Data Processing

This page describes how project and reporting data entered into Catchment is processed, stored and retained. It should be read together with our Privacy Policy and Terms & Conditions. If you have questions, or need this information for procurement due diligence or a security questionnaire, contact us at legal@catchment.software.

What data the platform processes

Catchment processes the data your organisation and its supply chain enter to meet reporting obligations, including:

• Project, package and target configuration;
• Workforce hours and workforce attribute data submitted against packages;
• Spend, local content, emissions, waste and other reporting figures;
• Evidence documents attached to submissions, such as invoices and certifications;
• Account details for the users who submit, review and certify that data.

Where data is stored

Customer data is hosted with AWS in Australia. It is not stored or replicated outside Australia unless your organisation asks us to do so in writing.

How data is protected

Data is encrypted in transit using SSL technology and stored on secure, password- and firewall-protected servers. Access within the platform is role-based: every user sees only the projects and packages that belong to them. Access to production systems is restricted to authorised personnel and logged.

Who can see the data

Data entered into your organisation's instance of Catchment is processed only to deliver the platform. We will never disclose personal data that has been directly inputted into your organisation's login instance - including any personal beneficiary or survey data - to a third party. Where external providers help us run the platform, they receive only the data they need to perform their obligations to us.

Retention

Reporting data and its supporting evidence are retained for the life of your subscription so submission history remains traceable for audit. On termination, your organisation can request an export of its data, after which it is deleted from production systems in line with our standard deletion schedule.

Data breaches

If we discover or suspect a data breach we will notify you as soon as we are able to provide sufficient information as to the nature and extent of the breach, including the dates and times of the event, a description of the data involved, the facts of the event or the decision to investigate a suspected event, and the steps we are taking to remedy or mitigate the vulnerability.

Contact

For data processing agreements, security questionnaires or contract queries, email legal@catchment.software.