Privacy Policy

1. Introduction

NEWCHURCHTEK PTY LTD (ACN 159 180 337), as trustee for C D & A VAN NIEUWKERK FAMILY TRUST (ABN 33 589 622 372), trading as You'reOnTime ("You'reOnTime", "we", "us" or "our"), recognises the importance of protecting personal information and respecting individual privacy rights.

This Privacy Policy explains how we collect, hold, use, disclose, protect and retain personal information through:

• Our website at https://youreontime.com ("Site").
• Our salon, spa, barber and clinic management software, including web, desktop and mobile applications ("Platform").
• Consumer-facing services hosted on behalf of businesses using our Platform, including online booking pages, branded mobile applications, electronic forms, gift vouchers, memberships, online stores, reviews, self check-in and appointment communications ("Client Services").

We manage personal information in accordance with applicable privacy and data protection laws, including:

• The Privacy Act 1988 (Cth), Australian Privacy Principles and Notifiable Data Breaches scheme.
• The European Union General Data Protection Regulation ("GDPR"), where applicable.
• The UK GDPR and Data Protection Act 2018, where applicable.
• Bermuda's Personal Information Protection Act 2016 ("PIPA"), where applicable.

This Privacy Policy should be read together with our Terms of Service and, where applicable, the privacy policy of the business providing services to you.

We do not sell personal information.

2. Who This Policy Applies To

Customers: Businesses subscribing to You'reOnTime, including their owners, directors, employees, contractors and authorised users.

Clients: Individuals whose personal information is entered into the Platform by a Customer or who interact with a Customer through our Client Services.

Visitors: Individuals who visit our Site, request demonstrations, contact us, subscribe to communications or otherwise interact with You'reOnTime.

2.1 Our Role

For Customers and Visitors, You'reOnTime generally determines how and why personal information is processed and acts as the data controller where GDPR or UK GDPR applies.

For Clients, the Customer generally determines the purposes and means of processing personal information, and You'reOnTime processes that information on the Customer's behalf.

Customers are responsible for obtaining necessary consents, providing appropriate privacy notices and complying with applicable privacy laws when collecting and managing their Clients' information.

2.2 Limited Independent Processing

You'reOnTime may independently process limited Client information where reasonably necessary to:

• Maintain the security and integrity of the Platform.
• Investigate fraud, misuse or security incidents.
• Provide authentication and account verification.
• Respond to enquiries or complaints.
• Comply with legal obligations.
• Establish, exercise or defend legal claims.
• Produce aggregated or de-identified statistics.

Such processing will be limited to legitimate purposes and carried out in accordance with applicable law.

3. What Is Personal Information?

Personal information means information or an opinion about an identified or reasonably identifiable individual.

Examples include names, addresses, telephone numbers, email addresses, dates of birth, appointment histories, account identifiers and IP addresses.

Sensitive information may include health records, allergies, medications, medical conditions, photographs, consultation notes and other information receiving additional protection under applicable privacy laws.

We process sensitive information only where there is an appropriate legal basis and in accordance with applicable law.

Aggregated or properly de-identified information that does not identify an individual may be used for analytics, reporting and product improvement.

4. Personal Information We Collect

4.1 Visitors

We may collect:

• Names, contact details and business information.
• Enquiries, messages and correspondence.
• Demo requests and marketing preferences.
• Website usage and technical information.
• Publicly available business information where legally permitted.

4.2 Customers

We may collect:

• Business names, addresses and registration details.
• Names and contact details of owners and authorised users.
• Account credentials and authentication information.
• Subscription plans, invoices and billing history.
• Payment transaction references and limited card information supplied by payment processors.
• Account registration and Terms acceptance records.
• Customer support communications.
• Account activity and system audit logs.
• Information entered into the Platform.

Full payment card details are handled by authorised payment processors rather than stored directly by You'reOnTime.

4.3 Clients

Depending on the services used, we may process:

• Names and contact details.
• Appointment and booking histories.
• Purchase and payment information.
• Gift vouchers, memberships and loyalty records.
• Consultation forms, signatures and photographs.
• Health information, allergies and treatment notes.
• Marketing preferences and communication history.
• Reviews and feedback.
• Technical information associated with Client Services.

Customers control the collection and use of their Clients' information and are responsible for obtaining any required consent.

5. Online Booking and Client Services

5.1 Online Bookings

When Clients make appointments through our booking services, we process the information necessary to create and manage their bookings.

This may include names, contact details, selected services, appointment dates, staff preferences and booking notes.

5.2 Client Authentication

Where Client login functionality is available, identity may be verified through one-time codes sent by SMS or email.

5.3 Appointment Communications

You'reOnTime may send appointment confirmations, reminders, follow-ups and other service-related communications on behalf of Customers.

Customers may also use the Platform to send marketing communications, subject to applicable laws and consent requirements.

5.4 Online Payments

Online payments, deposits and purchases may be processed by third-party payment providers, including Stripe, Windcave, Square or other supported providers.

Payment providers handle sensitive card information according to their own privacy and security obligations.

You'reOnTime may receive transaction references, payment tokens, card brand, last four digits and transaction status information where necessary to operate the Service.

5.5 Electronic Forms and Sensitive Information

Customers may collect consultation details, medical information, photographs, signatures and other sensitive information through electronic forms.

You'reOnTime processes this information on the Customer's behalf and does not use it for unrelated marketing purposes.

5.6 Reviews and Client Communications

Where enabled by the Customer, Clients may submit reviews, respond to appointment messages or communicate with the business through the Platform.

Information is made available to the relevant Customer in accordance with the functionality selected.

5.7 Third-Party Integrations

Customers may connect third-party services to their You'reOnTime account.

Information shared through authorised integrations may also be subject to the privacy policies of those third parties.

5.8 Marketing by Customers

Customers are responsible for complying with applicable marketing and anti-spam laws.

You'reOnTime does not use Customers' Client databases to market its own products or services.

5.9 Separate Customer Databases

Customer business databases are maintained separately.

You'reOnTime does not combine Clients' appointment histories across unrelated businesses to create advertising profiles.

6. How We Collect Personal Information

We collect information:

• Directly through registration, enquiries and communications.
• Through use of the Platform and Client Services.
• From Customers who enter or import Client information.
• Automatically through system logs, cookies and technical monitoring.
• From payment processors and authorised service providers.
• From publicly available sources where permitted by law.

We take reasonable steps to ensure personal information is collected lawfully and only where reasonably necessary.

7. How and Why We Use Personal Information

We collect, use and disclose personal information for the following purposes.

7.1 Providing Our Services

To operate accounts, process bookings, manage subscriptions, provide customer support and deliver the Platform and Client Services.

7.2 Billing and Subscription Management

To process subscription payments, issue tax invoices, maintain billing records, manage renewals and recover valid outstanding fees.

7.3 Billing Errors and Outstanding Payments

Where subscription fees have not been collected because of a technical, administrative or billing error, we may use relevant account, invoice and payment information to investigate the error, notify the Customer and recover valid outstanding amounts.

7.4 Payment Disputes and Chargebacks

We may use relevant information to investigate disputed payments, verify subscription charges, demonstrate service delivery, respond to chargebacks and establish or defend legal claims.

Relevant information may include:

• Subscription agreements and acceptance records.
• Payment authorisations and transaction details.
• System-generated tax invoices.
• Account registration and subscription history.
• System audit logs and activity records.
• Appointment and transaction activity.
• Customer communications and billing notifications.

We will limit the information used or disclosed to what is reasonably necessary and legally permitted.

7.5 Fraud Prevention and Security

We may use account activity and technical information to identify suspicious activity, investigate security incidents, prevent misuse and protect our systems.

7.6 Service Improvement

We may analyse system performance, technical errors and usage patterns to improve the Platform.

Where practicable, we use aggregated, de-identified or pseudonymised information.

7.7 Communications

We may contact Customers regarding account activity, payments, subscriptions, security matters, support requests and changes to our services or policies.

7.8 Marketing

We may send Customers and Visitors marketing communications where permitted by law.

Recipients may unsubscribe at any time.

7.9 Legal Compliance

We may process information to meet taxation, accounting, regulatory, security and legal obligations.

7.10 Lawful Bases for Processing

Where GDPR or UK GDPR applies, we rely on an appropriate lawful basis, which may include:

• Performance of a contract.
• Compliance with legal obligations.
• Legitimate interests, where those interests are not overridden by individuals' rights.
• Consent, where required.

For sensitive information, we will also identify an applicable additional condition for processing where required.

Where we process Client information on behalf of a Customer, we generally act under that Customer's documented instructions.

8. What Happens if Information Is Not Provided?

If necessary personal information is not provided, we may be unable to:

• Create or maintain an account.
• Provide booking and appointment services.
• Process payments.
• Verify account ownership.
• Respond to support requests.
• Provide certain Platform features.

9. Cookies, Analytics and Tracking Technologies

9.1 Website Cookies

Our Site may use cookies and similar technologies to support functionality, measure traffic, improve performance and deliver relevant advertising.

These may include services such as Google Analytics, Google Ads and Meta Pixel.

9.2 Platform Cookies

The Platform and Client Services may use essential cookies and local storage for authentication, security, booking functionality and session management.

9.3 Performance Monitoring

We may collect technical information to identify errors, monitor performance and maintain service reliability.

9.4 Cookie Choices

Users may manage cookies through browser settings and any cookie preference tools made available on our Site.

Where consent is legally required for non-essential cookies, we will obtain it before using those technologies.

9.5 Third-Party Content

Embedded content, maps and links may be subject to the privacy practices of third-party providers.

10. Disclosure of Personal Information

We may disclose relevant personal information to:

• Authorised employees, directors and contractors.
• Cloud hosting and infrastructure providers.
• Payment processors, acquiring banks, card networks and financial institutions.
• SMS, email and notification providers.
• Customer support and technical service providers.
• Authorised third-party integrations.
• Accountants, auditors, legal advisers and insurers.
• Lawfully engaged debt recovery providers.
• Courts, regulators and law enforcement agencies where required or permitted by law.
• Other parties where consent has been provided or disclosure is otherwise legally authorised.

10.1 Payment Disputes and Chargebacks

Where a payment is disputed, reversed or charged back, You'reOnTime may provide relevant evidence to payment processors, banks, card networks, financial institutions and professional advisers.

Evidence may include invoices, payment records, subscription agreements, audit logs, account activity and relevant correspondence.

We will take reasonable steps to limit disclosures to information necessary for the dispute.

Where audit logs contain personal information relating to Clients or unrelated third parties, we will redact or minimise that information where reasonably practicable.

10.2 Debt Recovery

Where a valid outstanding balance remains unpaid, relevant account, billing and contact information may be disclosed to authorised debt recovery providers or legal advisers where reasonably necessary and permitted by law.

10.3 Service Providers

We take reasonable steps to ensure service providers handling personal information implement appropriate confidentiality, privacy and security protections.

10.4 Business Transfers

Personal information may be disclosed in connection with a proposed or completed merger, acquisition, restructuring or sale of our business, subject to applicable law and appropriate confidentiality safeguards.

10.5 No Sale of Personal Information

You'reOnTime does not sell personal information or disclose Customers' Client databases to unrelated businesses for their own direct marketing.

11. Storage and Overseas Transfers

You'reOnTime operates from Australia and uses third-party infrastructure and service providers.

Personal information may be stored, processed or accessed in Australia and overseas, including the United States and countries within the European Economic Area.

Where required by Australian privacy law, we take reasonable steps to ensure overseas recipients handle personal information consistently with applicable Australian Privacy Principles.

Where GDPR or UK GDPR applies, we use appropriate international transfer safeguards, such as adequacy decisions, Standard Contractual Clauses, UK transfer agreements or other legally recognised mechanisms.

Where Bermuda PIPA applies, overseas transfers will be handled in accordance with applicable requirements.

We may maintain records of relevant sub-processors and international transfers as required by law.

12. Direct Marketing

You'reOnTime may send Customers and Visitors information about our products, services, features, promotions and events where permitted by law.

Marketing may be delivered through email, SMS, telephone or digital advertising.

Recipients may opt out using unsubscribe links, SMS opt-out instructions or by contacting us.

Opting out of marketing does not prevent essential communications concerning account security, billing, subscriptions or service delivery.

We do not use Customers' Client databases for our own marketing.

13. Security of Personal Information

You'reOnTime takes reasonable technical, organisational and administrative measures to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure.

These measures may include:

• Encryption of information in transit and at rest.
• Secure cloud hosting.
• Role-based access controls.
• Individual account credentials and authentication controls.
• System audit logs.
• Access restrictions for authorised personnel.
• Security monitoring and vulnerability management.
• Backup and recovery procedures.
• Confidentiality and security obligations for service providers.

Customers are responsible for protecting their login credentials and appropriately managing staff access permissions.

No internet-based system can guarantee absolute security.

If you suspect unauthorised access to your account, please contact us promptly.

14. Retention and Deletion of Personal Information

14.1 General Retention Principles

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to legal, contractual, security and regulatory requirements.

14.2 Customer Account and Financial Records

Customer account, billing and transaction records may be retained for the duration of the subscription and for seven years after it ends, where necessary to meet applicable tax, accounting and legal requirements.

14.3 Customer Business Data – 90-Day Retention

Following cancellation or termination of a Customer's subscription, You'reOnTime will ordinarily retain the Customer's business data, including appointment records, Client information and other operational records, for 90 calendar days.

During this period, Customers may request an export of their business data, subject to reasonable identity verification, security and privacy requirements.

After the 90-day period, Customer business data may be permanently deleted from active production systems and may no longer be recoverable.

Deleted information may remain in encrypted backups until those backups are removed through established backup retention procedures.

Customers are responsible for requesting or exporting required business records within the retention period.

14.4 Suspended Accounts

Where an account is suspended rather than cancelled or terminated, suspension does not automatically trigger deletion of Customer business data.

Data will ordinarily be retained while the account remains suspended, subject to applicable law, our Terms of Service and any subsequent termination.

If the account is subsequently terminated, the 90-day retention period will ordinarily commence from the effective termination date.

14.5 Extended Retention for Billing Disputes and Legal Purposes

Certain records may be retained beyond the ordinary 90-day period where reasonably necessary or legally required.

These may include:

• Tax invoices and financial records.
• Payment authorisations and transaction records.
• Subscription agreements and acceptance records.
• System audit logs and account activity records.
• Relevant customer communications.
• Security incident records.
• Information necessary to investigate or respond to chargebacks.
• Records necessary to establish, exercise or defend legal claims.

Retention will be limited to information reasonably necessary for the relevant purpose.

Where a dispute or legal matter remains unresolved, relevant records may be preserved until the matter is resolved and any applicable retention requirements have been satisfied.

14.6 Audit Log Retention

System audit logs may be retained separately from ordinary Customer business data for security, operational, compliance and dispute-resolution purposes.

Where audit logs are required to investigate payment disputes, demonstrate service delivery or support legal proceedings, they may be retained beyond the 90-day Customer data retention period.

Access will be restricted to authorised personnel and disclosures will be limited to legitimate and lawful purposes.

14.7 Other Information

Marketing consent and opt-out records may be retained as necessary to respect communication preferences.

Support correspondence and enquiries may be retained for reasonable operational and legal purposes.

Properly de-identified or aggregated information may be retained for statistical and product improvement purposes.

14.8 Deletion Requests

Customers may request earlier deletion of information, subject to applicable legal obligations, third-party rights and legitimate retention requirements.

Where deletion cannot be completed, we will explain the reason where reasonably practicable and legally permitted.

15. Data Breaches

If a data breach involving personal information occurs, You'reOnTime will take reasonable steps to contain the incident, investigate its cause, assess potential harm and implement appropriate remedial measures.

Where required by the Australian Notifiable Data Breaches scheme, we will notify the Office of the Australian Information Commissioner and affected individuals.

Where GDPR or UK GDPR applies, we will comply with applicable breach notification obligations, including notification to supervisory authorities and affected individuals where required.

Where a breach affects information processed on behalf of a Customer, we will notify the Customer in accordance with applicable law and contractual obligations and assist with relevant investigations and notifications.

Where Bermuda PIPA applies, we will comply with applicable breach notification requirements.

16. Accessing, Correcting and Deleting Personal Information

Individuals may request access to, correction of or deletion of personal information by contacting You'reOnTime.

We may require reasonable identity verification before responding.

Requests will be handled within applicable legal timeframes.

16.1 Customer Account Information

Customers may access and update relevant account information through the Platform.

16.2 Client Information

Where personal information is controlled by a Customer, requests should generally be directed to that Customer.

If a Client contacts You'reOnTime directly, we may refer the request to the relevant Customer and assist where appropriate.

16.3 Data Access During Suspension

Where a Customer's account has been suspended, the Customer may request a reasonable opportunity to retrieve or export its business data.

You'reOnTime may provide information through a secure export or other appropriate method without restoring full access to the Platform.

Requests may be subject to identity verification, privacy, security and legal requirements.

Suspension for non-payment does not automatically result in deletion of Customer data.

16.4 Refusal or Restriction of Requests

Certain requests may be restricted where necessary to comply with legal obligations, protect third-party privacy or preserve information required for legal claims.

Where appropriate, we will explain the reason for a refusal and available complaint options.

16.5 Client App Data Removal

Requests concerning information held in branded Client applications may also be submitted through:

https://youreontime.com/dataremoval

17. Rights Under the GDPR and UK GDPR

Where GDPR or UK GDPR applies, individuals may have rights including:

• Access to personal information.
• Correction of inaccurate information.
• Erasure in applicable circumstances.
• Restriction of processing.
• Data portability.
• Objection to certain processing.
• Withdrawal of consent.
• Protection against certain solely automated decisions producing legal or similarly significant effects.

These rights are subject to applicable conditions and exceptions.

Where You'reOnTime acts as a processor, requests concerning Client information will generally be referred to the relevant Customer acting as controller.

We will respond within applicable legal timeframes, ordinarily within one month, subject to lawful extensions.

Individuals may also lodge complaints with the relevant data protection authority.

18. Rights Under Bermuda's PIPA

Where Bermuda's Personal Information Protection Act 2016 applies, individuals may have rights to:

• Request access to personal information.
• Request correction of inaccurate information.
• Request erasure or blocking in applicable circumstances.
• Object to certain processing.
• Withdraw consent where applicable.
• Lodge complaints with Bermuda's Privacy Commissioner.

These rights are subject to applicable legal conditions and exceptions.

Requests may be submitted through our contact details in Section 22.

19. Automated Decision-Making and Profiling

You'reOnTime provides automated features that Customers may configure, including appointment reminders, booking rules, cancellation settings, marketing campaigns and other workflow functions.

These features generally operate according to the Customer's settings and instructions.

You'reOnTime may also use automated systems to identify potential fraud, suspicious transactions, unusual account activity or security risks.

Where an automated system flags an account for potential suspension or termination, a member of our team will review the relevant circumstances before a significant account restriction is imposed.

We do not ordinarily make solely automated decisions about individuals that produce legal or similarly significant effects.

Where applicable law requires additional transparency about automated decisions, we will provide information about the relevant decisions, categories of personal information used and available rights.

Individuals may contact us to request information or review where required by law.

20. Children

The You'reOnTime Platform is intended for business use and is not directed at children.

Customer accounts must be registered by individuals aged 18 years or older.

Client Services may be used in connection with appointments or services for minors, subject to appropriate parental or guardian involvement and applicable legal requirements.

Customers are responsible for obtaining necessary consent and complying with laws concerning children's personal information.

If we become aware that information has been collected from a child without appropriate authorisation, we will take reasonable steps to address the matter.

21. Privacy Complaints

If you believe your privacy has been breached or have concerns about how your personal information has been handled, please contact us.

We will investigate complaints and aim to resolve them within 30 days, or within another period required by applicable law.

If you are dissatisfied with our response, you may contact the relevant privacy regulator:

Australia: Office of the Australian Information Commissioner
https://www.oaic.gov.au

European Economic Area: Relevant national data protection authority
https://www.edpb.europa.eu

United Kingdom: Information Commissioner's Office
https://ico.org.uk

Bermuda: Office of the Privacy Commissioner
https://www.privacy.bm

If your complaint concerns information controlled by a Customer, you should generally contact that Customer first.

22. Contacting Us

For privacy enquiries, requests, complaints or concerns, please contact:

You'reOnTime
NewChurchTek Pty Ltd
ACN 159 180 337
As trustee for C D & A Van Nieuwkerk Family Trust
ABN 33 589 622 372

Website: https://youreontime.com
Contact: https://youreontime.com/contact
Data Removal Requests: https://youreontime.com/dataremoval

Attention: Privacy Officer

We will handle privacy enquiries confidentially and respond within a reasonable period and any applicable legal timeframe.

23. Changes to This Privacy Policy

You'reOnTime may update this Privacy Policy to reflect changes to our services, business practices, technology or legal obligations.

The current version will be published on our website, together with its effective date.

Where changes materially affect how personal information is collected, used, disclosed or retained, we will provide appropriate notice and obtain consent where required by law.

Previous versions may be retained for compliance and record-keeping purposes.

This Privacy Policy applies to our operations in Australia and, where applicable, the European Union, United Kingdom and Bermuda.