetry (opt-out) | United States | mapbox.com/legal/privacy |
Google Firebase | Crash reporting, analytics, push notifications and remote settings for the Ecologue and KDSmart Android apps | Crash logs, device and app details, installation ID, push token | United States | policies.google.com/privacy |
HubSpot | Customer relationship management and website forms | Contact details, enquiries, website interactions (with consent) | United States | legal.hubspot.com/privacy-policy |
Atlassian Jira | Software issue tracking | Support and bug details; we minimise personal information | United States / Australia | atlassian.com/legal/privacy-policy |
Xero | Accounting and invoicing | Billing contact details, invoices, payment status | New Zealand | xero.com/privacy |
Illumina BaseSpace Sequence Hub | Sequencing data platform | Sample and project identifiers, sequence data | Australia | illumina.com/company/legal/privacy |
Biomolecular Resource Facility (ANU) | Sequencing | Sample identifiers, sequence data | Australia | anu.edu.au/privacy |
Ramaciotti Centre for Genomics (UNSW) | Sequencing | Sample identifiers, sequence data | Australia | unsw.edu.au/privacy |
FedEx, Australia Post and other couriers | Transporting samples and products | Sender and recipient name, address, phone, email, customs details | Australia and destination countries | Each carrier’s own policy |
We review this list when providers change and update it without changing the rest of this policy.
Software we run ourselves
Several of our services are open-source or licensed software that we host on our own infrastructure. Because they run on servers we control, no information is disclosed to the software’s developers.
Software | What it does | Information it holds |
Keycloak | OneDArT sign-in and access control (section 5.2) | Name, email, username, organisation, roles and permissions, sign-in logs |
Matomo | Website and Engagement Hub analytics (section 8) | Pages visited, navigation, browser and device details, shortened IP address |
Listmonk | Newsletters and announcements (section 9) | Name, email, organisation, subscription status, opens and clicks |
Zammad | Customer support tickets (section 5.6) | Contact details, correspondence, attachments |
Redmine and OpenProject | Project and issue tracking (section 5.6) | Project details, issue descriptions, attachments |
Nextcloud | File storage for customer and project files (section 5.7) | Files you send us, scientific data, reports and documents |
dartDB | Laboratory information management (section 5.5) | Customer, order, sample, laboratory and result records |
We update this list as our tooling changes.