Privacy policy

1. About this policy

This policy describes how Hivive Pty Ltd (ACN 672 184 002), referred to as “Hivive”, “we”, “us” or “our”, collects, holds, uses and discloses personal information in connection with Hivive products and services.

These services may include point of sale software, mobile apps, the admin portal, QR and online ordering, self-service kiosks, kitchen displays, ecommerce, loyalty features, hardware support, integrations and related support services (together, the “Services”). Not every feature described here is used by every merchant.

This policy should be read with any collection notice shown when information is collected and any agreement that applies to the Services. Our separate Website Privacy Notice covers visits to our public website.

2. Hivive's role and the merchant's role

Businesses that subscribe to or use the Services (“merchants”) decide how they use Hivive in their operations. For much of the customer and staff information processed through the Services, the merchant is responsible for deciding why the information is collected and how it is used, while Hivive processes it to provide the Services and follow the merchant's instructions.

Hivive may also handle information for its own business purposes, including managing merchant accounts, billing, service security, product improvement, legal compliance and direct relationships with users.

If you are a customer or staff member of a merchant and your question concerns information in that merchant's Hivive account, contact the merchant first. We will assist merchants with appropriate requests where required.

3. Information we may collect and hold

Merchant and account information

• names, work contact details, business details, ABN, venue address and role;
• account credentials, user permissions and authentication information;
• subscription, billing, invoice, onboarding, sales and support records; and
• communications, feedback and training records.

Staff and operational information

• staff names or identifiers, roles, permissions and venue assignments;
• log-in, clock-in or activity records where the merchant enables those features; and
• orders, refunds, discounts, register activity and audit logs associated with a user.

Customer, order and loyalty information

• names, phone numbers, email addresses and delivery or billing details;
• order contents, special instructions, table or fulfilment details, receipts, refunds and transaction references;
• loyalty membership, points, rewards, visit and purchase history where enabled; and
• booking, preference, feedback or support information where a relevant feature is enabled.

Free-text fields may contain information a user chooses to enter. Merchants and users should avoid entering sensitive information unless it is necessary and permitted.

Payment information

Payment card credentials and digital wallet details are generally collected and processed by the merchant's selected payment provider, such as a payment gateway, acquiring bank or digital wallet provider. Depending on the configuration, Hivive may receive limited payment information such as payment status, amount, payment method, transaction reference and a masked card number. We do not need a customer's full card number to provide ordinary POS and ordering functions.

Device, usage and technical information

• IP address, device identifiers, app and operating system version, browser type and language;
• feature usage, diagnostic, crash, performance, security and audit logs;
• network, printer, terminal and integration status; and
• approximate location inferred from an IP address, and precise location only where a feature requires it and permission is granted.

How we collect information

We may collect information directly from merchants, users and customers; automatically through the Services; from a merchant on behalf of its staff or customers; and from authorised integrations, payment providers, app stores, resellers or support partners.

4. How we use information

We may use personal information to:

• create and administer accounts, subscriptions, venues, users and permissions;
• process and route orders, receipts, refunds, loyalty activity and operational records;
• connect devices and integrations and coordinate transactions with payment providers;
• provide onboarding, support, maintenance, updates and service communications;
• monitor availability, diagnose faults, prevent fraud and protect merchants, users and the Services;
• analyse performance and improve or develop features, including through aggregated or de-identified information where appropriate;
• manage billing, records, disputes and our business relationship with merchants;
• send product or marketing communications where permitted, with an option to unsubscribe; and
• comply with law, enforce agreements and establish or defend legal claims.

We do not use information processed solely for a merchant to independently market to that merchant's customers unless we have a separate lawful basis or permission to do so.

5. How we disclose information

We may disclose personal information as reasonably necessary to:

• the relevant merchant, its authorised users and its connected venues;
• payment processors, banks, digital wallet providers and fraud-prevention services;
• cloud hosting, communications, analytics, monitoring, customer support and security providers;
• third-party services or integrations a merchant chooses to connect;
• professional advisers, insurers, auditors, financing parties or prospective purchasers in a business transaction; and
• courts, regulators, law enforcement or other parties where required or authorised by law or reasonably necessary to protect rights, safety and security.

We do not sell personal information as a standalone product.

Overseas processing

Hivive and its service providers may store or process information outside Australia. The countries involved depend on the merchant's configuration and the providers used, and may change over time. We take reasonable steps appropriate to the circumstances when selecting and engaging providers that handle personal information. Contact us if you would like current information relevant to your use of the Services.

Third-party services

A merchant may connect Hivive to external payment, accounting, ecommerce, delivery or other services. Those providers handle information under their own terms and privacy policies. Hivive is not responsible for a third party's independent privacy practices.

6. Security, data location and retention

We use reasonable technical and organisational safeguards designed to protect personal information from loss, misuse, interference and unauthorised access, modification or disclosure. Measures may include access controls, authentication, encryption in transit, logging, monitoring, backups and staff or provider confidentiality controls, as appropriate to the information and system.

No service can guarantee absolute security. Merchants are responsible for managing their user access, devices, passwords, network security and lawful use of exported data. Users should notify us promptly if they suspect unauthorised access.

We keep personal information for as long as reasonably needed to provide the Services, meet merchant instructions, maintain legitimate business and security records, resolve disputes, and comply with tax, accounting and other legal obligations. Retention periods vary by record type and configuration. When information is no longer required, we take reasonable steps to delete or de-identify it, subject to backups and lawful retention requirements.

7. Access, correction and deletion

You may request access to or correction of personal information Hivive holds about you. You may also ask about deletion or object to certain handling where applicable. We may need to verify your identity and clarify the scope of a request. Legal exceptions may apply, and some information must be retained for security, transaction integrity or legal reasons.

If the information is controlled by a Hivive merchant, please make the request to that merchant. We will support the merchant in responding where appropriate. Account holders can update some information directly in the Services.

8. Children

The Services are designed for businesses and general commerce, not for children to create independent Hivive merchant accounts. Merchants are responsible for ensuring that any collection of information about children through their business is appropriate, lawful and covered by any required consent or notice.

9. Changes to this policy

We may update this policy as our Services, providers or legal obligations change. We will publish the updated version here and revise the effective date. If a change is material, we may also notify merchants through the Services, account email or another appropriate channel.

10. Contact and complaints

For access, correction, privacy questions or complaints, contact:

Please include enough detail for us to understand the issue, but do not send passwords or full payment card details. We will acknowledge and investigate complaints within a reasonable time. If you are not satisfied with our response, you may be able to contact the Office of the Australian Information Commissioner or another relevant regulator.