Privacy Policy

1. Introduction

EpiqFlo (“we”, “us”, “our”) is committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and the Privacy and Other Legislation Amendment Act 2024 (Cth). We also acknowledge the Privacy and Responsible Information Sharing Act 2024 (WA) (PRIS Act) as Western Australia’s dedicated privacy framework for public sector entities.

This Privacy Policy explains how we collect, use, store, disclose and protect your personal information, including information processed through our website, quoting tools, artificial intelligence (AI) systems and customer relationship management platforms. We are transparent about our use of automated decision-making technologies and the steps we take to safeguard your data.

By accessing our website, submitting an enquiry, or engaging our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any aspect of this policy, you should not use our services or provide personal information to us.

2. Definitions

In this Privacy Policy:

• “Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether recorded in a material form or not. This includes names, contact details, location data, online identifiers and inferred information such as behavioural predictions or preferences generated from aggregated data.
• “Sensitive information” means personal information including health information, racial or ethnic origin, political opinions, religious beliefs, criminal record, biometric data, or genetic information. We do not typically collect sensitive information unless required for a specific purpose with your consent.
• “Automated decision-making” (ADM) means decisions made by computer programs, algorithms, or AI systems that use personal information to make, or substantially assist in making, decisions that may significantly affect your rights or interests, without meaningful human intervention.
• “APPs” means the Australian Privacy Principles set out in Schedule 1 of the Privacy Act 1988 (Cth).
• “De-identified information” means personal information that has been treated or processed so that it can no longer be used to identify a specific individual.

3. What Information We Collect

We collect personal information that is reasonably necessary for our business functions and activities. The types of personal information we may collect include:

• Identity and contact details: Your name, business name, email address, phone number and postal or business address.
• Project and facility information: Details about your premises (e.g. warehouse, commercial kitchen, factory, cool room), approximate floor area, project specifications and uploaded files such as photos, drawings, or site plans.
• Communications data: Records of phone calls, emails, online chat transcripts and enquiry history with our team.
• Device and technical data: IP address, browser type, operating system, device identifiers, cookie data and geolocation data where enabled.
• Inferred information: Preferences, interests and behavioural patterns derived from your interactions with our website, advertising and AI-powered tools.

We do not collect sensitive information about you unless it is reasonably necessary for our services and you have provided explicit consent, or where required or authorised by law.

4. How We Collect Your Information

We collect personal information through the following channels:

• Website forms: Quote requests, contact forms, booking requests for site assessments and newsletter sign-ups.
• AI-powered tools: Our floor visualiser, automated quoting assistant and AI-driven customer support chatbot that process your uploaded images, facility details and text inputs.
• Direct interactions: Phone calls, emails, on-site visits and in-person consultations.
• Third-party platforms: CRM systems (including GoHighLevel), cloud storage providers, advertising platforms (Meta, Google) and analytics tools.
• Automated technologies: Cookies, tracking pixels, Google Analytics, Meta Pixel and similar technologies that collect website usage data.

At or before the time we collect your personal information, we will take reasonable steps to notify you of the matters required under APP 5, including the purpose of collection, how you may access the information and to whom we may disclose it.

5. Purpose of Collection and Use

We collect, use and hold your personal information for the following primary purposes:

• To provide quotes, project assessments and epoxy flooring services.
• To communicate with you regarding your enquiry, project status and follow-up.
• To process and analyse project data, including through AI-powered visualisation and estimation tools.
• To improve our website, services and customer experience through analytics and feedback.
• To send marketing communications, promotions and service updates where you have consented or where permitted by law.
• To comply with legal obligations, resolve disputes and enforce our agreements.
• For insurance, warranty registration and quality assurance purposes.

We will only use your personal information for the purpose for which it was collected (the primary purpose) or for a related secondary purpose that you would reasonably expect, or where you have consented. If we propose to use your information for any other purpose, we will seek your consent first.

6. Automated Decision-Making and Artificial Intelligence

We use artificial intelligence and automated systems to enhance our service delivery. In accordance with the Privacy and Other Legislation Amendment Act 2024 (Cth), we disclose the following about our automated decision-making processes:

6.1 Types of ADM We Use

• Floor Visualisation Tool: Processes uploaded photos of your premises and applies simulated epoxy coatings to generate visual previews. This tool uses image recognition algorithms to map surfaces and render finishes.
• Automated Quoting Assistant: Uses facility type, floor area and project parameters provided by you to generate indicative pricing estimates. This assists our team in preparing formal quotes.
• Customer Support AI: Our chatbot and email response systems use natural language processing to interpret your enquiries and provide initial responses or route communications to the appropriate team member.

6.2 Personal Information Used in ADM

These systems may process your uploaded images, facility details, floor dimensions, contact information and communication history to generate outputs relevant to your project.

6.3 Significant Decisions

Where an automated process substantially informs a decision that could significantly affect your rights or interests — such as a formal quote approval, warranty eligibility determination, or credit assessment — we ensure meaningful human review is available. You may request that a human review any such decision and provide input before the decision is finalised.

6.4 Transparency and Accountability

We take reasonable steps to ensure our AI tools are used responsibly, ethically and in accordance with privacy obligations. We do not rely solely on automated processing for decisions that produce legal or similarly significant effects without human oversight. We regularly review our AI systems to identify and mitigate risks of bias or unintended adverse outcomes.

7. Cookies, Tracking and Analytics

We use cookies, web beacons and similar tracking technologies to:

• Understand how visitors interact with our website (Google Analytics).
• Measure the effectiveness of our advertising campaigns (Meta Pixel, Google Ads conversion tracking).
• Personalise content and remarketing communications.
• Improve website functionality and user experience.

You can manage or disable cookies through your browser settings. However, some features of our website may not function correctly if cookies are disabled. For more information, refer to our Cookie Policy available on request.

8. Disclosure of Personal Information

We do not sell your personal information. We may disclose your personal information to:

• Internal staff and contractors: Employees and subcontractors of EpiqFlo and Excalibur Contractors Pty Ltd who require the information to perform their duties.
• Service providers: Third-party technology and service providers including CRM platforms (GoHighLevel), cloud storage providers, email marketing services, accounting and insurance providers and IT support services.
• AI and analytics providers: Platforms that power our visualisation, quoting and analytics tools, subject to data processing agreements.
• Professional advisers: Legal, accounting and insurance advisers where reasonably required.
• Government authorities: Where required or authorised by law, including under the PRIS Act if applicable to contracted service arrangements with WA government agencies.

Where we disclose personal information to third parties, we take reasonable steps to ensure they handle it in accordance with the APPs and appropriate contractual safeguards.

9. Cross-Border Disclosure of Personal Information

Some of our service providers may store or process personal information outside Australia, including in the United States, Singapore and the European Union. This may occur through our use of cloud-based CRM systems, AI platforms, analytics tools and email marketing services.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient does not breach the APPs, including by:

• Entering into contractual arrangements that require the overseas recipient to comply with privacy obligations substantially similar to the APPs.
• Only disclosing information to providers in jurisdictions with comparable privacy protections where a whitelist exception under the amended Privacy Act applies.
• Obtaining your informed consent where required.

We also take reasonable steps to protect any de-identified information disclosed to overseas recipients, consistent with IPP 9 and IPP 11 of the PRIS Act, to prevent re-identification except in limited and lawful circumstances.

10. Data Security

We take the security of your personal information seriously. We implement a range of technical and organisational measures to protect your data from misuse, interference, loss, unauthorised access, modification, or disclosure, including:

• Encryption of data in transit (SSL/TLS) and at rest where practicable.
• Access controls, password policies and multi-factor authentication on systems holding personal information.
• Regular security assessments, software updates and staff training on privacy and data protection.
• Secure cloud storage environments with redundancy and backup procedures.
• Physical security measures at our offices and worksites.

Despite these measures, no method of electronic transmission or storage is completely secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

11. Data Breach Notification

We have procedures in place to detect, assess and respond to data breaches. Under the Notifiable Data Breaches (NDB) scheme, if we become aware of unauthorised access to, or unauthorised disclosure of, personal information we hold and a reasonable person would conclude that the access or disclosure is likely to result in serious harm to any of the individuals to whom the information relates, we will:

• Take immediate steps to contain the breach and prevent further harm.
• Promptly assess the breach to determine whether it is an eligible data breach.
• Notify affected individuals as soon as practicable with details of the breach and recommended steps they should take.
• Report the breach to the Office of the Australian Information Commissioner (OAIC).

“Serious harm” may include physical, psychological, emotional, financial, or reputational harm. Where remedial action is taken before serious harm occurs, notification may not be required.

12. Data Retention and Deletion

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, insurance and warranty obligations. Our general retention periods are:

• Enquiry and quote records: 2 years from last contact (or as required for follow-up marketing with consent).
• Project and client records: 7 years from project completion (to satisfy contractual, warranty and legal obligations).
• Marketing and analytics data: 2 years (or until you withdraw consent).
• Cookies and tracking data: As per the respective cookie expiry periods, typically up to 26 months.

When personal information is no longer required, we take reasonable steps to securely destroy or de-identify it, consistent with APP 11 and the PRIS Act requirements for de-identified information.

13. Access to and Correction of Your Information

Under APP 12 and APP 13, you have the right to:

• Request access to the personal information we hold about you.
• Request correction of any personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

We will respond to access and correction requests as soon as practicable and, in any event, within 30 days of receiving your request. In certain circumstances permitted by the Privacy Act, we may refuse to grant access or make corrections. If we refuse, we will provide you with written reasons and inform you of your complaint rights.

14. Anonymity and Pseudonymity

Where it is lawful and practicable, you may interact with us on an anonymous or pseudonymous basis. For example, you may browse our website without providing personal information. However, if you wish to request a quote, book a site assessment, or engage our services, we will require your identity and contact details to fulfil your request.

15. Direct Marketing

We may use your personal information to send you marketing communications about our services, promotions and industry updates where:

• You have consented to receiving such communications;
• You have an existing customer relationship with us and the marketing is directly related to services you have previously enquired about or received; or
• It is otherwise permitted under the Privacy Act and the Spam Act 2003 (Cth).

Every marketing communication we send will include a clear opt-out mechanism. You may opt out of receiving marketing communications at any time by clicking the unsubscribe link in our emails or contacting us directly. We will honour your opt-out request within 5 business days.

16. Third-Party Services and Links

Our website may contain links to third-party websites, platforms and services, including booking systems, social media platforms and external visualisation tools. This Privacy Policy applies only to our own data handling practices. We are not responsible for the privacy practices of third-party websites or services and we encourage you to review their privacy policies before providing any personal information.

17. Children’s Privacy

Our services are not directed to individuals under the age of 18 and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under 18, we will take reasonable steps to delete that information as soon as possible. If you believe we may have collected information from a minor, please contact us immediately.

18. Privacy Impact Assessments

In line with best practice and the PRIS Act’s emphasis on privacy governance, we conduct privacy impact assessments (PIAs) when introducing new technologies, systems, or processes that involve the collection or handling of personal information at scale, including the deployment of new AI tools, CRM integrations, or data sharing arrangements. These assessments help us identify and mitigate privacy risks before they materialise.

19. How to Make a Complaint

If you believe we have breached the APPs or mishandled your personal information, we encourage you to contact us first so we can attempt to resolve the matter directly.

Step 1: Contact EpiqFlo

Email your complaint to [email protected] with the subject line “Privacy Complaint”. Please include your contact details, a description of your concern and any relevant supporting information. We will acknowledge receipt within 5 business days and aim to resolve the matter within 30 days.

Step 2: Escalate to the OAIC

If you are not satisfied with our response, or if we have not responded within 30 days, you may lodge a complaint with the Office of the Australian Information Commissioner:

• Online: www.oaic.gov.au/individuals/make-a-privacy-complaint
• Phone: 1300 363 992
• Mail: GPO Box 5218, Sydney NSW 2001

Step 3: WA Information Commissioner

If your complaint relates to services provided under a Western Australian government contract, you may also contact the Office of the Information Commissioner Western Australia. Phone: (08) 6557 7165.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or service offerings. Material changes will be notified by:

• Updating the “Last Reviewed” date at the top of this page.
• Posting a prominent notice on our website homepage.
• Sending an email notification to registered users where practicable.

We encourage you to review this Privacy Policy periodically. Your continued use of our services after any changes constitutes acceptance of the updated policy.

21. Contact Us

Privacy Officer – EpiqFlo
A subsidiary of Excalibur Contractors Pty Ltd
ABN: 69 614 048 547
Email: [email protected]
Phone: (08) 6629 6400
Website: www.epiqflo.com
Address: Perth, Western Australia