Privacy Policy

Version 1.4 · Effective November 2026

​

SECTION 1  ·  APP 1

Overview

Nova Analytics respects your privacy and is committed to protecting personal and business information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

This policy outlines how Nova Analytics collects, uses, stores, discloses, and manages personal information. It applies to all clients, prospective clients, and individuals whose personal information is provided to us in connection with our services.

We are committed to handling all personal information with transparency, care, and in strict accordance with our legal obligations. If you have any questions about this policy or our privacy practices, please contact us using the details in Section 16.

​

SECTION 2  ·  APP 2

Anonymity & Pseudonymity

Where practicable, individuals have the option of not identifying themselves or of using a pseudonym when interacting with Nova Analytics.

However, given the nature of our services, identification is generally required to deliver dashboards and analytics tailored to your business. Where a client cannot be identified, Nova Analytics may be unable to provide the agreed services. This will be communicated clearly at the time of engagement.

​

SECTION 3  ·  APPS 3 & 4

What We Collect

Nova Analytics collects the information needed to deliver the agreed services. Depending on what clients choose to provide, this may include:

• Business performance data (e.g. sales figures, bookings, invoices)

• Financial data (e.g. Xero exports, POS reports, revenue summaries)

• Staff and customer data (e.g. rosters, appointment records)

• Contact details (e.g. name, email address, phone number)

• Feedback and communication history

We do not collect sensitive information, such as health information, unless this has been agreed in writing with the client first.

​

3.1  Unsolicited Information

If Nova Analytics receives personal information that was not requested, we will assess whether it is necessary for the purpose of delivering our services. If it is not necessary, we will securely destroy or de-identify that information as soon as practicable, provided it is lawful to do so.

​

SECTION 4  ·  APP 5

How We Collect Information

Nova Analytics collects information through the following means:

• Direct uploads from clients (e.g. Excel, CSV, or PDF files)

• Access to data kept in a client's own Microsoft 365 environment (for example a SharePoint folder), for clients on an Owned package, using an account or guest access the client provides

• Email or consultation forms

• Client interviews or onboarding sessions

• Publicly available business directories and websites (business contact details only)

Client Data is provided by clients under the Service Agreement. Clients confirm they collected it lawfully and can share it with us (Terms of Service section 5.3).

​

4.1  Collection Notice

At or before the time of collecting your personal information, Nova Analytics will take reasonable steps to notify you of the following:

• The purpose for which the information is being collected

• Any third parties to whom the information may be disclosed

• Your right to access and correct your information

• The consequences if the information is not provided (i.e. Nova Analytics may be unable to deliver the agreed services)

A collection notice is provided at the time of data submission, in addition to this policy.

​

SECTION 5  ·  APPS 6 & 7

Why We Collect It

Nova Analytics uses your information primarily for the purpose of delivering agreed services. This includes:

•  Building custom dashboards and reports tailored to your business

• Tracking KPIs and business performance metrics

• Providing data-driven insights and analytics

• Delivering ongoing support and dashboard updates

​

Nova Analytics will not sell your personal information, use it for profiling, or use Client Data (including information about your customers and staff) for any marketing purpose.

​

We may occasionally contact clients and past clients about our own related services, for example a check-in or a package update.

We may also contact businesses whose contact details are publicly listed to introduce our services. Every such message identifies Nova Analytics and tells you how to opt out, and we stop as soon as you ask.

​

If we need to use your information for any other secondary purpose, we will seek your explicit written consent first.

​

SECTION 6  ·  APP 11

How We Store & Protect Your Information

Nova Analytics takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure.

 

Your data is stored using:

• Encrypted local drives and/or Microsoft OneDrive/SharePoint

• Password-protected folders and files

• Access restricted to authorised personnel only

• Multi-factor authentication on cloud platforms where available
   

While we take all reasonable precautions, no method of electronic storage or transmission is completely secure. We cannot guarantee the absolute security of your data.

​

6.1  Destruction of Data

When personal information is no longer required for the purpose for which it was collected, and the retention period outlined in Section 11 has elapsed, Nova Analytics will take reasonable steps to destroy or permanently de-identify that information securely.

​

6.2 Owned Packages

Where a client chooses an Owned package, its data stays in the client's own Microsoft 365 and Power BI environment. Nova Analytics accesses it only through a guest or named account issued by the client and protected by multi-factor authentication. To build the dashboard, Nova Analytics keeps a temporary working copy of the report file, which contains imported data, on its encrypted device. That copy is deleted within 10 business days after handover, and the deletion is confirmed to the client in writing. The client is responsible for the security, backup and access settings of its own environment.

 

SECTION 7  ·  APP 6

Disclosure of Information

Nova Analytics does not share, sell, or disclose your personal information to third parties except in the following circumstances:

• Where required or authorised by law

• Where you have provided prior written consent

• Where it is necessary to deliver an agreed service (e.g. a subcontracted dashboard specialist working under a confidentiality agreement)

​

Where disclosure is made to a subcontractor or service provider, Nova Analytics will take reasonable contractual steps to ensure that party handles your information in accordance with the APPs.

​

7.1  Use of AI Tools

Nova Analytics may use AI tools to help design dashboard data models. Your data itself is never shared with these tools. Only column headers are used, and each header row is checked first to ensure it contains no personal details. Your data is never used to train AI models.

​

SECTION 8  ·  APP 8

Where Your Information Is Stored

Nova Analytics uses the following providers to store and process information. Where practicable, we choose providers that keep data in Australia. 

For clients on an Owned package, client data and the finished dashboard are held in the client's own Microsoft 365 environment under the client's own arrangements with Microsoft, not with the Nova Analytics providers listed below.

• Microsoft 365: Email, OneDrive, SharePoint, Teams. Holds: Client data, correspondence. Stored in: Australia.

• Microsoft Power BI: Hosting published dashboards. Holds: Client dashboards and the data behind them. Stored in: Australia.

• Zoho: Invoicing. Holds: Client contact and billing details. Stored in: Australia.

• Wix: Our website. Holds: Website visitor information and enquiries. Stored in: United States and other countries where Wix operates.

• Anthropic (Claude): AI assistant for internal drafting and build work. Holds: Business documents and headers-only files with no data values. Never client personal information. Stored in: United States.

​

Some providers may process limited information outside Australia for security, support or service delivery. For example, Microsoft’s email security filtering is not tied to a fixed location.

​

Nova Analytics takes reasonable steps to make sure overseas recipients handle personal information in a way that is consistent with the APPs. That includes choosing providers with recognised security certifications, such as ISO 27001 and SOC 2, and contractual data protection commitments.

​

You can read each provider’s privacy policy for more detail on how it handles data.

​

SECTION 9  ·  APP 9

Government Identifiers

Nova Analytics does not collect, use, or disclose government identifiers such as Tax File Numbers (TFNs), Medicare numbers, or other government-issued identifiers as part of its standard services.

If a government identifier is inadvertently included in data provided by a client, it will be treated as unsolicited information in accordance with Section 3.1 of this policy and securely deleted as soon as practicable.

​

SECTION 10  ·  APPS 10 & 13

Data Quality & Correction

Nova Analytics takes reasonable steps to ensure that the personal information it holds is accurate, up-to-date, complete, and relevant to the purposes for which it is used.

​

10.1  Requesting Correction

You may request correction of your personal information at any time by contacting us using the details in Section 16. We will respond to correction requests within 30 days.

Where a correction is made, we will take reasonable steps to notify any third party to whom the information was previously disclosed, if relevant and practicable.

​

10.2  Declined Correction Requests

If Nova Analytics declines a correction request, we will provide you with a written explanation of the reason for the refusal and information on how to lodge a complaint with the OAIC if you are not satisfied with our response.

​

SECTION 11  ·  APP 11

Data Retention

Nova Analytics retains Client Data for 90 days following project completion or cancellation for the purpose of revisions, troubleshooting, or dispute resolution. For clients on an ongoing retainer, Client Data is kept for the duration of the engagement and the 90-day period begins when the engagement ends. Unless otherwise requested in writing, Client Data will be securely deleted or de-identified after this period. This includes uploaded and source files, working copies, every version of the dashboard file, and published dashboards and reports.

For clients on an Owned package, Nova Analytics does not keep Client Data after handover: working copies are deleted within 10 business days of handover (see Section 6.2), although a copy of the report design with all Client Data removed may be kept.

​

You may request deletion of your data at any time by contacting us in writing. We will action deletion requests within 30 days, subject to any legal obligations that require us to retain certain records.

Business records such as signed agreements and invoices are kept for five years to meet tax record-keeping obligations, then securely deleted. This retention period is consistent with the Nova Analytics Terms of Service (Section 5.1).

​

SECTION 12  ·  APP 12

Access to Your Information

You have the right to request access to any personal information Nova Analytics holds about you. To make an access request, please contact us using the details in Section 16.

We will respond to access requests within 30 days. Access will be provided free of charge, except where the request requires a disproportionate effort to fulfil, in which case we will advise you of any applicable costs before proceeding.

​

12.1  Declined Access Requests

If Nova Analytics declines an access request, we will provide you with a written explanation of the reason and information on how to lodge a complaint with the OAIC.

​

12.2  Withdrawing Consent

You may withdraw consent for Nova Analytics to collect or use your personal information at any time by notifying us in writing. Please note that withdrawing consent may affect our ability to deliver agreed services. If a project is underway, withdrawal of consent will be treated as a request to terminate the Service Agreement and managed accordingly.