Second Phase Systems

Privacy Policy

PRIVACY POLICYEffective date: 1/8/2026This Privacy Policy explains how Joshua Michael Fenner, trading as Second Phase Systems (ABN 64797243763 ) (“Second Phase Systems”, “we”, “us” or “our”), collects, uses, stores and discloses personal information.We respect the privacy of our clients, prospective clients, website visitors and individuals whose information is processed through the systems we provide.Contact email: [email protected]1. About this policyThis policy applies when you:• Visit a Second Phase Systems website or demonstration website
• Contact us by email, telephone, social media or an online form
• Request a demonstration, proposal or quotation
• Purchase or enquire about our services
• Interact with an automation, chatbot, enquiry form or communication system operated by us
• Provide information to us during client onboarding or service deliveryWe aim to manage personal information transparently and responsibly. References to legal obligations in this policy apply where those obligations legally apply to us.2. Personal information we may collectThe information we collect depends on how you interact with us and may include:• Your name
• Business name and ABN
• Email address and telephone number
• Business address, service location or suburb
• Website and social-media account details
• Information contained in enquiries or quote requests
• Information about the services you require
• Business hours, prices, services and operational information
• Contracts, quotations, invoices and payment status
• Communications, feedback, complaints and support requests
• Information submitted through chatbots, forms and automated systems
• Technical information such as IP address, browser type, device information, timestamps, logs and website analytics
• Records of approvals, instructions and system changes
• Other information reasonably necessary to provide the requested serviceWe seek to collect only the information reasonably necessary for the relevant purpose.3. Sensitive informationSecond Phase Systems does not ordinarily need to collect sensitive information.Please do not submit health information, identity documents, financial account information, passwords, private access credentials or other sensitive information through our websites, demonstrations, chatbots or general enquiry forms unless we have specifically requested it through an appropriate and secure process.If sensitive information becomes necessary for a particular lawful project, its collection and handling must be separately assessed and agreed upon.4. How we collect informationWe generally collect personal information directly from you when you:• Submit a website, enquiry or quotation form
• Communicate with us by email, telephone or social media
• Interact with one of our chatbots or automated systems
• Attend a meeting or demonstration
• Enter into an agreement with us
• Provide information during onboarding, implementation or supportWe may also receive information from:• An authorised representative of your business
• A referral source
• Publicly available business sources
• Website analytics providers
• Payment providers
• Social-media platforms
• Other third-party services used to deliver an agreed service5. Why we use personal informationWe may collect, use, hold or disclose personal information to:• Respond to enquiries
• Arrange demonstrations or consultations
• Prepare quotations, proposals and service agreements
• Configure, test, launch and maintain automation systems
• Provide website assistance, lead systems and multi-channel services
• Customise AI assistants using client-approved business information
• Operate enquiry forms, automated communications and lead workflows
• Communicate with clients and authorised representatives
• Provide support, maintenance and troubleshooting
• Manage accounts, billing, bookkeeping and legal records
• Improve our services, demonstrations and internal processes
• Monitor system performance, security and reliability
• Investigate suspected misuse, security incidents or unlawful activity
• Manage complaints, disputes, insurance matters and legal obligations
• Send marketing communications where permitted by law
• Carry out another purpose disclosed when the information is collected6. Information relating to our clients’ customersWhen we provide automation services to a client, we may process information belonging to that client’s customers, prospective customers or website visitors.The client generally determines:• Why the information is collected
• What information is requested
• How the information will be used
• How long it should be retained
• Which people and systems may access itSecond Phase Systems processes this information only to configure, test, operate, troubleshoot or maintain the agreed service, follow documented client instructions, protect the system or comply with legal obligations.Our clients remain responsible for ensuring that their customer-facing collection notices, privacy policies, consent processes and use of personal information are appropriate for their business and legal obligations.Where practical, production accounts and customer information should remain under the client’s ownership and control.7. AI and automated processingSome services provided by Second Phase Systems use artificial intelligence or automated tools to:• Answer common questions
• Categorise or route enquiries
• Collect and organise information
• Trigger notifications or follow-up messages
• Record approved information in connected systems
• Assist with responding to prospective customersAutomated responses may be based on client-approved information and instructions. However, AI-generated responses may occasionally be incomplete, inaccurate or inappropriate.Our systems are not intended to provide medical, legal, financial, emergency or other regulated professional advice.We do not intend our systems to make decisions that produce significant legal or similarly significant effects on an individual without appropriate human involvement. Clients should review important enquiries and make their own business decisions.8. Disclosure to service providersWe may disclose or make personal information available to service providers when reasonably necessary to operate our business or deliver an agreed service.Depending on the project, these providers may include:• Website-hosting and website-building providers
• AI assistant and chatbot platforms
• Online form providers
• Workflow and automation platforms
• Email and business-productivity providers
• Customer relationship management platforms
• Social-media and messaging platforms
• Payment and accounting providers
• Cloud-storage providers
• IT support, security and professional advisersPlatforms that may be used include Google Workspace, Chatbase, Tally, Make, ManyChat, Meta or Instagram, Carrd and other client-approved services.The exact providers used may differ between clients and projects. Each provider operates under its own privacy policy, security practices and terms of service.We may also disclose information:• With your consent
• At the direction of a client that controls the information
• To professional advisers, insurers or contractors where reasonably necessary
• Where required or authorised by law
• To investigate suspected fraud, misuse or security incidents
• To protect the rights, safety or property of an individual or organisationWe do not sell personal information.9. Overseas processingSome service providers used by Second Phase Systems may store or process information outside Australia, including in the United States, European Union or other locations selected by the provider.The countries involved may change depending on a provider’s infrastructure and policies.Where reasonably possible, we consider the privacy and security information made available by providers before using them. However, we cannot guarantee that all information will be stored exclusively in Australia unless an Australian data-location requirement has been specifically agreed in writing.Clients with regulated-industry or data-location requirements must inform us before implementation begins.10. SecurityWe use reasonable administrative and technical measures appropriate to the size of our business, the services provided and the information handled.These measures may include:• Client-owned production accounts where practical
• Individual user accounts
• Password management
• Multi-factor authentication where available
• Restricted access permissions
• Secure connections
• Software and security updates
• Access removal after work is completed
• Testing before systems are launched
• System monitoring and activity records where available
• Documented client approvals
• Incident-response proceduresNo internet-based service, AI system, cloud platform or electronic storage method is completely secure. We cannot guarantee that unauthorised access, disclosure, misuse, loss or technical failure will never occur.You must not send passwords or private access credentials through ordinary email, public forms, chatbots or demonstration systems unless we have provided an appropriate method.11. Demonstration websites and systemsSome websites, forms, chatbots, Instagram accounts and automated workflows operated by Second Phase Systems are fictional demonstrations.Demonstration systems are intended to show how our services operate and should only be used with sample or non-sensitive information.Please do not submit:• Passwords
• Payment card information
• Identity documents
• Medical information
• Confidential business records
• Information about another person without authority
• Any unnecessary sensitive personal informationInformation entered into a demonstration may still pass through third-party platforms to demonstrate the workflow.12. Retention and deletionWe retain personal information only for as long as reasonably necessary for:• The purpose for which it was collected
• Providing and supporting the agreed service
• Managing our business relationship
• Maintaining records of instructions and approvals
• Accounting, insurance, dispute-resolution and legal requirements
• Security, fraud prevention and system integrityWhen information is no longer reasonably required, we may delete, de-identify or securely dispose of it, subject to applicable legal obligations and the technical capabilities of third-party platforms.Client-controlled information will generally be handled according to the client’s documented instructions and the applicable service agreement.Deletion by a third-party platform may be subject to that provider’s functionality, backup processes, retention periods and terms.13. Access and correctionYou may contact us to request access to personal information we hold about you or ask us to correct information that is inaccurate, incomplete or out of date.We may need to verify your identity before processing a request.In some circumstances, access may be refused or limited where permitted or required by law. If that occurs, we will explain the reason where legally permitted.If the information is controlled by one of our clients, we may direct your request to that client or assist the client as reasonably required.14. Marketing communicationsWe may send business-related marketing communications where we reasonably believe we have your consent or another lawful basis to do so.Marketing emails will identify the sender and provide a functional method for unsubscribing where required.You may unsubscribe at any time by using the unsubscribe option in the communication or contacting us at [email protected]Transactional, administrative or service-related communications may still be sent where necessary.15. Cookies and analyticsOur websites or hosting providers may use cookies, logs, analytics tools or similar technologies to:• Operate the website
• Maintain security
• Understand general website usage
• Diagnose technical problems
• Measure performance
• Improve our services and demonstrationsYou may be able to manage cookies through your browser settings. Disabling certain cookies may affect website functionality.16. Data incidentsIf we become aware of a suspected privacy or security incident affecting information we hold, we will assess the incident and take reasonable steps to contain it, investigate what occurred and reduce potential harm.Where the Notifiable Data Breaches scheme or another notification law applies, we will follow the applicable assessment and notification requirements.Where an incident involves information controlled by a client, we will notify and cooperate with that client as reasonably appropriate. Responsibility for regulatory or individual notifications will depend on the circumstances, applicable law and contractual arrangements.17. Third-party websites and servicesOur websites and communications may contain links to third-party websites, platforms or services.We are not responsible for the privacy practices, content, availability or security of independently operated third-party services. You should review the relevant provider’s privacy policy before providing personal information.18. Privacy enquiries and complaintsIf you have a question, request or complaint concerning privacy or our handling of personal information, please contact:Second Phase Systems
Operated by: Joshua Michael Fenner
ABN: 64797243763
Email: [email protected]Please provide enough information for us to understand and investigate your enquiry.We will aim to acknowledge and respond to privacy complaints within a reasonable period.If you are not satisfied with our response, you may be entitled to contact the Office of the Australian Information Commissioner or another applicable regulator.19. Changes to this policyWe may update this Privacy Policy when our business practices, services, providers or legal obligations change.The current version will be published on our website with its effective date. Material changes should be reviewed before they take effect.20. ContactFor privacy questions, access or correction requests, complaints or concerns about information submitted through a Second Phase Systems service, contact:[email protected]Last updated: 1/8/2026

Ready to move your business into its next phase?