Privacy Policy

Last updated: 12 October 2026

1. We respect your privacy

1.1 ART Software Pty Ltd (ACN 701 376 285) (ART Software, we, us or our) respects your right to privacy and is committed to safeguarding the privacy of our customers, their personnel and visitors to our website. This Privacy Policy sets out how we collect, use, disclose and otherwise handle your personal information.

1.2 We adhere to the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) (Privacy Act) and, to the extent applicable, the EU General Data Protection Regulation (GDPR) and the GDPR as it forms part of the law of the United Kingdom (UK GDPR).

1.3 “Personal information” is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether directly or indirectly. It includes “personal data” as defined in the GDPR and UK GDPR. Information about a business or organisation (such as a company name or a Sitecore organisation identifier) is not personal information unless it identifies an individual.

1.4 You may contact us in writing at Suite 9, 1-7 Albion Place, Sydney, NSW 2000 for further information about this Privacy Policy.

2. Who this Privacy Policy applies to

2.1 This Privacy Policy applies to personal information we collect about:

(a) visitors to our website at jsonldschemamanager.com (Website);

(b) representatives of our customers and prospective customers, including individuals who install the ART Software app (App), accept our SaaS Terms of Use on behalf of an organisation, act as billing contacts, or contact our support team;

(d) our suppliers, contractors and other business contacts.

2.2 Content within our customers’ Sitecore environments: the App operates within our customers’ Sitecore environments, and our customers’ content and the publishing of that content remain within those environments. Where the App accesses content in a customer’s Sitecore environment that contains personal information, we handle that information on behalf of our customer, as their processor or service provider, under our SaaS Terms of Use. The customer is responsible for that information as the controller. If you have a question about personal information contained in a website that uses the App, please contact the organisation that operates that website.

3. What personal information we collect

3.1 We are committed to collecting only the information we need. The personal information we collect depends on how you interact with us, and may include the following.

3.2 Licensing information: to manage licensing and verify that a customer is entitled to use the App, we store a one-way hash of the customer’s Sitecore organisation identifier and/or Sitecore project identifier. These identifiers are generated by Sitecore and relate to an organisation or project rather than an individual. We store them only in hashed (non-reversible) form, and do not use them to identify individuals.

3.3 Customer, contract and acceptance records: when an organisation subscribes to the App, we collect and keep records of who our customer is and the contract we have with them. These records may include the organisation’s name, the name, job title, email address and telephone number of its representatives, the Subscription Plan and Subscription Period, and a record of acceptance of our SaaS Terms of Use (including the version accepted, the date and time of acceptance, and the name of the individual who accepted them).

3.4 Billing and payment information: payments are processed by our payment processor, Stripe. We do not collect or store full payment card details. Through our Stripe account we can access, and we retain records of, billing information such as the billing contact’s name, email address and billing address, the organisation’s tax registration details (such as an ABN, VAT or GST number), the card type, last four digits and expiry date, invoices, and transaction and payment history.

3.5 Support and correspondence: if you contact us (including by email or through our help desk), we collect your name, contact details, the content of your communications, and any information you choose to provide, such as screenshots or descriptions of issues.

3.6 Marketing preferences: if you choose to subscribe to our newsletter, product updates, release notes or other marketing communications (for example, during onboarding or on our Website), we collect your name, email address and communication preferences.

3.7 Website and technical information: when you visit our Website, we may collect information such as your IP address, browser type, device information, operating system, pages viewed, the website you visited before ours, and the date and time of your visit, including through cookies and similar technologies (see clause 15).

3.8 Supplier and business contact information: if you are a supplier or business contact, we collect your name, contact details, role and information relevant to our business dealings with you.

3.9 We do not intend to collect sensitive information (such as health information or information about racial or ethnic origin, political opinions or religious beliefs). Please do not provide it to us. If you do provide sensitive information to us despite this request, you consent to us collecting and handling that information in accordance with this Privacy Policy, and we accept no additional responsibility for it beyond what is set out in this Privacy Policy.

4. How we collect your personal information

4.1 We collect personal information directly from you, including when you visit our Website, install or subscribe to the App, accept our SaaS Terms of Use, make a payment, contact us, or subscribe to our communications.

4.2 We may also collect personal information from third parties, including from Stripe (in relation to billing and payments), from Sitecore and the Sitecore Marketplace (for example, the Sitecore identifiers associated with an installation of the App), from your organisation (for example, where you are named as a contact), and from our newsletter platform. If we do, we will handle it in accordance with this Privacy Policy.

4.3 If you do not provide the personal information we request, we may not be able to provide the App or our services to your organisation, respond to your enquiry, or allow you to access all parts of our Website.

5. How we use your personal information and our lawful bases

5.1 We use personal information only for the purposes for which it was collected, for related purposes you would reasonably expect, or as otherwise permitted or required by law. Where the GDPR or UK GDPR applies, we rely on the lawful bases set out below.

Purpose	Lawful basis (GDPR / UK GDPR)
Providing the App and our services, including licensing, verifying entitlement, onboarding and support	Performance of a contract; legitimate interests (where you act on behalf of our customer)
Recording acceptance of our SaaS Terms of Use, and managing our contract and relationship with customers	Performance of a contract; legitimate interests
Billing, invoicing, collecting payments and calculating taxes	Performance of a contract; legal obligation
Keeping business, financial and tax records, and complying with our legal and regulatory obligations	Legal obligation
Establishing, exercising or defending legal claims, and resolving disputes and complaints	Legitimate interests; legal obligation
Sending service communications, such as billing, security and important notices about the App or our terms	Performance of a contract; legitimate interests
Sending newsletters, product updates, release notes and marketing communications	Consent
Operating, securing, analysing and improving our Website, the App and our services	Legitimate interests; consent (for non-essential cookies)

6. Marketing communications

6.1 We will only send you newsletters, product updates, release notes or other marketing communications if you have opted in to receive them. Subscribing is optional and is not a condition of using the App.

6.2 Our marketing lists are managed separately from the information we need to provide the App, using a third-party newsletter platform (Mailchimp).

6.3 You may unsubscribe at any time using the unsubscribe link in any marketing email, through the App, or by contacting us. We will still send you service communications that are necessary to provide the App or manage your organisation’s subscription.

6.4 We comply with the Spam Act 2003 (Cth) and, where applicable, other laws regulating electronic marketing.

7. Disclosure of your personal information

7.1 We may disclose personal information to the following parties, to the extent reasonably necessary for the purposes set out in this Privacy Policy:

(a) Stripe, which processes payments, issues invoices and calculates applicable taxes on our behalf;

(b) our hosting, technology and software service providers, including PING Works Pty Ltd, Microsoft Azure, Microsoft 365 and Xero;

(d) Sitecore, to the extent necessary for the App to operate within the Sitecore platform and Marketplace;

(e) our professional advisers (such as lawyers, accountants and auditors) and insurers;

(f) our employees, officers, contractors and agents; and

(g) courts, tribunals, regulators, law enforcement agencies and other government authorities where required or authorised by law.

7.2 We require our service providers to protect personal information and to use it only for the purpose of providing their services to us.

7.3 If there is a change of control of our business, or a sale or transfer of our business assets, we may transfer personal information to the extent permitted by law, provided the recipient agrees to handle it consistently with this Privacy Policy.

7.4 We do not sell or rent personal information.

8. How long we keep your personal information

8.1 We keep personal information only for as long as it is needed for the purposes for which it was collected, or as required by law.

8.2 In particular, we retain customer, contract and acceptance records, invoices, billing and payment records, and correspondence with customers (including support requests) for at least seven years after the end of the customer relationship or the end of the relevant financial year (whichever is later). We keep them to meet our legal, tax and accounting obligations and to establish, exercise or defend legal claims. We may retain records for longer where reasonably necessary for any ongoing or anticipated legal proceedings.

8.3 We maintain these records independently of Stripe, in our own accounting records, so that they remain available to us if required.

8.4 Marketing information is kept until you unsubscribe (after which we keep only a record of your unsubscribe request, so we can honour it). Website analytics information is kept for not more than 12 months.

8.5 When personal information is no longer needed, we take reasonable steps to securely destroy or de-identify it.

9.1 We comply with the principles of data protection set out in the GDPR and UK GDPR, including fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

9.2 We are the controller of the personal information described in clause 3 (such as customer, billing, support, marketing and Website information). Where we process personal information contained in a customer’s Sitecore environment on our customer’s behalf, we act as a processor and our customer is the controller (see clause 2.2).

9.3 We process personal information only where we have a lawful basis to do so, as set out in clause 5. Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew it.

9.4 We do not knowingly collect or process any “special categories of personal data” under the GDPR or UK GDPR (including data about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation). Please do not provide such data to us.

9.5 We do not use personal information for automated decision-making, including profiling, that produces legal or similarly significant effects for you.

9.6 Our services are directed at businesses. You must not provide us with personal information if you are under the age of 16 (or the applicable minimum age in your jurisdiction) without the consent of your parent or guardian. We do not knowingly collect the personal information of children.

10.1 If the GDPR or UK GDPR applies to you, you have certain rights in relation to your personal information. Subject to the exceptions in those laws, you have the right to:

(a) be informed about how your personal information is being used;

(b) access your personal information (we will provide a copy free of charge, unless the request is manifestly unfounded or excessive);

(d) have your personal information erased (also known as “the right to be forgotten”), subject to our legal obligations to retain certain records (see clause 8);

(e) restrict the processing of your personal information;

(f) receive your personal information in a portable format and have it transferred to another controller;

(g) object to the processing of your personal information, including for direct marketing; and

(h) not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

10.2 You may exercise these rights at any time by contacting us using the details in clause 16. We may ask you to verify your identity before acting on your request. We will respond within one month, unless an extension is permitted by law.

10.3 You also have the right to lodge a complaint with the data protection supervisory authority in the EU member state where you live or work, or, in the UK, with the Information Commissioner’s Office.

11. Hosting and international data transfers

11.1 ART Software is based in Australia. The personal information we collect may be stored, processed in, or transferred to countries outside Australia, including the United States (where Stripe and MailChimp store data), the EU, and the UK.

11.2 Where we disclose personal information outside Australia, we take reasonable steps to ensure the recipient handles it in a manner consistent with the Australian Privacy Principles.

11.3 Where we transfer personal information from the EU or UK to a country that has not been recognised as providing an adequate level of protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum), or another mechanism permitted by the GDPR or UK GDPR.

12. Security of your personal information

12.1 We are committed to keeping the personal information we hold secure. We have implemented reasonable physical, electronic and managerial measures to protect personal information from misuse, interference, loss and unauthorised access, modification and disclosure. These measures include:

(a) storing Sitecore licence identifiers only in one-way hashed form;

(b) using a reputable third-party payment processor (Stripe), so that we do not store full payment card details;

(c) restricting access to customer and billing records (including our Stripe account) to authorised personnel who need it, and protecting that access with multi-factor authentication; and

(d) encryption of data in transit and at rest, and other measures.

12.2 Where we use service providers to process personal information on our behalf, we only do so where they have provided sufficient guarantees that they have appropriate technical and organisational measures in place.

12.3 While we take reasonable steps to protect personal information, no transmission of information over the internet or method of storage is completely secure, and we cannot guarantee the security of information you transmit to us.

12.4 If a data breach occurs that is likely to result in serious harm to individuals, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act. Where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority, and affected individuals where required, within the timeframes required by those laws.

13. Access to and correction of your personal information

13.1 You may request access to the personal information we hold about you, or ask us to correct it if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading, by contacting us at help@jsonldschemamanager.com.

13.2 We will respond to your request within a reasonable period (and, for requests under the Privacy Act, generally within 30 days). We may refuse access or correction in certain circumstances permitted by the Privacy Act or other applicable law, in which case we will give you our reasons in writing.

14. Complaints about privacy

14.1 If you have a complaint about how we have handled your personal information, please contact us at help@jsonldschemamanager.com with details of your complaint. We take complaints seriously and will generally respond within 30 days of receiving your complaint. If we need more time, we will let you know.

14.2 If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or, if you are in the EU or UK, the relevant supervisory authority referred to in clause 10.3.

15. Our Website

15.1 When you visit our Website: when you visit our Website, we may collect the information described in clause 3.7. We use this information, generally in aggregated form, to analyse how people use our Website so that we can improve it and our services.

15.2 Cookies: cookies are small files that a website stores on your device to recognise you when you return and to record details about your use of the site. We use:

(a) strictly necessary cookies, which are required for our Website to function;

(b) analytics cookies (for example, Google Analytics), which help us understand how visitors use our Website.

Where required by law (including for visitors in the EU and UK), we will ask for your consent before placing non-essential cookies, and you may change your preferences at any time through our cookie banner. You can also block or delete cookies through your browser settings, although this may affect how our Website works.

15.3 Third-party sites: our Website may contain links to websites that we do not own or control, such as the Sitecore Marketplace and Stripe. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies.

16. Changes to this Privacy Policy and contacting us

16.1 We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting a prominent notice on our Website or, where appropriate, by email. The updated Privacy Policy will take effect on the date it is published, unless we state otherwise. Please review this Privacy Policy periodically.

16.2 If you have any questions about this Privacy Policy, or wish to exercise any of your rights, please contact:

Privacy Officer

ART Software

Email: help@jsonldschemamanager.com