1. Scope and audience
This statement sets out how HN Ventures L.L.C-FZ ("MessageMind", "we"), the operator of the MessageMind platform, handles personal information of Australian individuals under the Australian Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles (APPs) in Schedule 1 of that Act. It supplements, and does not replace, our Privacy Policy, our Data Processing Agreement, our Retention Schedule, our Sub-processor List and our Security page.
It applies in two scenarios: (a) where we are an "APP entity" because we carry on business in Australia and collect or hold personal information in Australia (section 5B of the Privacy Act, "Australian link"); and (b) where we are not an APP entity but our business customers are, in which case the APPs apply to our customer and we act as their service provider.
Nothing in this statement limits any rights an Australian individual has under the Privacy Act. Where this statement conflicts with the Privacy Act for personal information covered by the Act, the Privacy Act prevails.
2. Operator and Australian contracting entity
| Item | Detail |
|---|---|
| Operator | HN Ventures L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates |
| Registration | License No. 2539786.01 · Formation No. 2539786 |
| Australian subsidiary | None at the date above. Australian customers contract with the operator named here. |
| Privacy contact | [email protected] · subject line "Australian Privacy Act" |
| OAIC role | External complaints body for Australian individuals (see section 11) |
An Australian individual or Australian business can contract with the operator above. We will enter a signed data processing agreement, add Australian-specific terms on request, and provide a reasonable Australian point of contact for privacy matters. If and when we establish an Australian subsidiary, this page is updated and existing customers are notified by email.
3. Roles under the Privacy Act
For personal information we process on behalf of a business customer (for example, guest messages inside the customer's inbox), the customer is the entity that decides the purposes and means of handling the information. We handle that personal information on the customer's documented instructions as a service provider; the customer is the APP entity for that handling.
For personal information we handle for our own purposes (prospective customers reaching us through the website, platform user accounts, support correspondence), we handle it as an APP entity for that information if we have an Australian link, and as the controller equivalent in every other jurisdiction. Our Privacy Policy covers these interactions.
Where this statement refers to "we", it means the handling we do in either role; the role is identified where it affects what we do.
4. Australian Privacy Principles we apply
The table below maps each APP that is operationally relevant to the service to the page or clause that implements it. APPs not listed (for example APP 2 on anonymity and pseudonymity, APP 9 on government identifiers, APP 10 on quality) are covered by the Privacy Policy and the general operational posture; they are not reproduced here because they do not change our platform behaviour.
| APP | How we implement it |
|---|---|
| APP 1 · Open and transparent management | This page, the Privacy Policy and the DPA are published and reachable without an account. They name HN Ventures L.L.C-FZ as the entity accountable for handling. |
| APP 3 · Collection of solicited personal information | We collect only what is necessary to operate the platform the customer configures. Sensitive information is not required by the service (see section 9). |
| APP 5 · Notification of collection | The customer is responsible for giving APP 5 notices to the individuals they communicate with through our platform. Our Privacy Policy handles notification for individuals who reach us directly. |
| APP 6 · Use or disclosure | We use personal information only for the purpose for which the customer provided it, or for a purpose a reasonable person would expect and that is related (or, for sensitive information, directly related) to that purpose. We do not sell personal information and we do not train shared models on customer data. |
| APP 7 · Direct marketing | Marketing from us to Australian individuals contains an opt-out mechanism we honour within 10 business days. We do not use personal information processed on behalf of a customer for our own direct marketing. |
| APP 8 · Cross-border disclosure of personal information | Primary storage is in the EU. See section 5 for the APP 8 steps we take before disclosing Australian personal information to overseas recipients. |
| APP 11 · Security of personal information | Technical and organisational measures are described on the Security page and in section 5 of the DPA, including encryption in transit and at rest, least-privilege access with multi-factor authentication, logging and monitoring, environment segregation and encrypted backups. |
| APP 12 · Access to personal information | Individuals may request access by email to [email protected]. We respond within 30 days. Where the data belongs to a business customer, we forward the request to that customer and support their response. |
| APP 13 · Correction of personal information | Correction requests follow the same route as APP 12 access requests and the same 30-day timeline. |
5. APP 8: cross-border disclosure of personal information
Where personal information of Australian individuals is disclosed to an overseas recipient (including, by operation of APP 8, where we handle it from outside Australia ourselves), we take the following reasonable steps so the recipient does not breach the APPs:
We bind each sub-processor to written terms no less protective than our DPA, including the obligations in Article 32 GDPR and the APP equivalents on security, confidentiality, use limitation and breach notification. The current list is published at /subprocessors; each sub-processor is reviewed on security and lawful basis before onboarding, and we remain liable for their acts and omissions.
Primary storage is in the European Union, under the GDPR and the ePrivacy framework; depending on the channels and features a customer enables, approved sub-processors may process selected data elsewhere, under the EU Standard Contractual Clauses with supplementary measures where required. These contractual safeguards are the "reasonable steps" we take for the purposes of APP 8.1.
Section 5B(3) of the Privacy Act may extend the APPs to our handling of the information outside Australia; where that applies, we handle the information under this statement and the DPA, which incorporate the APP obligations by reference. We do not rely on APP 8.2(a) consent as a general matter: our customers obtain any consent they consider necessary from the individuals they communicate with.
Under section 16C of the Privacy Act, an APP entity remains accountable for an overseas recipient's handling of personal information, except in the narrow cases set out in that section. Our business customers remain accountable for the overseas handling we perform on their behalf; we accept processor liability for that handling under the DPA.
6. Notifiable Data Breaches
The Privacy Act, Part IIIC, requires an APP entity to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals of an "eligible data breach" (an unauthorised access, disclosure or loss of personal information likely to result in serious harm) as soon as practicable.
Where we become aware of a security incident affecting personal information we handle, we notify the affected customer without undue delay and in any case within 48 hours of becoming aware of the incident (DPA section 8). The notification describes the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and the measures taken or proposed.
Where the customer is the APP entity, the 72-hour OAIC notification obligation sits with the customer, and we assist them with the information needed to meet it (DPA section 7). Where we are the APP entity because of our Australian link, we make the OAIC notification directly within 72 hours of forming a reasonable belief that an eligible data breach has occurred, and we notify the affected individuals as soon as practicable.
7. Retention and deletion
Personal information handled on behalf of a customer is retained for the periods set out in the Retention Schedule. Conversation content defaults to 24 months; a customer may request a shorter period in writing, down to 30 days.
On termination, the customer may export personal information for 30 days. After that we delete or anonymise personal information handled on their behalf within 90 days, and instruct sub-processors to do the same, except where applicable law requires longer retention. This satisfies APP 11.2 (destruction or de-identification once the information is no longer needed for an authorised purpose).
8. Rights of Australian individuals
Australian individuals whose personal information we handle have the following rights:
Access (APP 12): request a copy of the personal information we hold about them, or a summary where providing a copy would reveal evaluative material or another individual's personal information. We respond within 30 days. There is no charge for the request; a reasonable charge for a copy may apply for very large requests, notified in advance.
Correction (APP 13): request that we correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading. We respond within 30 days. If we decline the correction we provide the reasons and the complaint route in section 11.
Withdrawal and opt-out: withdraw consent for direct marketing by replying to any of our marketing emails or by writing to [email protected]. We honour the request within 10 business days.
Where the personal information in question is held on behalf of one of our business customers, we forward the request to that customer and support their response, because the customer decides the purposes and means of handling that information.
9. Sensitive information
The platform does not require sensitive information (as defined in section 6 of the Privacy Act, including health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record and biometric information) to operate. We ask customers not to submit sensitive information through the platform.
If a customer or an individual nonetheless submits sensitive information, the customer remains responsible for the lawful basis of its collection and the APP 3 conditions for collection of sensitive information, and we handle it under the same technical and organisational measures that cover other personal information, with the stricter use limitations of APP 6.
10. Children and vulnerable individuals
The platform is sold to businesses and is not directed at children. Where a customer configures the platform to communicate with individuals under 15 (for example a tutoring provider), the customer is responsible for the lawful basis of that communication and for obtaining parental consent where applicable, under APP 3 and the common-law capacity rules the OAIC applies in guidance.
11. Complaints
An Australian individual who believes we have breached the APPs in handling their personal information may complain to us by email to [email protected], subject line "Australian Privacy Act complaint". We acknowledge within 5 business days and respond substantively within 30 days.
If the individual is not satisfied with our response, they may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, by phone on 1300 363 992 or by post to GPO Box 5218, Sydney NSW 2001. The OAIC generally expects the complainant to raise the complaint with us first and to give us 30 days to respond.
12. Updates and contact
We update this statement when the Privacy Act, the APPs or the operational posture of the service change in a way that affects Australian individuals. Material updates are notified to active customers by email; the "last updated" date at the top of this page reflects the current version.
To raise an Australian Privacy Act matter, request a signed addendum or ask for an Australian-specific DPA: [email protected]. HN Ventures L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates.
