1.1 This agreement forms part of the Admin Tea Terms of Service between Admin Tea Pty Ltd ("we", "us") and the Customer ("you"). Words defined in the Terms have the same meaning here.
1.2 It applies to personal information in Customer Data ("Customer Personal Information"). If it conflicts with the Terms on anything about personal information, this agreement prevails.
1.3 "Privacy Law" means the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), the Privacy (Tax File Number) Rule 2015 and the Notifiable Data Breaches scheme, and any other Australian law about personal information that applies to a party.
2.1 You collect Customer Personal Information and decide the purposes for which it is handled. We handle it on your behalf to provide the Service.
2.2 Your instructions to us are: the Terms; this agreement; your choice of features and settings in the Service; and any other reasonable written instruction you give us that is consistent with them. If we believe an instruction would breach the law, we will tell you and need not follow it.
2.3 We are also an organisation bound by Privacy Law in our own right. Nothing in this agreement requires either party to breach Privacy Law.
You are responsible for:
We will:
5.1 We will take reasonable steps to protect Customer Personal Information from misuse, interference and loss, and from unauthorised access, modification and disclosure. This includes at least the measures in Schedule 1.
5.2 We may update our security measures, but will not reduce the overall level of protection they provide.
5.3 You are responsible for the security of your own devices and networks, for your Authorised Users' sign-in details, for resets of multi-factor authentication made by your account owner under section 4.3 of the Terms, and for configuring access within your account appropriately.
6.1 You authorise us to use the service providers listed in Schedule 2 to help provide the Service.
6.2 Each provider is bound by written terms that require it to protect the information and use it only to provide its service. We remain responsible to you for their performance of our obligations under this agreement.
6.3 Before a new provider starts handling Customer Personal Information, we will update Schedule 2 and give you at least 30 days' notice by email. If you reasonably object on privacy or security grounds, tell us within that period. We will try to address your concern. If we cannot, you may end the agreement without penalty and receive a refund of any Fees paid in advance for the period after it ends.
6.4 We may replace a provider without notice if urgently needed for security or continuity of the Service. We will then notify you as soon as practicable, and section 6.3 applies from that notice.
6.5 Government systems you lodge with through the Service, such as the Australian Taxation Office and the National Disability Insurance Agency, are not our service providers. Information is sent to them on your instruction and their own terms apply.
7.1 Our core database, uploaded files and regional application processing use Google Cloud's Sydney region, with database backups in Australia. Automated email uses SMTP2GO's Australian API endpoint. These arrangements do not mean all authentication, delivery metadata, support access, email routing or connected services stay in Australia. Operational server logs are configured in Sydney for 400 days; older entries written before 15 September 2026 used a global bucket with 30-day retention. Our administrative audit log is configured globally for 400 days and records operator or system identities, resource names and action metadata, which can include identifiers. Section 11 of the Privacy Policy explains these flows.
7.2 Some providers in Schedule 2 handle limited information outside Australia, as described there. We will not move storage of Customer Personal Information outside Australia without notice under section 6.3.
7.3 Where we disclose Customer Personal Information outside Australia, we take reasonable steps to ensure the recipient does not breach the APPs in relation to it.
8.1 We will tell you without undue delay, and in any case within 72 hours of becoming aware, of any unauthorised access to, disclosure of, or loss of Customer Personal Information held by us or our service providers.
8.2 We will give you the information we have about what happened, the kinds of information and the individuals likely affected, and the steps taken, and update you as we learn more.
8.3 We will promptly take reasonable steps to contain the breach and reduce the risk of harm, and cooperate with you in assessing whether it is an eligible data breach under the Notifiable Data Breaches scheme.
8.4 Where a breach affects both of us, we will agree with you who prepares any statement to the Office of the Australian Information Commissioner and who notifies affected individuals, so that notification is timely and consistent. The Privacy Act allows one notification to satisfy both parties. Where the breach affects tax file numbers or payroll information, we will also report it to the Australian Taxation Office as our obligations as a software provider require.
8.5 Our notice of a breach is not an admission of fault or liability.
9.1 We coordinate individual access, correction and complaint requests with you where appropriate, while independently meeting obligations that apply to us. Your agreement is not a condition of an individual's statutory rights against us. Before sharing a request we consider legal restrictions, safety concerns and the information reasonably necessary for you to assist.
9.2 We will help you respond to requests within the time Privacy Law requires, including by giving you the information we hold or making corrections you ask for.
We will give you reasonable help, taking into account the information available to us, with privacy impact assessments, inquiries from the Office of the Australian Information Commissioner or another regulator, and NDIS Quality and Safeguards Commission audits, as they relate to the Service. We may charge reasonable costs for help that requires significant effort, and will tell you before we do.
If a government agency, court or other third party asks us for Customer Personal Information, we will refer it to you where we can. If we are legally required to disclose it, we will disclose only what is required and tell you first, unless the law prohibits us from telling you.
12.1 While your account is active, and for 60 days after the agreement ends, you can obtain a copy of Customer Personal Information as section 7.3 of the Terms describes. Once your account is closed, the Data Retrieval Fee in section 14.5 of the Terms applies to a copy we prepare for you.
12.2 After that period, we will securely delete or de-identify Customer Personal Information within a further 90 days, except:
12.3 We will confirm deletion in writing if you ask.
13.1 Once a year, or after a data breach affecting your data, we will on request answer a reasonable security questionnaire and give you a summary of our security controls and any independent assessment we hold.
13.2 If a regulator requires an audit of our handling of your data, or that information does not reasonably address a specific concern, you may arrange an audit by an independent auditor bound by confidentiality, with at least 30 days' notice, during business hours and at your cost. It must not give access to other customers' data or compromise the Service's security.
14.1 This agreement continues while we hold Customer Personal Information, including after the Terms end.
14.2 Each party's liability under this agreement is subject to the limits in the Terms, and nothing in this agreement limits liability that cannot be limited by law.
14.3 We may update this agreement in the same way as the Terms (section 19). We will not reduce the protections in it for your existing data without your agreement.
| Provider | What it does | Information | Location |
|---|---|---|---|
| Google Cloud (Firebase: Firestore, Cloud Functions, Cloud Storage) | Hosting, databases, file storage and processing | Core Customer records and uploaded files; authentication and global service metadata are described separately | Australia (Sydney) |
| SMTP2GO | Sending email | Recipient name and email address, and email content such as invitations, security alerts and roster details | Australian sending endpoint; recipient providers and onward routing may involve overseas processing |
| Google Cloud Identity Platform | Sign-in, including sending SMS codes through mobile carriers | Email address, mobile number used for sign-in codes, authentication credentials and settings, IP address, browser information and security metadata | United States |
| Google reCAPTCHA | Blocking automated sign-in abuse, including when an SMS code is sent, and scoring each page load and server call through Firebase App Check to block automated abuse | IP address, browser and device information | United States |
| Google Maps | Showing addresses and clock-in locations on maps, and working out travel distance between staff and clients for open shifts | Addresses and map coordinates, including the saved coordinates of an Authorised User's address, which can be their home, and of a client's address; IP address | United States |
| Firebase Cloud Messaging and the Authorised User's browser push service (Google, Apple or Mozilla) | Urgent shift notifications | Device token, notification payload and delivery metadata | United States and global delivery infrastructure |
| Google Cloud administrative audit log | Record of administrative changes to our cloud project, configured globally for 400 days | Operator or system identity, resource names and action metadata, which can include identifiers | United States and Google's global network |
| Google Fonts, Google Hosted Libraries, Firebase Hosting, jsDelivr, cdnjs (Cloudflare), unpkg, jQuery CDN, Bootstrap CDN (StackPath), Quill CDN | Delivering web pages, fonts and page components | IP address and browser information | United States and the providers' global networks |
| YouTube, Vimeo | Playing training videos a Customer adds | IP address, browser information and viewing activity on the video | United States |
Customer-support correspondence: We use yasir@admintea.com, a Titan Email mailbox supplied through GoDaddy, to communicate with Customers about Admin Tea. Its role is limited to contact details, support messages, any attachments sent through the mailbox, and delivery and security metadata. We do not use it to store the platform's payroll, TFN or participant records. Support correspondence may be processed overseas; section 11 of the Privacy Policy describes the providers and their locations. Titan hosts mailbox contents with Amazon Web Services in the United States. Please send only information needed for your enquiry and avoid sending TFNs, passwords, bank details or detailed health records.
Password checking: Have I Been Pwned / Pwned Passwords receives the first five characters of a proposed password hash and network information, through Cloudflare's global network, including the United States. This check does not receive the password, full hash or account email. The operator is Australian.
Maps and Customer-selected services: Google Maps receives addresses and coordinates to display locations, look up addresses, including before clock-in, and work out travel distance between staff and clients; these may identify participants, care sites or an Authorised User's home. Customer-selected embedded content, including Google Drive and Microsoft OneDrive, can receive IP addresses, browser and viewing information and recognise an existing provider login. These services may process information overseas as described in section 11 of the Privacy Policy. Customers must have lawful authority for the information they send. Our own legal responsibilities for disclosures remain applicable.