Privacy Policy

This policy applies to:

• visitors to our website;
• people who create or use an account on the Platform on behalf of a hospitality business (our "Customers");
• people who work at a Customer's venue ("Venue Staff") whose information the Customer loads into, or connects to, the Platform; and
• people who apply to work with us.

The Platform is intended for use by businesses. The Customer controls its account and is responsible for the personal information it provides to us.

We handle personal information in two capacities:

• On behalf of a Customer. A Customer, usually your employer, decides what Venue Staff information is loaded into the Platform and how the Platform is used in its business. We handle that information for the Customer under our Data Processing Addendum.
• For our own purposes. This covers account, billing, support, enquiry, marketing and website information, and the limited uses described in sections 4 and 6.

If you are a Venue Staff member, your employer is best placed to help with questions and requests about your information. If you contact us first, we will refer you to your employer and assist it to respond. We are not responsible for the privacy practices of a Customer, which may differ from this policy.

This policy does not apply to third party systems that integrate with the Platform.

The Platform also holds venue operating data, such as point of sale (POS) records of when an order was placed, the order type, the sale amount and the store location. This is business information and is generally not personal information. We do not seek information that identifies a venue's patrons.

We do not seek to collect sensitive information (for example health information). Our Terms of Service require Customers not to load sensitive information, tax file numbers, bank account details or government identifiers into the Platform.

Younger workers. Our website and Platform are not directed to children. Hospitality venues commonly employ people under 18, so Venue Staff information supplied by a Customer may relate to younger workers. We handle that information in the same way as other Venue Staff information.

If you do not provide information we need, we may be unable to provide the Platform or some of its features to you.

We collect personal information:

• directly from you, for example when you create an account, contact us, request a demonstration or subscribe to communications;
• from another party, for example a Customer that loads or connects Venue Staff information, or a third party system such as a POS, time and attendance or payroll system that a Customer authorises us to connect to; and
• automatically, through server logs and strictly necessary cookies (see our Cookie Policy).

You can browse our website without identifying yourself. We cannot provide the Platform to you on an anonymous basis because we need to authenticate users and administer accounts.

We use personal information to:

• provide the Platform to you and our Customers, including sales forecasts, generated rosters and labour optimisation guidance, and to administer, maintain and improve its performance;
• allow you to access and use the Platform, including authentication;
• train and calibrate a Customer's venue forecasting models using that Customer's own data;
• develop, train, test and improve our models, algorithms, products and services, including across our customer base (see section 6);
• provide assistance and support, and respond to requests and complaints;
• protect the safety and security of the Platform, including detecting and responding to security incidents, fraud and unlawful activity;
• generate de-identified statistical data, measure performance and produce benchmarks;
• communicate with you about the Platform and, where permitted by the Spam Act 2003 (Cth), send marketing messages;
• comply with our legal obligations and exercise or defend legal claims; and
• facilitate a sale, merger or restructure of our business.

We do not sell personal information.

The Platform uses proprietary machine learning models, developed by Zuno, to forecast sales and to generate recommended rosters and labour guidance for a venue. The models are statistical forecasting and optimisation models. The Platform is not a generative AI or large language model product.

• Personal information used. To generate a recommended roster, the Platform uses Venue Staff information such as names, roles, employment type, classifications and pay rates, availability and shift history. Dates of birth are used to work out the wage rates that apply to a staff member.
• What the Platform does. The Platform produces recommendations. It does not make employment decisions.
• Human control. A manager at the Customer's venue reviews each recommended roster and accepts, overrides or confirms it. Overrides are logged with a reason. The Customer remains the decision maker and is responsible for rostering decisions that affect its staff.
• No solely automated decisions. We do not use the Platform to make decisions about individuals without human involvement.
• No third party AI providers. We do not send Customer data to third party artificial intelligence (AI) model providers, and we do not use Customer data to train third party or general-purpose AI models. If that changes we will update this policy before the change takes effect.

From 10 December 2026 the Privacy Act requires APP entities to describe in their privacy policies certain decisions made with the assistance of computer programs. This section is intended to give that transparency for the Platform. Customers who use the Platform should consider what they need to say in their own privacy policies, and we will assist on request.

Improving forecast accuracy is central to the Platform, and it depends on learning from data across the venues we serve.

• Venue operating data. We use venue operating data, such as sales and trading data, across our customer base to develop, train, test and improve our models, algorithms, products and services. This is generally not personal information.
• De-identified data. We de-identify or aggregate data and use it for the same purposes, and to measure performance and produce collective insights and industry benchmarks. We do not attempt to re-identify de-identified data.
• Personal information. Our models do not need to know who an individual is in order to learn. We de-identify personal information before it is used for model development across customers.
• What we do not do. We do not use this data to analyse the personal characteristics of individuals, and we do not publish or disclose it in a form that identifies an individual, a Customer or a venue.

We may retain models, learnings and de-identified data after a Customer's subscription ends.

We may disclose personal information to:

• the Customer whose account the information relates to, and its authorised users;
• any third party that a Customer directs us to disclose it to, including third party systems the Customer connects to the Platform;
• technology and service providers that help us operate our business, such as hosting, payment processing, email and accounting providers;
• our related companies;
• our lawyers, accountants, insurers and other professional advisers;
• regulators, courts and law enforcement bodies where required or authorised by law; and
• a prospective purchaser or investor in connection with a business transfer, under obligations of confidentiality.

Personal information held in the Platform is hosted in Australia.

We engage software development contractors located in Vietnam. A limited number of authorised support personnel in Vietnam may access personal information held in the Platform, under supervision and confidentiality obligations, in order to maintain and support it.

Some service providers we use to administer our own business may handle limited account and billing information outside Australia. Our payment provider (Stripe) may handle information in countries including the United States, India and member states of the European Union.

Before we disclose personal information to an overseas recipient we take reasonable steps to ensure the recipient does not breach the APPs in relation to that information. If our hosting or overseas disclosure arrangements change, we will update this policy.

We use technical and organisational measures to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

No security system is impenetrable. We cannot guarantee the security of information during transmission over the internet or while it is stored on our systems.

If we have reasonable grounds to suspect a data breach involving personal information we hold, we will assess it promptly. If an eligible data breach has occurred, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. Where the breach involves information we hold on behalf of a Customer, we will notify the Customer and coordinate the response with it.

We keep personal information for the period necessary to fulfil the purpose for which it was collected or another purpose described in this policy, or to meet legal and regulatory obligations such as financial record keeping. When information reaches the end of its retention period we delete or de-identify it. If that is not immediately possible, for example because the information is in a backup, we isolate it from further use until deletion is possible.

When a Customer's subscription ends, we delete or de-identify Venue Staff information within 12 months after the end of the export period, other than copies in backups and records we are required by law to keep. This is set out in our Data Processing Addendum.

You may ask for access to the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify your identity. We will respond within a reasonable period, usually within 30 days. If we refuse a request we will give you written reasons and tell you how to complain.

If we hold your information only because we provide the Platform to your employer, it will usually be more appropriate to make your request to your employer, and we will tell you so if you contact us first.

We send marketing messages only with your consent, whether express or inferred as permitted by the Spam Act 2003 (Cth). Every marketing message identifies us and includes a working unsubscribe facility. We action unsubscribe requests within 5 working days.

If you have a complaint about how we handle your personal information, please contact our Privacy Officer using the details below. We may need to contact you for further details. We will investigate and respond in writing within a reasonable time, usually within 30 days.

If you are not satisfied with our response you may complain to the OAIC at www.oaic.gov.au or on 1300 363 992.

We may change this policy at any time. We will publish the updated policy on our website with a revised effective date. If a change is material we may also give notice by email or in the Platform.

The company responsible for compliance with this policy is Zuno Group Pty Ltd (ACN 692 114 060, ABN 26 692 114 060).

Privacy Officer

Email: hello@zuno.au