1. We respect your privacy
1.1. LVXP.AU is owned and operated by Beneath the Surface AU, ABN 16 843 916 557, of PO Box 48, Ballajura, Western Australia 6066. In this Policy, "LVXP.AU", "we", "us", and "our" mean that operator, and "you" and "your" mean a person whose personal information we hold.
1.2. We follow the Australian Privacy Principles contained in the Privacy Act 1988 (Cth). This Policy sets out how we collect and treat personal information.
1.3. "Personal information" is information we hold which is identifiable as being about you.
1.4. "Sensitive information" is defined in the Privacy Act to include information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record, or health information.
1.5. We do not ask you for sensitive information. Nothing in the registration process or the account dashboard asks you to disclose any of the matters listed in clause 1.4. Section 4 explains the position where a member chooses to publish such information on their own page.
2. Who this Policy applies to
2.1. Visitors. A person who reads a page on lvxp.au without holding an account. We hold very little about a visitor, and Section 12 describes all of it.
2.2. Members. A person who holds an account and has a page at an address beginning lvxp.au/@. Most of this Policy concerns members.
2.3. People named on a member's page. A member may publish information about another person. We do not control that, we did not collect it, and the member is responsible for it under Section 5 of the Terms of Service. If information about you appears on a member page and you want it removed, write to [email protected] and Section 9 applies.
3. What we collect from members
3.1. Registration. When you register we collect a display name, an email address, a page address of your choosing, and a password. The password is stored in hashed form and cannot be read by us.
3.2. Your page. We store what you put on your page: your page description, each link and its label, your profile image, and your chosen theme.
3.3. Files you upload. Where you upload a file, we store it and serve it publicly at an address on this site.
3.4. Contact cards. Where you enable a contact card, we store the contact details you enter and serve them as a downloadable file at an address on this site.
3.5. Correspondence. Where you write to us, we keep the message and our reply.
3.6. What we do not collect. We do not ask you to describe, categorise, or evidence any personal experience, and we hold no record of any such thing. We do not collect a date of birth, a residential address, a phone number, a government identifier, or payment details, because LVXP.AU is free and none of those are needed to operate it.
3.7. If you give us information we did not ask for and do not need, we will delete it.
4. Your page is public by design
4.1. A member page is published to the open internet. Everything on it can be read by anyone who has the address, without an account and without logging in.
4.2. Search engines index member pages. A page can therefore be found by searching for your name, and a copy may persist in a search engine cache or a web archive after you have deleted it. We cannot remove a copy held by a third party.
4.3. Anything on a page can be copied, screenshotted, and republished by any person who sees it. This is a property of the open internet, not a failure of this site, and we cannot undo it.
4.4. A member may publish sensitive information about themselves. Clause 1.5 records that we never ask for it. Where a member chooses to publish it on their own page, they have made it public themselves, and the consequences described in clauses 4.2 and 4.3 apply to it in the same way.
4.5. Your email address and your password are not published. Everything else described in Section 3 is published unless you remove it.
4.6. You should put on your page only what you are content for a stranger to hold permanently.
5. What we collect from visitors
5.1. We record aggregate counts of how many times a page has been viewed and how many times a link has been followed. These counts are numbers. They are not tied to an identified person.
5.2. Internet Protocol addresses are held for 15 minutes. To avoid counting the same visitor repeatedly, the software records a visitor's Internet Protocol address for 15 minutes and then discards it. Only the aggregate count remains. We do not use that address for any other purpose, and we do not build a profile of any visitor.
5.3. Our hosting provider maintains server logs in the ordinary course of operating the infrastructure. Those logs are held by that provider under its own retention arrangements and are used for security and diagnosis.
6. How we use personal information
6.1. To operate LVXP.AU: to create and maintain your account, to display your page, and to let you sign in.
6.2. To communicate with you about your account, including verifying your email address, resetting your password, and telling you about a change to these documents.
6.3. To carry out a review under Section 4 of the Terms of Service, and to act on a report made under Section 7 of that document.
6.4. To meet a legal obligation, and to protect the safety of members, visitors, and other people.
6.5. We do not send marketing. We do not add you to a mailing list, we do not sell or rent personal information, and we do not disclose it to advertising networks. There is no advertising on LVXP.AU.
6.6. We will not use your content for any purpose other than displaying your page. Clause 5.3 of the Terms of Service states the licence you grant, and it is limited to that purpose.
7. Disclosure of personal information
7.1. We disclose personal information only where it is necessary to operate the service, where you have consented, or where the law requires it.
7.2. Overseas disclosure. We use third-party providers to host the website and to handle email. Your personal information is therefore stored outside Australia. In accordance with Australian Privacy Principle 1.4, the recipients we are likely to disclose personal information to, and the countries in which they are likely to be located, are:
| Recipient | Purpose | Likely location |
|---|---|---|
| Hostinger International Ltd | Website, database, and file hosting | Singapore (data centre); company established in the Republic of Lithuania |
| Microsoft | Email sent to and from the lvxp.au addresses | United States, and other countries in which Microsoft operates data centres |
7.2.1. We take reasonable steps to ensure that any overseas recipient deals with your personal information in a manner consistent with the Australian Privacy Principles, as required by Australian Privacy Principle 8. Those steps include selecting providers that publish binding data protection commitments, restricting the categories of personal information disclosed to each provider to what that service requires, and reviewing this Policy whenever a provider changes.
7.2.2. Under Australian Privacy Principle 8.1 we remain accountable for personal information disclosed to an overseas recipient. An act or practice of an overseas recipient that would breach the Australian Privacy Principles is taken to be a breach by us.
7.2.3. LVXP.AU cannot be provided without the disclosure described in clause 7.2. If you are not willing for your personal information to be disclosed overseas, you should not register for an account.
7.3. We may disclose personal information to comply with a legal requirement, such as a law, regulation, court order, subpoena, or warrant, or in response to a request from a law enforcement agency.
7.4. We may disclose personal information where we believe it is necessary to prevent a serious threat to the life, health, or safety of any person.
7.5. We do not use third-party analytics or advertising services. No behavioural analytics, heatmapping, session recording, advertising, or remarketing product operates on this site, and no social login provider is enabled. No personal information is disclosed to any such service, because none is used.
7.6. The lvxp.au addresses deliver to the operator. [email protected] and [email protected] are aliases that deliver to Beneath the Surface AU mailboxes held with the provider identified in clause 7.2. Beneath the Surface AU operates LVXP.AU, so this is not a disclosure to a third party. Mail sent to [email protected] is delivered to the address Beneath the Surface AU uses for privacy requests and complaints, and is kept separate from general enquiries.
8. Security, retention, and data breach notification
8.1. We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, and disclosure. Those steps include serving the whole site over an encrypted connection, storing passwords in hashed form, restricting administrative access to the operator, and keeping the software updated.
8.2. The transmission of information over the internet is carried out at your own risk. We cannot guarantee the security of information you transmit to us or receive from us.
8.3. Clause 8.2 describes the practical limits of any security measure. It does not limit our obligations under the Privacy Act 1988 (Cth), or the commitments set out in this section.
8.4. Application of the Notifiable Data Breaches scheme. The Privacy Act 1988 (Cth) does not apply to a small business operator with an annual turnover of $3 million or less, unless an exception applies. The operator of LVXP.AU is below that threshold. We apply the Notifiable Data Breaches scheme in Part IIIC of the Act as a minimum standard to all personal information we hold, whether or not the Act requires it of us. The commitments in this section are given, and will be met, on that basis.
8.5. What a data breach is. A data breach occurs where personal information we hold is subject to unauthorised access or unauthorised disclosure, or is lost. Examples include unauthorised access to the member database, a member account taken over by another person, and an email sent to the wrong recipient.
8.6. Eligible data breach. A data breach is an eligible data breach where it is likely to result in serious harm to one or more individuals, and we have not prevented that harm through remedial action (sections 26WE and 26WF). Serious harm includes serious physical, psychological, emotional, financial, or reputational harm. Whether serious harm is likely is assessed against matters including the kind and sensitivity of the information, the protections in place, and the persons who have obtained or could obtain access (section 26WG).
8.7. Assessment. Where we have reasonable grounds to suspect that an eligible data breach may have occurred, we will carry out a reasonable and expeditious assessment, and will take all reasonable steps to complete that assessment within 30 calendar days of becoming aware of those grounds (section 26WH). Where we have reasonable grounds to believe that an eligible data breach has occurred, we proceed directly to notification.
8.8. Notification. Where notification is required, we will prepare a statement and give it to the Office of the Australian Information Commissioner as soon as practicable, and we will notify the individuals at risk of serious harm (sections 26WK and 26WL). Where it is not practicable to notify each individual, we will publish the statement and take reasonable steps to publicise its contents.
8.9. What a notification contains. A notification will set out our identity and contact details, a description of the data breach, the kinds of information concerned, and our recommendations about the steps you should take in response (section 26WK).
8.10. We keep a record of each suspected or actual data breach, the assessment carried out, and the action taken.
8.11. Retention and destruction. We retain personal information only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. When it is no longer needed, we destroy it or de-identify it, as Australian Privacy Principle 11.2 requires.
8.12. The following periods apply.
| Record | Retention period |
|---|---|
| Member account and page content | For as long as the account is open. Deleted when the account is closed |
| Backups containing member data | Overwritten in the ordinary backup cycle, within 30 days of deletion |
| Visitor Internet Protocol address | 15 minutes, then discarded |
| Aggregate page view and link counts | Retained while the page exists. Not tied to an identified person |
| Correspondence with us | 2 years from the last message |
| Reports about a member page, and the decision made | 7 years |
| Records of data breaches | 7 years |
8.13. Reporting a suspected breach. If you believe personal information we hold about you has been lost, accessed without authorisation, or disclosed without authorisation, contact us at [email protected].
9. Access, correction, and deletion
9.1. You can do most of this yourself. Signing in to your account lets you see everything we hold about you other than correspondence, change any of it, and delete your page and your account.
9.2. You may ask us for details of the personal information we hold about you, in accordance with Australian Privacy Principle 12. Write to [email protected]. There is no fee.
9.3. If you believe information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may ask us to correct it.
9.4. Deleting your account deletes your page. When an account is closed, the page stops being served, the account record is deleted, and backups are overwritten within the period stated in clause 8.12. Clauses 4.2 and 4.3 explain what we cannot reach, being copies held by search engines, archives, and other people.
9.5. Where information about you appears on another member's page, write to [email protected]. We will consider the request under Section 6 of the Terms of Service and may remove the material or the page.
9.6. We may refuse a request in the circumstances set out in the Privacy Act. If we refuse, we will tell you why, unless it is unreasonable to do so.
10. Complaints about privacy
10.1. If you have a complaint about how we have handled your personal information, write to [email protected], or to PO Box 48, Ballajura, Western Australia 6066, Australia. We take complaints seriously and will respond within 30 days.
10.2. If you are not satisfied with the outcome, or if we do not respond within 30 days, you may refer the complaint to the Office of the Australian Information Commissioner.
- Website: www.oaic.gov.au
- Phone: 1300 363 992
11. Changes to this Policy
11.1. We may change this Policy. The version number and effective date at the top of the published page identify the version in force.
11.2. Where a change materially affects how we handle member personal information, we will email members at least 14 days before it takes effect.
12. Website and tracking technologies
12.1. Hosting. The website and its database are hosted by Hostinger International Ltd, a company established in the Republic of Lithuania, on infrastructure located in Singapore. Everything you submit through the website is stored on that infrastructure. Section 7.2 sets out our overseas disclosure obligations.
12.2. Cookies. LVXP.AU sets session cookies that are necessary for the site to function. They are not used for tracking or advertising.
| Cookie | Purpose |
|---|---|
| XSRF-TOKEN | Protects forms against cross-site request forgery |
| lvxpau_session | Maintains your session while you are signed in |
| lvxp.au_session | Maintains your session while you are signed in |
12.2.1. The session cookies are marked so that they cannot be read by scripts, are sent only over an encrypted connection, and are not sent to other sites. They expire when the session ends.
12.3. No behavioural tracking. We do not use analytics, heatmapping, session recording, or advertising products of any kind. We do not track you across other websites, and we do not use your activity for advertising or remarketing. Clause 5.2 describes the only visit measurement performed, and the 15 minute limit on the Internet Protocol address that supports it.
12.4. No social login. Signing in with an account held at another company is not enabled on this site, so no such company is told that you hold an account here.
13. Links and files to other sites
13.1. The purpose of LVXP.AU is to hold links to other places. Following a link takes you to a website we do not own or control.
13.2. A link on a member page is not an endorsement by us of the destination. We do not monitor where a link leads, and it may change after we have seen it.
13.3. Once you leave this site, this Policy no longer applies. The privacy policy of the destination governs what that website collects about you.
13.4. A file uploaded by a member and served from this site is public, and downloading it is subject to clauses 13.1 to 13.3 in the same way.