Privacy policy

1. Information we collect

Depending on your interactions with us, we collect:

• Your name, email address, telephone number, and business or property details.
• Enquiry details, service interests, project requirements, budget information and answers you choose to provide on a form.
• Our correspondence with you, contact preferences, consent records and notes about your enquiry or project.
• Appointment, inspection, proposal and customer-service information, and documents or photographs you provide in connection with our services.
• For Meta lead forms: lead, Page, form, advertisement or campaign identifiers and submission times, and whether the enquiry came from Facebook or Instagram, where Meta makes that information available.
• For staff using BMS: account and role details, assignments and activity records. Our hosting and security providers may also process technical information such as IP addresses, browser details and request logs.

Please provide only information relevant to your enquiry. We do not ask you to include sensitive personal information in lead forms.

2. How we collect information

We collect information directly when you submit an enquiry, contact us by telephone or email, book or attend an appointment, or provide information during a project. We also receive information you submit through Facebook or Instagram instant forms, and information from authorised team members, representatives or referrals.

When you submit a Meta lead form, Meta may securely send the information to our CRM so we can respond. Meta handles information on its own platforms under its own privacy policy.

You may contact us without identifying yourself where practical. If you do not provide contact or project details, we may be unable to respond, arrange a visit or provide the requested service.

3. How we use information

We use personal information to respond to enquiries, understand service requirements, arrange appointments, assign appropriate team members, prepare proposals, provide services, follow up on requests, maintain business records and protect our systems.

BMS may route enquiries, create tasks and schedule reminders. These functions support our team in managing customer relationships. Emails or SMS reminders depend on the services and communication preferences configured for your enquiry.

Where permitted by law and consistent with your preferences, we may send relevant marketing communications. You can opt out at any time using an available unsubscribe facility or by contacting us. We do not sell personal information.

4. Sharing and overseas storage

We share information with authorised staff and contractors who need it to respond to your enquiry or deliver services. We may also disclose relevant information to professional advisers, technology providers, or authorities where required or permitted by law.

Our BOSS Manager workspace uses Cloudflare for hosting and security and Supabase for database and authentication services. Meta provides the Facebook and Instagram lead-form integration. Configured email or SMS providers may process contact details and message content when those services are used.

Our current BMS database is hosted in South Korea. These providers may also process information in the United States and other countries where they or their service providers operate. Consequently, your information may be stored or accessed outside Australia. Provider locations can change; contact us for current details. Where applicable, we take reasonable steps to address privacy obligations for overseas disclosures.

We do not publish customer contact details through the CRM. Access is restricted to authorised accounts and business workspaces.

5. Security, cookies and retention

We use safeguards appropriate to the information, including authenticated access, role-based permissions, restricted database access and encrypted connections. No online service can guarantee absolute security.

BMS uses essential authentication cookies to keep authorised users signed in. Our infrastructure providers may use cookies or similar technologies for security and service operation. This CRM does not currently include advertising pixels or optional analytics tracking. Facebook and Instagram have their own cookie practices. Disabling essential cookies may prevent account sign-in.

We retain information for as long as reasonably needed for the enquiry, customer relationship, service delivery, record-keeping, legal obligations and resolving disputes. When information is no longer needed, we take reasonable steps to delete or de-identify it. Residual copies may remain in protected backups until they are replaced under the relevant backup cycle.

6. Access, correction and deletion

You can request access to your personal information, ask us to correct inaccurate or outdated details, update communication preferences, or request deletion by emailing admin@nicholasyoungdesign.com.au.

For a deletion request, use the subject Privacy — data deletion request and include the name and contact details used for your enquiry, plus enough information for us to locate it. Do not send passwords, access tokens or identity documents in an initial request. We may need to verify your identity before disclosing or changing records.

We will assess your request and respond within a reasonable period. Some information may need to be retained for legal, contractual or legitimate record-keeping purposes; we will explain any applicable limitation. Deleting information from our systems does not delete information held independently by Meta or another service.

To remove an app connection from your Facebook account, use Facebook’s business integration settings. Removing access stops that connection’s future access; contact us separately about information already received.

7. Contact and complaints

For privacy enquiries, requests or complaints, contact:

Please describe your concern and how we can contact you. We will review the matter and aim to respond within 30 days. If more time is required, we will let you know. If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner to understand your options, where applicable.

8. Changes to this policy

We may update this policy as our services, systems or legal obligations change. The current version will be available on this page, with its last-updated date.