1. Who we are
Easy Registration is a product of Easy Compliance. We are an Australian business, and we are independent of the NDIS Quality and Safeguards Commission.
We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). The APPs cover how personal information is collected, used, disclosed, stored, corrected and accessed. This policy explains how we apply them.
2. What we collect
Account information
Your name, email address, password (stored only as a secure hash), and your communication preferences.
Provider profile
Information about your organisation: legal and trading name, ABN, business structure, contact details, the supports you deliver, and the roles of key people. We use it to personalise your documents and your roadmap.
Registration check answers
The answers you give in the free registration check, and the roadmap we calculate from them. Before you create an account these are held against an anonymous identifier stored in a cookie on your device.
Evidence and uploads
Documents and records you choose to upload as evidence, and the notes you add about them. For most evidence you can simply record that you hold a document instead of uploading it.
Analytics and attribution events
Events about how the product is used — for example that a landing page was viewed, a check was completed or a document was generated — together with attribution details such as the page you arrived from and any campaign parameters in the link you followed. We use these to understand which parts of the product help and where people get stuck.
Technical information
Your IP address and browser user agent, used for session security, rate limiting and fraud prevention. We use cookies for signing in, for the registration check, and to remember how you first found us.
3. Data minimisation
We ask for the least information we need to do the job. In practice that means:
- we do not ask for information about the people you support;
- evidence can usually be recorded as “held by us” rather than uploaded;
- optional fields are clearly optional; and
- we do not buy personal information from third parties.
4. Sensitive information
Sensitive information includes health information and information about disability. Registration is about your business, not about the people you support, so we recommend that you do not upload participant records, health information or behaviour support plans to us.
- Where evidence involves a participant record, record that you hold the document rather than uploading a copy.
- Where you do upload a file, it is encrypted in transit and at rest, stored privately, and only available to your organisation.
- We never send participant, health or behaviour support information to analytics, and we never use it for marketing.
- Please do not include sensitive details in support messages. If we need to see something, we will tell you a safe way to share it.
5. How we use your information
- To work out your likely registration pathway and build your roadmap.
- To personalise your documents, training, tasks and evidence checklist.
- To provide support when you ask for it, and to run any expert review you have purchased.
- To send you service messages such as reminders, deadlines and account notices.
- To send marketing messages only if you have opted in — you can opt out at any time.
- To improve the product, using aggregated and de-identified information wherever possible.
- To keep the service secure and to meet our legal obligations.
We do not sell your personal information.
6. Storage and security
- Your information is encrypted in transit and at rest.
- Files are held in private storage. Downloads use short-lived signed links rather than public URLs.
- Passwords are stored only as secure hashes. We can never read your password.
- Access inside your organisation is limited to the people you invite, and to the role you give them.
- We keep backups so we can recover from a failure. Backups are encrypted.
No system is perfectly secure. If a data breach occurs that is likely to cause serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
7. Access logging
Access to your organisation’s records is logged, including access by our own staff. Our staff only open an account to provide support you have asked for, to complete an expert review you have purchased, or to investigate a security or technical problem. You can ask us for a summary of that access.
8. Third parties
We use a small number of service providers to run the product. Each receives only what it needs to do its job.
- Payment provider. Processes payments and stores your card details. We never see or store full card numbers.
- Email provider. Sends account, reminder and support emails on our behalf.
- AI provider. Helps draft documents and self-assessment responses. Prompts contain only the information needed for that task — your answers and your own documents — and never participant or health information. AI output is always shown to you for review before it is used.
- Hosting and infrastructure. Runs the application and stores your data securely.
Some providers may store or process data outside Australia. We take reasonable steps to make sure they handle your information consistently with the Australian Privacy Principles.
9. Retention and deletion
- We keep your information while your account is active, and for a period afterwards so you can come back to your work.
- Retention periods are configurable and are set to support NDIS record-keeping expectations. Evidence records are kept longer than analytics events.
- You can ask us to delete your account and its data at any time. We action deletion requests within a reasonable time.
- Encrypted backups may hold copies for a short period after deletion, so deletion from backups can take longer.
- We may retain limited records where the law requires it, such as financial records.
10. Your rights
- Ask for a copy of the personal information we hold about you.
- Ask us to correct anything that is wrong or out of date.
- Ask us to delete your account and your data.
- Opt out of marketing messages at any time, without affecting service messages.
- Make a complaint about how we handled your information.
Email us and we will respond within a reasonable time. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.
11. Changes to this policy
If we change this policy we will update the date at the top of this page. Where a change is significant, we will tell you in the product or by email.
12. How to contact us
Email support@easycompliance.org, or use our contact form. Please do not include sensitive information in your first message.