Privacy Policy

1. About This Policy

This Privacy Policy explains how Fieldstate Pty Ltd (ABN 60 695 654 436), trading as hey ema ("we", "us", "our"), collects, holds, uses, and discloses personal information. It applies to our website at heyema.com and the ema event management platform (collectively, the "Service").

We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), where applicable.

By using the Service, you acknowledge that you have read and understood this policy. If you are an event organiser using ema to manage attendee, exhibitor, or speaker data, you act as the data controller for that event data, and we act as your data processor.

2. Information We Collect

Information you provide

• Name, email address, and phone number when you create an account or contact us
• Organisation name, role, and billing details when you subscribe
• Content you upload, create, or share within the Service, including event data, documents, and messages
• Form responses, support requests, and other communications you send us

Information collected automatically

• Device and browser information (type, version, operating system)
• IP address and approximate geographic location
• Usage data including pages visited, features used, and interaction patterns
• Cookies and similar technologies (see Section 9)

Information from third parties

• Authentication data from Microsoft when you sign in via single sign-on (SSO)
• Data from connected integrations (Microsoft 365 including SharePoint, Teams, Calendar, and Outlook; Stripe; Xero; iMIS; Membes) as authorised by you

Event data

When event organisers use ema, they may upload or collect personal information about attendees, exhibitors, and speakers. This typically includes names, email addresses, job titles, dietary requirements, and session preferences. The event organiser determines what data is collected, and we process it on their behalf.

3. How We Use Your Information

We use personal information to:

• Provide, operate, maintain, and improve the Service
• Process subscriptions, payments, and related billing
• Send service notifications, updates, and security alerts
• Respond to your enquiries and support requests
• Power AI features within the platform (see Section 4)
• Analyse usage patterns to improve functionality and user experience
• Detect, prevent, and respond to security incidents and fraudulent activity
• Comply with legal obligations

We will not use your personal information for direct marketing without your consent. You may opt out of marketing communications at any time.

4. AI Features and Data

ema includes an AI agent with over 60 specialised tools that can query and analyse your event data to help you manage events more effectively. Here is how we handle data in the context of AI features:

• No training on your data. We do not use your event data, personal information, or any customer content to train AI models. Your data is used solely to generate responses to your queries within the Service.
• Permission-aware access. The AI agent respects the same role-based permissions as the rest of the platform. It can only access data that the requesting user is authorised to view.
• Processing scope. AI queries are processed in real time to serve your request and are not stored beyond what is necessary for delivering the response and maintaining audit logs.
• Output accuracy. AI-generated outputs are provided as assistance and may not always be complete or accurate. You should review AI outputs before relying on them for decisions.

5. Disclosure of Information

We may disclose personal information to:

• Subprocessors who assist in operating the Service (see Section 6), bound by data processing agreements and confidentiality obligations
• Professional advisers, including lawyers, accountants, and auditors
• Law enforcement or government agencies when required by law or to protect rights, safety, or property
• A successor entity in the event of a merger, acquisition, or sale of assets, provided they agree to honour this policy

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

6. Subprocessors

We use the following categories of subprocessors to deliver the Service. Each is bound by contractual obligations to protect your data:

• Cloud hosting and infrastructure — AWS and Microsoft Azure, for application hosting, storage, and compute
• Payment processing — Stripe, for handling subscription payments and billing
• Accounting integration — Xero, when connected by the customer for invoice and financial data sync
• Member system integrations — iMIS and Membes, when connected by the customer for member and CPD/CE data alignment
• Email delivery — transactional and notification email services
• Analytics — Google Analytics (via Google Tag Manager with consent mode v2) for understanding website usage

A current list of specific subprocessors is available on request by contacting hi@heyema.com.

7. International Data Transfers

Our infrastructure is hosted in Australia and the United States. If you are located in the European Economic Area (EEA) or the United Kingdom, your data may be transferred to and processed in these countries.

For transfers of personal data from the EEA or UK to countries that have not received an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, as applicable. These safeguards ensure your data receives an equivalent level of protection.

Where personal information is transferred overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs and other applicable privacy laws.

8. Data Security

We implement technical and organisational measures to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These include:

• Encryption in transit using TLS and encryption at rest for stored data
• Access controls and role-based permissions across the platform
• Secure credential storage using industry-standard hashing algorithms
• Regular security monitoring, logging, and vulnerability assessments
• An incident response plan for identifying, containing, and resolving security events

No method of electronic storage or transmission is completely secure. While we cannot guarantee absolute security, we are committed to protecting your data using current best practices.

9. Cookies and Tracking

We use cookies for authentication, session management, and analytics. We implement Google Tag Manager with consent mode v2, which adjusts the behaviour of analytics tags based on your consent preferences.

For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

10. Your Rights — Australian Privacy Act

If you are in Australia, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate, out-of-date, or incomplete information
• Request deletion of your personal information, subject to our legal obligations
• Lodge a complaint about our handling of your personal information

To exercise any of these rights, contact us at hi@heyema.com. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Your Rights — GDPR (EEA/UK)

If you are in the European Economic Area or the United Kingdom, you have the following rights under the GDPR:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data where there is no compelling reason for continued processing
• Data portability — receive your personal data in a structured, commonly used, machine-readable format
• Restriction — request that we restrict processing of your data in certain circumstances
• Objection — object to processing based on legitimate interests or for direct marketing purposes
• Automated decision-making — not be subject to a decision based solely on automated processing that produces legal or similarly significant effects

We process personal data under the following legal bases:

• Contract — processing necessary to perform our agreement with you (e.g., providing the Service)
• Legitimate interest — processing necessary for our legitimate business interests (e.g., analytics, security), where those interests are not overridden by your rights
• Consent — where you have given clear consent for specific processing (e.g., marketing communications, optional cookies)

To exercise any of these rights, contact us at hi@heyema.com. You also have the right to lodge a complaint with your local supervisory authority, including the UK Information Commissioner's Office (ICO) or the relevant EU data protection authority.

12. Your Rights — CCPA/CPRA (California)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to delete — request deletion of personal information we have collected, subject to certain exceptions
• Right to opt-out of sale — we do not sell your personal information, so there is no need to opt out, but you retain this right
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights

To exercise any of these rights, contact us at hi@heyema.com. We will verify your identity before processing your request and respond within the timeframes required by law.

13. Data Retention

• Account data is retained for as long as your account remains active.
• After account closure, we delete your personal information within 90 days, except where retention is required to comply with legal obligations, resolve disputes, or enforce our agreements.
• Event data is retained according to the settings configured by the event organiser (the data controller). Organisers can delete event data at any time through the platform.
• Analytics data is retained for a maximum of 26 months.
• Backups containing deleted data are purged within 30 days of the deletion occurring in the production system.

14. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at hi@heyema.com.

15. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant regulatory authorities within 72 hours of becoming aware of the breach, where feasible.

This is consistent with our obligations under the GDPR and the Notifiable Data Breaches (NDB) scheme under the Australian Privacy Act 1988. Notification will include the nature of the breach, the likely consequences, and the measures taken or proposed to address it.

16. Changes to This Policy

We may update this policy from time to time. For material changes, we will provide at least 30 days' notice via the Service or by email before the changes take effect. Continued use of the Service after the effective date of the updated policy constitutes acceptance of the changes.

17. Complaints

If you have a concern about how we handle your personal information, please contact us first at hi@heyema.com. We will investigate and respond within 30 days.

If you are not satisfied with our response, you may escalate your complaint to the relevant authority:

• Australia — Office of the Australian Information Commissioner (OAIC) at oaic.gov.au
• United Kingdom — Information Commissioner's Office (ICO) at ico.org.uk
• European Union — your local data protection supervisory authority

18. Mobile Messaging (SMS)

If you provide your mobile number and opt in, we send transactional and informational SMS messages related to event registration, including registration confirmations, links to edit your registration, event reminders, and event updates. Message frequency varies. Message and data rates may apply.

You can opt out at any time by replying STOP to any message. Reply HELP for help, or contact us at hi@heyema.com.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from all information-sharing categories described in this policy; this information will not be shared with any third parties.

19. Contact Us

Fieldstate Pty Ltd (ABN 60 695 654 436), trading as hey ema
101 Camberwell Road, Hawthorn East VIC 3123, Australia
Email: hi@heyema.com