Privacy policy

My Vendor Hub is an online platform, with apps for iPhone and Android, that event vendor businesses in Australia use to run their operations: equipment and compliance records, stock and deliveries, cleaning, staff, rosters and timesheets, paperwork and events. This policy explains what personal information My Vendor Hub handles, why, who it is shared with, and how you can access, correct or delete it. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Who we are

My Vendor Hub is a trading name of Zachery Joseph La Rosa (“we”, “us”). Vendor Hub, the platform event promoters use to manage the vendors at their events, is also a trading name of Zachery Joseph La Rosa. The two are separate platforms with separate accounts, and information moves between them only as described under The Vendor Hub link. For any privacy question or request, email hello@vendor-hub.com.au.

Whose information this is

Our customers are vendor businesses. Each business has its own workspace, and the records in it, including everything about its employees, belong to that business. The business decides what to record, who in its team can see it, and how long it needs it. We hold and process that information on the business’s behalf, as its service provider, and use it only to provide My Vendor Hub to that business.

If you work for a business that uses My Vendor Hub, your employer is responsible for your employee records. Questions about what your employer records, or requests to see or change it, are best made to your employer first. If you contact us, we will work with your employer to answer you. We are directly responsible for the information we collect for ourselves: customer account and billing contacts, enquiries through our website, and how we run and secure the platform.

What we collect

Accounts

The name, email address and username of everyone who signs in, the business or businesses they belong to, their role and the modules they can use. Passwords are stored only as salted hashes, never in a form we can read. We also record the business’s name, ABN, locations and plan.

Employee profiles

When a business adds an employee, it can record their position, employment type, employee number, phone, date of birth, address, emergency contact, start and end dates, pay rate and award classification, standard hours, qualifications and their expiry dates, availability, and leave. Through the private onboarding link they are sent, the employee can add their legal name, tax file number, tax residency, tax-free threshold and study-loan answers, sign the declaration, and upload documents such as a signed TFN declaration, food-safety or TAFE certificate.

Tax file numbers are encrypted with a key held separately from the database, and only the business’s administrators can reveal one; every reveal is recorded in the business’s history with who did it and when. My Vendor Hub records tax declaration answers to help the business prepare payroll. It does not lodge anything with the ATO.

Rosters, timesheets and travel

Rostered shifts, availability, leave requests, clock-in and clock-out times, breaks, timesheet corrections with their reasons, and travel and accommodation bookings for jobs away from home. Roster changes can be emailed to the people on them.

Clock-in location and devices

A business can require that a person is at the work location when they clock in. Where it does, the app or browser asks for your precise location once, at the moment you clock in, and we store that position, its accuracy and its distance from the location with the time entry, so the business can see the clock-in was made on site. We do not track your location at any other time, in the background, or when you clock out. Where the business does not require it, the app does not ask for your location at all.

A business can also require clock-ins to come from a device an administrator has approved. To do that, the app or browser creates a random identifier for that installation, unconnected to the phone’s hardware or advertising identifiers, and sends it with a label such as “iPhone (My Vendor Hub app)” and with each clock-in. We store which devices each person has registered, their approval status and when each was last used.

Photos and files

Photos taken during cleaning checklists, photographed or uploaded delivery dockets and supplier invoices, and documents uploaded to the business’s paperwork, staff and equipment records. A photo can show people or places, and a document can carry the personal details printed on it.

Compliance documents

Licences, insurance certificates, gas and electrical compliance, test-and-tag records, servicing certificates and similar documents, with their issue and expiry dates, issuing bodies and policy numbers, kept so the business can show it is compliant and be reminded before anything expires.

History

Changes that matter keep a named history: who did what, in which business, and when. That includes account changes, equipment and compliance updates, roster and timesheet changes, device approvals and every reveal of a tax file number. Our own platform support staff can open a business’s workspace only through a restricted, time-limited support session, and each one is recorded.

Emails

We send email for account setup and password resets, employee onboarding links, business invitations, rosters, due-date and paperwork reminders, subscription notices and security alerts. We keep a record of what was sent so a reminder is not sent twice. If you send an enquiry through our contact form, we receive your name, business, email, phone, the details you give about your business and your message, and it is emailed to our team so we can reply.

Technical information

Signing in sets a cookie that keeps you signed in; it is used for nothing else. Our servers keep standard logs, including IP addresses and error messages, to keep the service running and secure. Our website does not use advertising or analytics cookies.

The mobile app

The My Vendor Hub app for iPhone and Android shows the same records as the website and handles personal information the same way.

• Camera and photos, only when you choose. The app uses the camera to photograph cleaning checklists, delivery dockets and documents, and to scan equipment and stock barcodes. It opens your photo library only when you choose to attach a photo you have already taken. Barcodes are read on your phone; a photo is uploaded only when you attach it.
• Location, only at clock-in, only where required. The app asks for location permission, and reads your position, only when you clock in for a business that requires it. It never reads your location in the background.
• Your sign-in stays on your phone, protected. Your session is kept in the iOS Keychain or, on Android, in storage encrypted with the Android Keystore, and is removed when you sign out. The clock-in device identifier is stored in the app’s own storage.
• No ads, analytics or tracking. The app contains no advertising, analytics or crash-reporting services, and does not track you across other apps or websites.

How we use it

To provide My Vendor Hub to the business you work with or for: keeping its records, showing each person what their role allows, running rosters and timesheets, checking clock-ins where the business requires it, sending the emails above, keeping its history, linking with Vendor Hub when it asks us to, answering support requests, and keeping the platform secure. We do not sell personal information, we do not use it for advertising, and we do not use it to train artificial intelligence models.

The Vendor Hub link

A business can link its My Vendor Hub account to its account on Vendor Hub, where the promoters of the events it trades at manage vendors. Although we run both, nothing moves between them unless the business links them. Only the business can start the link, accounts are never matched automatically by email or ABN, and either side can disconnect at any time. While linked:

• Staff for accreditation. For each employee, Vendor Hub receives their name, role, email, phone and whether they are active, so they can be issued event passes. When a rostered person needs a pass, the request is sent too.
• Business paperwork. Business documents such as licences and insurance certificates are kept in step on both sides, so promoters can verify them.
• Readiness. A summary per trading unit is sent: how much equipment is due or overdue, open faults, whether gas and electrical compliance is current and when it was last cleaned. Vendor Hub shows it to the vendor, not to promoters.
• From Vendor Hub. My Vendor Hub receives the business’s events, bookings, applications, invoices, takings totals (without card or customer details), messages, permits, incidents and check-ins, and any Vendor Hub crew the business chooses to add as employees.

Never shared with Vendor Hub: pay rates, timesheets, award data, tax file numbers, dates of birth, addresses, emergency contacts, staff documents, equipment-level certificates and our audit history. When the link is disconnected, sharing stops; what each side already received stays as part of its records.

Service providers

We use these providers to run My Vendor Hub. Each receives only what its service needs, and only for that service:

• RailwayHosting. The application, its database and every uploaded file and photo are stored on Railway's servers.
• ResendSending email. Receives each email we send: the recipient's name and address, and the message, which can include names, shift times, document names and expiry dates.
• UPCitemdb and Open Food FactsProduct barcode lookup, where it is switched on. They receive the barcode number of the product being scanned and nothing else: no account, business or personal information.

Travel and accommodation search on jobs opens links to sites such as Google Flights, Skyscanner, Booking.com and Airbnb, pre-filled with the destination, dates and number of travellers. Nothing is sent to those sites unless you open a link, and what you do there is covered by their own privacy policies. We may also disclose information where the law requires it.

Overseas processing

Some of our service providers store or process information outside Australia. Railway and Resend are based in the United States and may store or process information there or in other countries where they operate; Open Food Facts is based in France and UPCitemdb operates overseas, though they receive only barcode numbers. We take reasonable steps, including through our agreements with these providers, to make sure they handle personal information consistently with the APPs.

Keeping it secure

Every business’s records are kept separate from every other’s. Everyone signs in as themselves, and roles and module access decide what each person can see. Tax file numbers are encrypted, staff documents, photos and paperwork are served only to signed-in people with access to them and never through public links, connections to the service are encrypted in transit, and the platform’s own administrators sign in with multi-factor authentication. No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify the businesses and people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

How long we keep it

We keep a business’s records for as long as its account is open, because they are the business’s record of its equipment, compliance and people. Employers must keep many employee records, such as timesheets and pay records, for seven years under the Fair Work Act 2009, so a business may need to keep them after someone leaves. When someone is removed from a business, their access ends straight away and their records stay with the business. When a business closes its account, it is switched off straight away and its records are kept so it can come back or ask for a copy, until it asks us to delete them. Information we no longer need for any purpose allowed by the APPs is deleted or de-identified.

Access and correction

You can see much of your own information when you sign in, and an employee can enter or update their details through the onboarding form their employer sends. To ask for a copy of the personal information we hold about you, or to correct it, email hello@vendor-hub.com.au. Where the information is held for a business you work for, we will involve that business. We will respond within 30 days, and if we cannot give access or make a correction, we will tell you why.

Deleting an account and its data

To delete your account, email hello@vendor-hub.com.au from the address you sign in with, or ask an administrator of your business to remove you. Removing you ends your access straight away. Your deletion request is then handled as follows:

• Your own account. We delete your sign-in details and the personal information we hold for our own purposes, within 30 days of confirming the request came from you.
• Employee records. Records a business keeps about you, such as timesheets and pay details, belong to that business, which may be legally required to keep them. We pass your request to the business, and delete or de-identify what it does not need to keep.
• A whole business. An owner can ask us to close the business’s account and delete all of its records, including its employees’ records, photos and files. We can provide a copy first. Records already shared with Vendor Hub are part of the business’s Vendor Hub account, and are covered by the Vendor Hub privacy policy; ask us and we will handle both together.

Deleting the mobile app from your phone does not delete your account; sign out first to remove your sign-in from the phone.

Complaints

If you think we have mishandled your personal information, email hello@vendor-hub.com.au and tell us what happened. We will acknowledge your complaint, look into it and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

We will update this policy when what we do with personal information changes, and the date at the top will say when. If a change matters to how a business’s records are handled, we will tell its administrators by email before it takes effect.

Contact