How PrimeGreen handles your data.

PrimeGreen is operated by CleanCog Pty Ltd ("PrimeGreen", "we", "us"), an Australian business based in Sydney. This Data Use Policy explains how we collect, hold, use, and disclose personal information and business data in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

• Account data: name, email, phone, business name, role, login credentials.
• Operational data: utility bills, fuel receipts, waste invoices, fuel card exports, facility details, NMI/MIRN/meter IDs, addresses, and the contents of documents you upload.
• Derived data: extracted fields, calculated emissions (Scope 1, 2, 3), validation results, and audit trails generated by our AI agents.
• Tender content: tender questions, drafted responses, and review findings you create in the platform.
• Technical data: IP address, browser type, log entries, and basic usage analytics.

We do not knowingly collect sensitive information as defined in the Privacy Act.

• To provide the PrimeGreen service — extracting bill data, calculating emissions using NGA factors, and generating tender responses.
• To validate and audit your data quality, including greenwashing checks aligned with AASB S2, ASIC INFO 271, and ACCC guidance.
• To authenticate users and secure accounts.
• To improve the platform's accuracy. AI prompts may include extracts of your data at the time of processing, but your data is not used to train third-party foundation models.
• To communicate with you about your account, support requests, and material service changes.

We collect and handle personal information under APP 3 only where it is reasonably necessary for our functions. We will tell you, at or before the time of collection, what we are collecting and why (APP 5). We will not use your information for direct marketing without your consent (APP 7).

PrimeGreen runs on the Base44 platform, which uses cloud infrastructure that may store data in Australia and overseas data centres. Where data is disclosed to an overseas recipient, we take reasonable steps under APP 8 to ensure they handle it consistently with the APPs. Sub-processors we currently rely on include cloud hosting, email delivery, and AI inference providers.

We do not sell your data. We disclose information only:

• To other users in your own organisation (e.g. consultants, facility managers) according to their role.
• To sub-processors who help us operate the service, under contract.
• Where required by Australian law, court order, or to protect our legal rights.

We use TLS in transit, access controls, role-based permissions, and audit logging. Passwords used to authenticate to PrimeGreen are validated server-side and never returned to the browser. Despite our best efforts, no system is perfectly secure — please use a strong, unique password.

We retain your account and operational data for as long as your account is active. On account closure, we will delete or de-identify personal information within 90 days unless we are required by law to retain it (e.g. financial records under the Corporations Act 2001).

If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by Part IIIC of the Privacy Act (the Notifiable Data Breaches scheme).

Under the APPs you can:

• Request access to the personal information we hold about you (APP 12).
• Request correction of inaccurate or out-of-date information (APP 13).
• Withdraw consent or close your account at any time.
• Make a privacy complaint to us, and escalate to the OAIC (oaic.gov.au) if unresolved.

We use a small number of essential cookies for authentication and basic, privacy-respecting analytics to understand platform usage. We do not use third-party advertising trackers.

PrimeGreen is a B2B service and is not directed at children under 16.

We may update this policy from time to time. Material changes will be communicated by email or in-product notice before they take effect.

For privacy questions, access/correction requests, or complaints, contact our Privacy Officer:

anthony.dupreez@cleancog.com