Privacy Policy

1. Introduction
This Privacy Policy has been prepared in accordance with the Privacy Act 1988 (Cth), the 13 Australian Privacy Principles (APPs), and the Privacy and Other Legislation Amendment Act 2024. From 10 June 2025, individuals have a statutory right to take direct legal action for serious invasions of privacy. Keystone is committed to meeting these standards regardless of the small business turnover exemption, as a matter of good faith and client trust.

2. What Personal Information We Collect
Stubbs Capital Pty Ltd (ABN: 60 640 710 845) trading as Keystone Facility Services ("Keystone", "we", "us", "our") is committed to protecting the privacy of individuals whose personal information we collect and handle in the course of providing commercial cleaning and facility management services.
This Privacy Policy explains how we collect, use, store, disclose, and protect personal information. It applies to clients, prospective clients, and individuals who interact with our business or the Keystone platform.
This Privacy Policy is publicly available at www.keystonefacilityservices.com.au/privacy-policy. We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

3. What Personal Information We Collect
We collect only the personal information that is reasonably necessary to provide our services. This may include:
Contact Information

Full name.
Email address.
Phone number.

Business & Service Information

Business or trading name.
Service address or site address.
Service requirements, instructions, and notes.

Transaction & Agreement Information

Quotes and pricing details.
Service contracts and agreements.
Acceptance records (including name, date, and electronic signature where applicable).

Communications

Emails and messages exchanged with us
Records of phone calls or meetings where relevant

We do not collect sensitive information (such as health information, government identifiers, or financial account numbers) in the ordinary course of our business. If such information is ever required, we will seek your explicit consent.

4. How We Collect Personal Information
We collect personal information through:

Direct communication with you (phone, email, or in person).
Quote requests and service enquiries submitted via our app or website.
Acceptance of quotes and service agreements.
Ongoing service interactions and communications.

Where practicable, we will collect personal information directly from you. Personal information may also be entered into our internal management system (the Keystone platform) by our team for the purpose of managing and delivering our services.
If we receive personal information about you from a third party (such as a business contact who refers your details), we will take reasonable steps to notify you as soon as practicable.

5. Why We Collect and Use Personal Information

We collect and use personal information for the following primary purposes:
To prepare, provide, and follow up on quotes and proposals
To create and manage service agreements and contracts
To deliver cleaning and facility management services
To communicate with clients about their services
To manage scheduling, operations, and service delivery
To maintain internal records and comply with legal obligations
To process payments and manage billing (where applicable)

We will not use your personal information for purposes unrelated to those above without your prior consent, unless we are required or permitted to do so by law.

6. Use of the Keystone Platform
Keystone uses a secure internal application (the "Keystone platform") to manage:

Client contact information and business details.
Quotes, contracts, and service agreements.
Service scheduling and operational management.
Communication records.

The Keystone platform is used solely for legitimate business operations. It is not publicly accessible. Access to the platform is restricted to authorised Keystone team members on a need-to-know basis.
The platform uses automated processes to assist with tasks such as quote generation, contract creation, and service scheduling. These automated outputs are reviewed and managed by Keystone staff. In line with upcoming transparency obligations under the Privacy and Other Legislation Amendment Act 2024 (effective 10 December 2026), we are committed to ensuring clients are informed when automated processes are used in decisions that materially affect them.

7. Disclosure of Personal Information
We do not sell, rent, or trade personal information.
We may disclose personal information to trusted third-party service providers where reasonably necessary to operate our business, including:

Cloud database and hosting providers (who store data on our behalf).
Email and communication platform providers.
Payment processing services (where applicable).
Software and IT support providers.

These providers are engaged under contractual terms that require them to handle personal information securely and only for the purposes for which it is disclosed. We take reasonable steps to ensure our service providers comply with the APPs.
We may also disclose personal information where required or authorised by law (for example, to comply with a court order, law enforcement request, or a regulatory obligation under Australian law).

8. Overseas Disclosure of Personal Information
Some of our third-party service providers (such as cloud hosting platforms) may store or process personal information on servers located outside of Australia. Where this occurs, we take reasonable steps to ensure that those overseas recipients handle information in a manner consistent with the Australian Privacy Principles.
Countries where our service providers may be located include, but may not be limited to: the United States of America and the Republic of Ireland (in the context of major cloud providers such as Google and Amazon Web Services).
By providing us with your personal information and agreeing to this policy, you consent to this disclosure. Where we cannot ensure an overseas recipient will comply with the APPs, we will seek your explicit consent or take other protective steps required by the Privacy Act.

9. Data Security
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

Use of secure, access-controlled systems with role-based permissions.
Authentication controls for access to the Keystone platform.
Use of reputable third-party infrastructure providers with industry-standard security certifications.
Limiting access to personal information to authorised team members only.

No data transmission or storage system is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. If you have reason to believe that your information has been compromised, please contact us immediately using the details in Section 16.

10. Access and Correction
In the event of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we are committed to:

Assessing the breach as quickly as practicable.
Notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.
Taking immediate steps to contain the breach and prevent further harm.

This reflects our commitment to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). From 10 June 2025, individuals also have a statutory right to take direct legal action for serious invasions of privacy, which we take seriously.

10A. Data Retention

We retain personal information only for as long as it is reasonably necessary for the purposes for which it was collected, or as required by applicable law.

As a general guide:

Client contact information, service records, contracts, and invoices are retained for 7 years from the end of the relevant engagement, in accordance with Australian tax and legal record-keeping requirements.
Quotes and proposals that do not proceed to a service agreement are retained for up to 2 years.
Enquiries and communications that do not result in an engagement are retained for up to 12 months.

When personal information is no longer required, we will take reasonable steps to destroy or permanently de-identify it.

You may request deletion of your personal information by contacting us using the details in Section 17. Where we are required by law to retain certain records, we will advise you accordingly.

11. Access and Correction
You have the right to request access to the personal information we hold about you, and to request corrections if that information is inaccurate, out of date, incomplete, irrelevant, or misleading.
To make a request, please contact us using the details in Section 16. We will respond to access and correction requests within a reasonable time (generally within 30 days). In some circumstances, we may be required by law to decline access, in which case we will provide written reasons.
We will not charge a fee for making an access or correction request, though we may charge a reasonable fee for providing access if the request involves significant retrieval effort.

12. Anonymity and Pseudonymity
Where it is lawful and practicable, you may choose to interact with us anonymously or using a pseudonym (for example, when making a general enquiry). However, for the purposes of providing a quote or entering into a service agreement, we will need to collect your identifying information in order to deliver our services.

13. Relationship to Other Documents
This policy operates in conjunction with the Keystone Master Service Scope V4.1 and Site-Specific Scope of Works. Where a conflict arises between this policy and any other document, the executed Client Service Agreement governs the commercial arrangement. This policy does not override the terms of the Client Service Agreement.

14. Direct Marketing
We may use your contact details to send you information about our services, promotions, or updates where you would reasonably expect to receive such communications and have not opted out.
You have the right to opt out of receiving direct marketing communications at any time. To do so, please contact us using the details in Section 16, or use the unsubscribe link in any electronic communication we send you. We will action your request promptly.

15. Third-Party Links and Secure Communications
Quotes, agreements, or communications we send may contain secure links to view or interact with information on the Keystone platform. These links are intended only for the named recipient and should not be shared with unauthorised third parties.
We are not responsible for the privacy practices of any third-party websites or platforms you may access via links in our communications. We encourage you to review the privacy policies of any third-party services you use.

16. How to Make a Privacy Complaint
If you believe we have mishandled your personal information or breached your privacy rights, we encourage you to contact us in the first instance so we can resolve the matter directly.
Please contact us using the details in Section 16. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. We will keep you informed of the progress of your complaint.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001

17. Contact Us
For any questions, access or correction requests, opt-out requests, or privacy concerns, please contact:
Keystone Facility Services
Privacy enquiries: admin@keystonefacilityservices.com.au
Phone: (02) 7257 0123
ABN: 60 640 710 845
Privacy Policy: www.keystonefacilityservices.com.au/privacy-policy

18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. The current version is always available at www.keystonefacilityservices.com.au/privacy-policy and will display an updated Effective Date.
We encourage you to review this policy periodically. Material changes will be communicated to existing clients where reasonably practicable.