Privacy Policy

1. About this policy

Commerce One Systems Pty Ltd (ABN 90 146 072 308) operates under the master brand Commerce One (“Commerce One”, “we”, “us” or “our”).

This Privacy Policy explains how we collect, hold, use and disclose personal information when you:

• visit or interact with the Commerce One website, including conversations with Marc, Commerce One’s AI Commercial Director, and other interactive features
• submit a mandate or an enquiry
• communicate with us by email, phone, video call, meeting or other channel
• have a mandate assessed by Commerce One or appoint Commerce One under a Sell Mandate or Buy Mandate
• represent a business that Commerce One researches, contacts or introduces in the course of a mandate
• interact with us as a prospective principal, principal, counterparty, supplier, contractor, partner or business contact

In this policy, a “principal” is a business that appoints Commerce One under a mandate, and a “counterparty” is a buyer, supplier, manufacturer or other organisation that Commerce One researches, contacts or introduces for a principal.

We aim to handle personal information openly and responsibly and, where applicable, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This policy applies to our website, mandate submissions, mandate work and general business activities. Additional privacy, confidentiality, security and data-processing obligations may apply under a signed mandate, proposal or other written agreement.

2. Contact details

Commerce One

Operated by: Commerce One Systems Pty Ltd

ABN: 90 146 072 308

Address: Tower 1, Level 8, 1341 Dandenong Road, Chadstone, Victoria 3148, Australia

Email and privacy enquiries: contact@commerce.one

Phone: +61 3 7058 1328

Website: https://commerce.one

3. What information we collect

The information we collect depends on how you interact with us.

3.1 Contact and identity information

We may collect:

• your name
• job title or role
• employer or organisation
• business email address
• telephone number
• business address or location
• billing or account contact details
• communication preferences

3.2 Mandate and business information

If you submit a mandate or an enquiry, or Commerce One assesses a mandate with you, we may collect:

• business name, website and industry
• approximate organisation size, operating locations and current markets
• mandate direction: whether you want to sell, buy or source
• product, service and capability details, such as specifications, certifications and capacity
• purchasing requirements, such as specifications, volumes, standards, delivery geography and timing
• target markets and territories
• transaction-value ranges and expected order or purchase patterns
• buyer and supplier criteria, existing accounts and exclusions
• current customers, suppliers and sales or sourcing arrangements, where relevant
• commercial objectives and the relationship sought
• information reasonably required to assess a mandate, prepare a proposal or define scope

3.3 Communications, meetings and transcripts

We may collect:

• information included in forms, emails and messages
• notes from calls and meetings
• meeting recordings or transcripts where recording occurs lawfully, with appropriate notice or consent
• correspondence history
• proposals, mandate records and service records
• approvals, feedback and commercial decisions

Where a meeting is recorded or transcribed, participants will be informed where required or reasonably appropriate.

3.4 Information provided by principals

During a mandate, a principal may give Commerce One information, such as product, pricing, requirement, account, customer or supplier information, so that Commerce One can research the market, approach counterparties and manage the agreed commercial process.

Depending on the mandate, this information may include personal information relating to the principal’s employees, customers, suppliers, contractors or other individuals.

The categories of information and permitted processing depend on the agreed mandate.

Commerce One seeks to minimise access to personal information and confidential data to what is reasonably required for the approved purpose.

3.5 Technical and website-usage information

When you use our website, we may automatically collect information such as:

• IP address
• browser type
• operating system
• device information
• pages viewed
• referring URLs
• campaign parameters
• approximate location derived from technical data
• form and interface interactions
• error, performance and security logs
• cookie, local-storage, session-storage and analytics information

3.6 Sensitive and restricted information

We do not ask website visitors to provide unnecessary sensitive information through public forms.

Please do not submit through public forms, conversations with Marc or ordinary email:

• passwords
• access credentials
• payment-card or banking details
• API keys or recovery codes
• confidential customer or supplier records
• confidential formulations or restricted technical data
• unnecessary health information
• government identifiers unless specifically required and authorised
• other sensitive personal information
• confidential material you are not authorised to disclose

Where restricted information is required for an approved mandate, it should be provided only through the controlled process specified by Commerce One.

3.7 Counterparty, origination and attribution information

When conducting a mandate, Commerce One may process information about potential and actual buyers, suppliers, manufacturers and other counterparties, including:

• organisation details, such as name, website, industry, locations, capabilities and size
• names, job titles and professional contact details of business representatives
• public professional profiles
• the source of contact and company information
• counterparty research, fit-assessment and exclusion records
• outreach, correspondence and reply history
• qualification information and stated requirements
• opt-out, suppression and do-not-contact status
• introduction, meeting and opportunity records
• protected-account and attribution records
• CRM and Commerce One account identifiers

This information is processed to conduct the mandate, contact relevant organisations in their business capacity, prevent duplicate or inappropriate outreach, maintain protected-account records and resolve attribution questions.

Where Commerce One processes counterparty information for a principal, it does so within the scope and authority agreed in the signed mandate. Mandate-specific data-handling terms may apply where required.

3.8 Transaction and commission information

Where a mandate progresses to a transaction, Commerce One may process the information needed to confirm qualifying transactions and administer its fees, such as:

• contract, purchase-order, order or invoice references
• the products, services or capacity transacted
• transaction values and dates, including qualifying repeat or recurring transactions
• payment, refund and credit status relevant to the commission base
• commission calculations, Commerce One invoices and payment records

The buyer and supplier ordinarily contract and settle the underlying transaction directly. Commerce One does not require, and does not seek to collect, full payment-card details in order to conduct a mandate.

3.9 Marc and AI interaction records

Marc is Commerce One’s AI Commercial Director: an AI persona, not a person, that you can talk to on the website about Buy and Sell Mandates. A conversation starts only when you choose to talk to Marc, and ends when you end it or leave.

To provide the live conversation, Marc’s service provider, Anam, processes on Commerce One’s behalf:

• your voice, if you allow microphone access
• the messages you type
• Marc’s replies and the conversation’s transcript
• related technical information, such as connection and device details

Commerce One and Anam may keep records of a conversation, such as its transcript, to provide, secure and improve the service, for as long as the retention settings configured for the service allow. Commerce One does not add conversation transcripts to its general website analytics.

To limit repeated conversations, the website keeps a one-way, keyed hash of your IP address, never the address itself, and regularly deletes those older than two days.

Please do not share personal, confidential or restricted information with Marc.

4. How we collect information

We may collect personal information:

• directly from you
• through website forms, including Submit a Mandate
• through email, phone, meetings or video calls
• during mandate assessment
• during mandate establishment and delivery
• from a principal, where it is authorised to provide the information
• from counterparties during research, outreach, qualification and negotiation
• from your employer, colleague or authorised representative
• from public business sources and professional profiles
• from data-enrichment and business-information providers
• from website analytics and security systems
• from service providers that support communications, scheduling, transcription, workflow or service delivery
• from referral partners where collection is authorised or otherwise lawful

Where practical, you may interact with our public website without identifying yourself.

Accurate business and identity information may be required for us to respond to an enquiry, assess a mandate, prepare a proposal or establish a mandate.

5. Why we collect, use and disclose information

We may collect, hold, use and disclose personal information to:

• operate, maintain and secure the website
• respond to mandate submissions and enquiries
• assess whether a mandate fits Commerce One’s current scope
• research markets and identify relevant buyers, suppliers, manufacturers and other counterparties
• identify relevant business contacts
• send lawful, authorised commercial communications for a mandate
• manage replies, follow-up, qualification, introductions and opportunity progression
• maintain suppression, do-not-contact and exclusion records
• administer CRM records and pipeline
• maintain protected-account and attribution records, confirm qualifying transactions and calculate success commission
• prepare recommendations, proposals and mandate terms
• report to principals on mandate progress
• administer mandates, fees, invoicing and relationships
• manage suppliers, contractors and professional advisers
• maintain mandate, approval and governance records
• conduct sanctions, legal and other screening where a mandate requires it
• improve our systems, methods and service delivery
• analyse website and campaign performance
• send service-related communications
• send marketing or thought-leadership communications where permitted
• protect systems and detect misuse
• comply with legal, regulatory, tax, accounting and record-keeping obligations
• establish, exercise or defend legal rights
• support a lawful financing, restructuring or business transaction

We will not use personal information for a materially unrelated purpose unless we have an appropriate basis to do so.

6. Technology and AI-assisted processing

Technology supports the work. It does not replace commercial judgement.

Commerce One may combine its own systems, structured workflows, operational information and commercially available AI or machine-enabled tools to support:

• market and counterparty research
• classification and fit scoring
• extraction and enrichment of business information
• summarisation
• drafting of outreach and correspondence
• transcription and summarisation of meetings
• qualification and opportunity management
• quality assurance
• monitoring
• reporting
• prioritisation
• continuous improvement

Where personal information is involved, we consider the intended purpose, data required, provider controls, access, risk and the level of human oversight appropriate to the task.

Material commercial decisions, such as which organisations to approach, what is said on a principal’s behalf and how an opportunity progresses, remain subject to the authority and review defined for the mandate.

Commerce One does not use, permit or opt in to the use of principal confidential information, mandate data or personal information to train, fine-tune or improve general-purpose, shared or publicly available AI models.

We do not use one principal’s identifiable confidential information, prompts, outputs or personal information to train systems for another principal or to create a shared training corpus.

Where AI or automation providers process mandate information, Commerce One requires the approved provider and configuration to restrict that processing to delivery of the contracted service, security, authorised support, legal obligations and other strictly necessary service functions.

Where permitted by contract and law, Commerce One may use de-identified or aggregated operational learnings that do not identify the principal or individuals to improve Commerce One’s own internal methods, templates and evaluation approaches. This does not include using identifiable principal information to train general-purpose or shared AI models.

AI-assisted systems may produce incomplete, inaccurate or unexpected outputs. Material recommendations, approvals and commercial decisions remain subject to the governance defined for the relevant mandate.

7. Principal information and mandate delivery

When Commerce One processes information provided by a principal, the principal remains responsible for ensuring it has the authority to provide that information or permit its processing.

Commerce One uses principal information for the purposes authorised under the signed mandate.

Where Commerce One researches, contacts or introduces counterparties for a principal, it does so within the scope and authority agreed in the mandate. Information about a counterparty may be shared with the principal, and information about the principal may be shared with a counterparty, as the mandate authorises.

Depending on the mandate, additional terms may cover:

• confidentiality
• security
• permitted processing
• mandate-specific data-handling terms
• data location
• retention
• subprocessors
• incident notification
• access control
• deletion or return of data
• audit or assurance information

8. Cookies and website technologies

We may use cookies, pixels, local storage, session storage and similar technologies to:

• operate essential website functions
• remember preferences
• understand website traffic and usage
• measure campaigns and content
• detect security or availability issues
• improve website performance

Where required, we will request consent before enabling non-essential analytics or marketing technologies.

You may manage cookies through available website controls or your browser settings.

Disabling browser storage or cookies may affect some website functions.

9. Direct marketing

We may send updates, insights or promotional material where:

• you have consented
• you have requested information
• you have an existing business relationship with us and the communication is permitted
• another lawful basis applies

Commercial electronic messages will identify the sender and provide an unsubscribe method where required.

Where Commerce One contacts an organisation in the course of a mandate, the same requirements apply, and opt-out and do-not-contact requests are recorded in suppression records.

You may opt out using the unsubscribe method provided or by contacting contact@commerce.one.

We may still send communications reasonably necessary for an enquiry, mandate assessment, proposal, signed mandate or active business relationship.

10. Who we may disclose information to

We may disclose personal information to:

• employees, contractors and authorised representatives of Commerce One
• professional advisers
• the principal that has appointed Commerce One, where the information relates to that principal’s mandate
• counterparties, where an introduction or disclosure is authorised under a mandate
• website hosting and cloud infrastructure providers
• CRM, form, project and service-management providers
• data-enrichment and business-information providers
• communications, email, calendar, transcription and video-conferencing providers
• AI and machine-enabled service providers
• analytics and security providers
• workflow, integration and automation providers
• document, storage and knowledge-management providers
• accounting, invoicing and payment providers
• specialists or partners engaged for an approved mandate scope
• regulators, courts, law-enforcement agencies or government bodies where required or authorised by law
• a purchaser, investor, financier or adviser involved in a proposed business transaction, subject to appropriate arrangements

We do not sell personal information to advertisers or data brokers.

11. Overseas processing and disclosure

Some service providers used by Commerce One may store or process information outside Australia.

Depending on the systems and providers configured at the relevant time, this may include processing in the United States and other countries in which selected cloud, CRM, data-enrichment, communications, AI, analytics, security or infrastructure providers and their subprocessors operate.

Commerce One may engage subprocessors located outside Australia to support functions such as hosting, CRM, data enrichment, communications, AI and analytics.

Because mandates can involve counterparties in other countries, information may also be disclosed to principals and counterparties outside Australia where the mandate authorises it.

Where required, Commerce One takes reasonable steps appropriate to the circumstances when selecting and using overseas providers.

Privacy protections and legal rights may differ between countries.

Where a mandate requires a specific data location or restricts overseas processing, those requirements must be identified and agreed before the relevant work begins.

12. Data security

Commerce One takes reasonable administrative, technical and organisational steps designed to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

Depending on the environment, measures may include:

• role-based access
• least-privilege permissions
• separation of mandate records
• secure credential-management processes
• multi-factor authentication
• encryption in transit where supported
• provider due diligence
• logging
• monitoring
• controlled approval pathways
• data minimisation
• confidentiality obligations
• backup and recovery procedures where appropriate
• incident-response processes

No website, transmission method, AI system or storage environment can be guaranteed to be completely secure.

If we become aware of a data breach, we will investigate and respond in accordance with applicable law and contractual requirements.

13. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, security, operational and dispute-resolution requirements.

Retention periods may differ for:

• enquiries and mandate submissions
• meeting records
• call and meeting recordings and transcripts
• conversations with Marc
• assessment materials
• proposals
• mandate and principal records
• counterparty research and outreach records
• protected-account, attribution and commission records
• workflow and approval records
• operational logs
• security logs
• billing records
• legal or compliance records

Suppression and do-not-contact records may be kept for longer so that opt-out requests continue to be respected.

Where information is no longer reasonably required, we take reasonable steps to destroy or de-identify it where appropriate and permitted by law.

Mandate-specific deletion or return requirements may also be defined in the signed mandate.

14. Access and correction

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, incomplete, out of date, irrelevant or misleading.

Contact: contact@commerce.one

We may need to verify your identity.

Access or correction may be refused or limited where permitted or required by law.

15. Privacy complaints

If you believe Commerce One has mishandled your personal information, please contact:

• Privacy Contact
• Commerce One Systems Pty Ltd
• ABN: 90 146 072 308
• Tower 1, Level 8, 1341 Dandenong Road, Chadstone, Victoria 3148, Australia
• contact@commerce.one
• +61 3 7058 1328

Please provide sufficient detail for us to understand and investigate the matter.

We will aim to acknowledge, investigate and respond within a reasonable period.

Where the Australian Privacy Principles apply and you are not satisfied with our response, you may have the right to contact the Office of the Australian Information Commissioner or another applicable regulator.

16. International visitors

If you access our website or interact with Commerce One from outside Australia, including as a counterparty contacted in the course of a mandate, your information may be collected, stored or processed in Australia and other countries where authorised service providers operate.

Depending on your location, you may have additional rights under local privacy law.

To enquire about applicable privacy rights, contact contact@commerce.one.

17. Changes to this policy

We may update this Privacy Policy to reflect changes to:

• our website
• services
• operating model
• technology providers
• AI systems
• information-handling practices
• security arrangements
• legal or regulatory requirements

The updated version will be published with a revised “Last updated” date.

Material changes may also be communicated through another appropriate channel.