Privacy Policy

Ark Resources Pty Ltd (ABN 29 086 461 369) collects the name, email address and company you enter when you register your interest in ArkiLume, so we can contact you about ArkiLume, set up an ArkiLume account for you, provide the analysis service and issue invoices. If you don't give us these details we can't set up your account or provide the service.

We disclose this information to Microsoft, which hosts our sign-in, file storage and video conference services, and to our accounting software provider and our accountants, insurers and professional advisers for invoicing and bookkeeping purposes.

We delete the project files you upload 30 days after we deliver your final report, so please keep your own copies. We keep the report itself, and a record of the settings we used, for seven years.

This notice should be read together with the rest of this Privacy Policy, which explains how we handle your information more generally and how to ask for access or a correction, or raise a concern with us. Questions: privacy@arkresources.com.au or +61 3 9636 0280.

We collect the following personal information:

(a) contact and organisation details you give us when you register your interest in ArkiLume, when we onboard you and while we provide the service, including your name, business email address, company name, role and telephone number;

(b) account and sign-in information, including the ArkiLume account we create for you, the initial password we issue to you, your multi-factor authentication registration details, and records of your sign-ins and account activity;

(c) information exchanged during onboarding and debrief sessions held by video conference, including chat messages and, where we tell you the session is being recorded and you agree, the recording and any transcript;

(d) the project material you upload or send us, including IFC building models, drawings and PDFs. This material may contain personal information about you or about other people, such as the names of project team members, site addresses and property owner details;

(e) the sunlight and solar access reports we produce for you and the analysis history for your account;

(f) billing and payment records, including quotes and invoices we issue through Xero, and records of payments made by electronic funds transfer; and

(g) your correspondence with us.

We don't seek to collect sensitive information as defined in the Privacy Act, and we ask that you don't include it in the material you upload.

We use your personal information to:

(a) set up and administer your ArkiLume account;

(b) conduct onboarding and debrief sessions with you;

(c) process the material you upload and produce your analysis and reports;

(d) keep a history of your projects and past analyses;

(e) contact you about your account, an analysis in progress, or changes to ArkiLume;

(f) quote, invoice and collect payment, and keep financial records;

(g) improve ArkiLume, using de-identified or aggregated information wherever practicable;

(h) maintain the security of ArkiLume and investigate suspected misuse; and

(i) meet our legal, tax and record-keeping obligations.

We'll only use your personal information for another purpose if you'd reasonably expect it and that purpose is related to one above, if you consent, or if the law requires or authorises it.

We'll only send you marketing about ArkiLume where you'd reasonably expect it or you've asked for it. Every marketing message includes an unsubscribe link, and you can opt out at any time by contacting us. You can't opt out of essential service messages while your account is open.

You can make a general enquiry about ArkiLume without identifying yourself. Because ArkiLume is delivered through named accounts and paid engagements, it isn't practicable for us to provide the service itself anonymously or under a pseudonym.

If the material you give us contains personal information about other people, you must have the authority to give it to us and must have told those people how their information will be handled. We use that information only to provide the ArkiLume service to you, and we don't use it for any other purpose.

ArkiLume is a professional tool intended for use by adults signing in with a work Microsoft account, and is not directed at children.

ArkiLume uses Microsoft Entra ID for sign-in, Microsoft SharePoint for file storage and Microsoft Teams for onboarding and debrief sessions. Microsoft handles that information under its own privacy terms at privacy.microsoft.com.

We create your ArkiLume account within the Ark Resources environment and issue you an initial password. You must change that password when you first sign in. After you change it we have no access to your password.

Payment is made by electronic funds transfer to the account shown on your invoice. We receive only the remittance details shown on the transfer.

We may disclose your personal information to:

(a) Microsoft, which provides the identity, file storage and video conference services underlying ArkiLume;

(b) our accounting software provider, for invoicing purposes;

(c) our accountants, bookkeepers, insurers and professional advisers;

(d) our IT service providers, where access is needed to support or maintain our systems; and

(e) a court, regulator or law enforcement agency, where we're required or authorised by law.

We don't sell or rent your personal information, and we don't disclose it so that another organisation can market to you.

Your uploaded models, reports and account information are held in Microsoft data centres in Australia. Even so:

(a) Microsoft support, security and engineering personnel may access information to support and maintain the service. Microsoft does not publish a fixed list of countries for this access; instead, access is role-based, granted only when needed, logged, and subject to Microsoft's own audit and security policies, wherever in the world its global support and engineering teams are located;

(b) some administrative, email and accounting services we use may store or process information outside Australia.

Before we disclose personal information to an overseas recipient we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, mainly through the contractual, security and certification commitments in our agreements with those providers.

Uploaded models and generated reports are held within the Ark Resources Microsoft 365 environment, in Australian data centres, encrypted in transit and at rest.

Each client's files are held in a separate folder. Access is restricted to that client's account and to the Ark Resources personnel who need access to deliver the service. Signing in requires multi-factor authentication.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. No system is completely secure, and we can't guarantee absolute security.

ArkiLume only uses the browser storage required to keep you signed in. We don't use tracking, analytics or advertising cookies.

Different material is kept for different periods:

(a) we delete the project material you upload, including IFC models, drawings and PDFs, 30 days after we deliver your final report. You should keep your own copies;

(b) we keep the reports we produce, and a record of the settings we used to produce them, for two years, so that we can answer a later question about a report;

(c) we keep account and contact records for as long as your account is open and for two years after it closes; and

(d) we keep financial and tax records for seven years, as required by law.

You can ask us to close your account and delete the material associated with it at any time. We'll action reasonable requests promptly, except where we're required by law to keep the information, or where we need it to resolve a dispute or enforce our agreements. Where we no longer need personal information and aren't required to keep it, we take reasonable steps to destroy or de-identify it.

If we become aware of a breach affecting your information, we'll act promptly to contain it and work out what happened. Where the breach is likely to result in serious harm, we'll notify you and the Office of the Australian Information Commissioner (OAIC) as required under Australia's Notifiable Data Breaches scheme, explain what happened and set out what you can do about it. We may also report the breach to another regulator or to law enforcement where that's appropriate.

ArkiLume links to third-party sites such as Microsoft and arkresources.com.au. We aren't responsible for the privacy practices of sites we don't operate, and this policy doesn't cover them.

You can ask to access or correct the personal information we hold about you by contacting our Privacy Officer using the details below. We'll need to verify your identity first, and we'll respond within 30 days. Access and correction are usually free; if a request needs substantial work we'll tell you the cost before we start.

If we can't give you access or make a correction, we'll tell you in writing why.

If you have a concern about how we've handled your personal information, contact our Privacy Officer. We'll acknowledge it promptly and give you a written response within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC).

We may update this policy from time to time. The current version is always available at www.arkilume.com.au/privacy-policy, with the date it was last updated. Where a change is material we'll notify registered users before it takes effect.

Privacy Officer, Ark Resources Pty Ltd
Level 4, 127 Market Street, South Melbourne VIC 3205
Email: privacy@arkresources.com.au
Phone: +61 3 9636 0280

This policy is governed by the laws of Victoria, Australia.