1 Introduction

Next Generation Software Pty Ltd (“NGS”, “we”, “our”, “us”) is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information in connection with our websites and software products.

We operate in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where applicable, we also comply with the EU General Data Protection Regulation (GDPR) for users located in the European Economic Area.

2 Scope

This policy applies to all websites and products operated by Next Generation Software Pty Ltd, including:

It also applies to our corporate website at nextgenerationsoftware.com.au and any other digital touchpoints operated by NGS. Each product may publish supplementary privacy notices where additional processing activities apply.

3 Information We Collect

Information you provide directly

• Name, email address, phone number, and job title when creating an account or contacting us
• Billing details, including payment card information (processed by our payment providers; we do not store card numbers)
• Organisation name, ABN, and business address for invoicing and account management
• Content, data, and files you create or upload within our products (e.g. work orders in FMSPro, forms in Checkster)
• Communications with our support team

Information collected automatically

• IP address, browser type, operating system, and device identifiers
• Pages visited, features used, and time spent within our products
• Referring URLs and search terms that led you to our site
• Session and authentication tokens
• Error logs and performance data used to diagnose and improve our services

Information from third parties

• Financial data from Xero where you have authorised Yeildy to connect to your Xero account
• Business contact details from publicly available sources for B2B outreach, where permitted

4 How We Use Your Information

We use the information we collect to:

• Provision, operate, and maintain our products and services
• Process payments, manage subscriptions, and issue invoices
• Authenticate users and maintain account security
• Respond to support requests and communicate about your account
• Send product updates, release notes, and service announcements
• Send marketing communications where you have opted in (you may opt out at any time)
• Analyse usage patterns to improve existing features and develop new ones
• Monitor for fraud, security incidents, and terms of service violations
• Comply with legal obligations, including tax, accounting, and regulatory requirements

5 Disclosure of Information

We may share your personal information in the following circumstances:

Service providers

We engage trusted third-party companies to assist in delivering our services, including cloud hosting, payment processing, email delivery, and analytics. These providers are contractually bound to protect your information and may only use it as directed by NGS.

Third-party integrations you authorise

When you connect a third-party service (such as Xero for Yeildy), we share only the data necessary to deliver that integration, and only with your explicit consent.

Legal requirements

We may disclose your information if required to do so by law, court order, or government authority, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of NGS, our users, or the public.

Business transfers

In the event of a merger, acquisition, or sale of all or part of our business, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website before your information becomes subject to a different privacy policy.

6 Data Storage & Security

Your data is stored on secure cloud infrastructure. Where possible, we use data centres located in Australia. Some services may store or process data in other jurisdictions; in such cases we take steps to ensure appropriate protections are in place consistent with the APPs.

We implement the following security measures:

• Encryption of data in transit (TLS 1.2+) and at rest
• Role-based access controls limiting data access to authorised personnel
• Regular security assessments and penetration testing
• Incident response procedures with breach notification protocols
• Multi-factor authentication for administrative access

While we take all reasonable steps to protect your information, no method of transmission over the internet or electronic storage is completely secure. We encourage you to use strong, unique passwords and to notify us immediately if you suspect unauthorised access to your account.

7 Cookies & Tracking

Our websites and products use cookies and similar technologies (such as local storage and session tokens) for the following purposes:

Essential cookies

Required for core functionality including authentication, session management, and security. These cannot be disabled without affecting the operation of our products.

Analytics cookies

Help us understand how users interact with our products so we can improve them. We use privacy-respecting analytics tools and, where possible, anonymise or aggregate data before analysis.

Preference cookies

Remember your settings and preferences (such as display options or language) to provide a consistent experience.

You can manage or disable cookies through your browser settings. Disabling essential cookies will impair or prevent use of our products. For more information about cookies, visit www.oaic.gov.au.

8 Third-Party Services

Our products integrate with third-party platforms. We are not responsible for the privacy practices of these services, and we encourage you to review their policies independently.

Xero (Yeildy)

Yeildy connects to your Xero account to retrieve financial data for cashflow analysis. This connection requires your explicit authorisation via the Xero OAuth flow. We access only the data scopes you approve, and you may revoke access at any time through your Xero account settings. Xero’s privacy policy is available at xero.com/au/legal/privacy.

Payment processing

Payments are processed by our payment provider(s). Payment card data is handled directly by the payment processor under PCI-DSS compliance and is not stored on NGS servers.

9 Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services. When you close your account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it for legal, regulatory, or accounting purposes (typically 7 years under Australian taxation law).

Aggregated or anonymised data that cannot be used to identify you may be retained indefinitely for analytical and product improvement purposes.

10 Your Rights

Under the Privacy Act 1988 (Cth) and, where applicable, the GDPR, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate or incomplete information
• Deletion — request that we delete your personal information, subject to legal retention obligations
• Portability — request a machine-readable copy of your data (GDPR users)
• Objection — object to processing of your data for direct marketing at any time
• Restriction — request that we restrict processing of your information in certain circumstances

To exercise any of these rights, please contact us at privacy@nextgenerationsoftware.com.au. We will respond within 30 days. We may need to verify your identity before processing your request.

11 Complaints

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please contact us first using the details below. We take all complaints seriously and will investigate and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

EEA users who are not satisfied with our response may also contact their local data protection authority.

12 Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Notify active account holders by email at least 14 days before the changes take effect
• Display a prominent notice on our website or within our products

Your continued use of our services after the effective date of any changes constitutes your acceptance of the updated policy.

13 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact us: