OpenChair Privacy Policy

Version: 2.1.0

Effective date: when this version is published at OpenChair's Privacy Policy URL
Entity: Open Chair Pty Ltd (ACN 699 884 074, ABN 11 699 884 074)

1. Scope and responsibility

This policy explains how OpenChair handles personal information in operating its websites, applications and platform. Venues use OpenChair to run their businesses and may independently decide why and how customer and worker information is handled. A venue's privacy notice applies to that venue's activities.

OpenChair is responsible for its own account administration, security, billing, support, product improvement and corporate activities. It also processes venue-entered information to provide contracted platform functions.

2. Information handled

Depending on the feature used, information may include:

• account, identity, role, venue and contact information;
• booking, service, staff, customer and communication records;
• transaction references, invoices, deposits, refunds and payment status, but not full card credentials;
• consultation answers, customer notes, allergies or other information a venue chooses to record;
• photographs, uploaded files and portfolio-consent records;
• source exports, field mappings, validation results and working files supplied or created for an agreed data migration;
• support messages, audit records, device, browser, IP and security information;
• product-usage, analytics, cookie and communication-preference information; and
• content submitted to an enabled AI-assisted function and its resulting output.

Sensitive information should be collected only where the venue or OpenChair has an appropriate basis and the product presents any required notice or consent.

3. Collection sources

Information may come directly from an individual, a venue or authorised user, a booking or payment workflow, an integration selected by a venue, a source export supplied for an agreed migration, a support interaction, or automated platform/security telemetry.

OpenChair does not authorise venues to upload information they are not entitled to handle.

4. Purposes

Information may be used to provide and secure the platform, process requested bookings and transactions, map and validate records for an agreed migration, send service communications, provide support, keep records, prevent abuse, meet legal obligations, improve products using appropriately controlled information, and send marketing where the sender has the required permission.

Information submitted for one purpose is not automatically authorised for an unrelated purpose. Marketing, public portfolio use, saved-card authority and other purpose-specific choices are recorded separately.

5. Providers and disclosures

OpenChair uses infrastructure, payment, communications, analytics, support, security and AI providers. The current Subprocessor List identifies the providers used for Customer Data, their purposes and their principal or potential processing locations.

Information may also be disclosed to a venue involved in a transaction, an integration enabled by that venue, professional advisers under confidentiality, a purchaser in a controlled business transaction, or an authority where required or authorised by law.

Some providers and recipients may process information outside Australia, including in the United States, European Union and other locations stated in the Subprocessor List. Locations can vary by feature, account configuration, support access and provider resilience arrangements. Where applicable law requires it, OpenChair takes reasonable steps before disclosing personal information overseas.

6. AI-assisted functions

AI-assisted functions are feature-specific. The applicable feature notice, Subprocessor List or service description identifies material provider routing, permitted inputs, retention or training controls and human-review settings where those details affect a person's choice. OpenChair does not promise universal zero retention, a single model provider or a single processing location.

If a venue asks OpenChair to help migrate its records, OpenChair may use AI providers identified in the Subprocessor List to inspect, classify, map, transform, de-duplicate and check the supplied export. OpenChair records the agreed scope and transfer instruction before receiving private data. OpenChair personnel review the working output, and the venue is asked to verify the proposed mapping and imported result before cutover. OpenChair does not use personal or consumer AI accounts for this processing.

OpenChair uses computer programs to support functions such as availability and booking workflows, security and fraud alerts, audience selection, drafting and recommendations. These programs may determine whether a workflow proceeds automatically or is referred for operator review, but OpenChair does not use an AI output to provide a health assessment, treatment recommendation, medical advice or another professional decision about an individual. Venues remain responsible for their professional and service decisions. Payment providers may independently apply automated identity, fraud and risk controls under their own privacy notices.

If OpenChair begins using personal information in a computer program to make, or do a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect a person's rights or interests, this policy will identify the kinds of personal information used and the kinds of decisions made as required by applicable law.

7. Security and incidents

OpenChair uses technical and organisational safeguards proportionate to the information and risk. No system can guarantee absolute security. A specific safeguard applies only where it is stated in the current service or security description.

OpenChair maintains an incident process and will assess notification obligations under applicable law and contracts when an incident is confirmed.

8. Retention and deletion

Information is retained for the period reasonably needed for the purpose, contractual service, security, dispute, accounting or legal requirement that applies. Retention differs across active records, logs, backups and providers. OpenChair deletes or de-identifies information when it is no longer reasonably required, subject to lawful retention and technical backup expiry.

Account and service records may be retained while an account or venue relationship is active. Transaction, security, dispute and business records may be retained afterwards where reasonably necessary. Deletion from backups and providers occurs through normal rotation and deletion processes and may not be immediate. A person may ask about the retention applicable to a particular record by contacting OpenChair.

Source exports and migration working files are retained only while reasonably required for the agreed migration, verification, security, dispute or legal purpose recorded for the work. OpenChair deletes or de-identifies working copies when they are no longer reasonably required, subject to lawful holds and normal provider and backup deletion processes. Records accepted into the OpenChair service then follow the retention applying to those service records.

9. Access, correction and complaints

Individuals may ask to access or correct information OpenChair controls, subject to identity verification and applicable exceptions. They may also ask for deletion or restriction where available under applicable law and consistent with venue business records, security, disputes and lawful retention. Requests concerning venue-controlled records may be referred to the relevant venue. Privacy requests and complaints may be submitted through the published privacy-request form or to privacy@openchairpro.com.

OpenChair will acknowledge a privacy complaint and investigate it within a reasonable period. If a person is not satisfied, they may contact the Office of the Australian Information Commissioner or another regulator available to them.

10. Marketing and preferences

Commercial electronic messages require the applicable permission, sender identification and functional unsubscribe mechanism. Service messages such as booking confirmations, receipts, security alerts and legal notices are classified separately from marketing. OpenChair and venues must honour the preferences and suppression records applicable to messages they authorise.

11. Children and guardians

Where a venue serves a child or another person requiring a representative, the venue must obtain and record appropriate guardian authority for the service and any purpose-specific consent. OpenChair does not infer guardian authority from account access alone.

12. Cookies and tracking

The Cookie Policy describes verified cookies, SDKs and similar technologies, their purposes and available choices. Non-essential tracking is loaded only in accordance with the implemented consent configuration for the relevant surface and jurisdiction.

13. Changes

OpenChair publishes each version with its effective date and an archive. Material changes are notified through the registered account contact or a prominent in-product notice before they take effect, except where a shorter process is reasonably required and permitted for law, urgent security, fraud or a binding provider change.

14. Contact

Open Chair Pty Ltd (ACN 699 884 074, ABN 11 699 884 074) is based in Brisbane, Queensland, Australia. Privacy requests and complaints may be sent to privacy@openchairpro.com. General legal notices may be sent to legal@openchairpro.com.