Privacy Policy

1. Overview

Sustainable Procurement Value (“SPV”, “we”, “our”, or “us”) is committed to
protecting your privacy and ensuring transparency in how we collect, use, and
safeguard personal information. This policy outlines our practices in accordance
with relevant Information and Data Privacy legislation including:

  • The Australian Privacy Act 1988 (Cth)
  • The General Data Protection Regulation (GDPR) (EU/UK)
  • The California Consumer Privacy Act (CCPA)

2. Scope

This policy applies to all SPV and all individuals who interact with SPV, including
website visitors, clients, and stakeholders located in Australia, the European
Union, the United Kingdom, California or elsewhere.

It covers business confidential and personal data collected via our website, email
communications, collaboration tools and other forms of contact.

3. Policy details

a) Information We Collect

We collect personal information only when voluntarily submitted, including:

  • Name, email address, and organisation
  • Analytics data (e.g., IP address, browser type, device information)
  • We do not collect sensitive personal data unless explicitly required for service delivery and with your consent

We collect business confidential information when voluntarily shared to complete
projects and business interactions. This includes project-related details shared
before, during and after consulting engagements.

b) Legal Basis for Processing (GDPR)

Under GDPR, we process personal data based on:

  • Consent: When you voluntarily submit information
  • Contractual necessity: To deliver requested services
  • Legitimate interests: To improve our services and maintain security
  • Legal obligation: When required by law

c) How We Use Your Information

We use collected data to:

  • Respond to inquiries and deliver services
  • Share insights, updates, or resources relevant to your interests
  • Improve website performance and user experience
  • Maintain internal records and governance documentation

We do not sell, rent, or share your personal information with third parties unless
legally required.

d) Data Storage & Security

SPV uses secure hosting via GreenGeeks and cloud collaboration through
Microsoft 365. Our security measures include:

  • SSL encryption for all web traffic
  • Firewall and malware scanning
  • Multi-Factor Authentication (MFA) for Microsoft 365 accounts
  • Regular backups and version control

We keep your information for as long as necessary to fulfill the purposes outlined
in this Privacy Policy unless otherwise required by law. We will only keep your
personal information for as long as it is necessary for the purposes set out in this
Privacy Policy, unless a longer retention period is required or permitted by law.
When we have no ongoing legitimate business need to process your personal
information, we will either delete or anonymise it, or, if this is not possible, then
we will securely store your personal information and isolate it from any further
processing until deletion is possible.

e) International Data Transfers

Our website may use cookies to enhance user experience and collect anonymous
analytics data. You can manage cookie preferences through your browser
settings.

  • Hosting with suppliers that comply with international data protection standards
  • Contractual clauses and encryption protocols

f) Cookies & Analytics

Our website may use cookies to enhance user experience and collect anonymous
analytics data. You can manage cookie preferences through your browser
settings.

g) Third-Party Links and Services

Our website may contain links to external resources. SPV is not responsible for the privacy practices of these third-party sites or services. Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

This Privacy Policy applies solely to the information collected by SPV.

h) Automated Decision-Making and Use of Artificial Intelligence

SPV uses artificial intelligence (AI) tools, including coordinated AI agents, to help deliver its services, in particular its Sourcing Optimiser sourcing service. This section explains how we use these tools and how they relate to decisions that may involve your personal information. It reflects the automated decision-making transparency requirements of Australian Privacy Principle 1, which take effect on 10 December 2026.

How we use AI

  • AI tools assist our procurement professionals to draft documents (such as requests for proposal and evaluation materials), organise and summarise supplier responses, manage supplier communications, and prepare draft evaluations and recommendations.
  • These tools operate under the direction, review and quality assurance of SPV personnel.

Human oversight means we do not make decisions solely by automation

  • Every evaluation, recommendation or other output that could affect an individual is reviewed and approved by a named SPV professional before it is used or released. Outputs are only part of any procurement process. There are substantial human review, assessment and interaction processes, over and above any AI outputs, that materially affect decision making.
  • Final supplier selection and award decisions are made by our clients. They are not by SPV, nor by an automated system.
  • We may use AI to support a process. In each case a person makes or confirms the decision. We do not use AI tools to make, by solely automated means, decisions that could significantly affect individual rights or interests.

Personal information used

  • Where a supplier is an individual (for example, a sole trader), or where supplier responses include personal information about supplier personnel or referees (such as names, contact details, professional history and qualifications), that information may be processed by our AI tools when preparing drafts and analyses.

Your information and AI

  • We use AI tools under terms that do not permit your personal information or business-confidential information to be used to train third-party AI models.
  • We keep records of material AI-assisted actions and of the human review applied to them.

4. Your Rights

Under the Australian Privacy Act, you have the right to:

  • Access and correct your personal information
  • Make a complaint about a breach of privacy
  • Obtain information about our use of automated decision-making and AI tools (see the section above)

Under GDPR, you have the right to:

  • Access, rectify, or erase your data
  • Restrict or object to processing
  • Data portability
  • Withdraw consent at any time

Under CCPA, California residents have the right to:

  • Know what personal data is collected and how it’s used
  • Request deletion of personal data
  • Opt out of the sale of personal data (SPV does not sell data)
  • Non-discrimination for exercising privacy rights

For questions or concerns about this Privacy Policy, your rights under applicable
laws, or to exercise these rights, contact us via contact@spvalue.com.au
We do not knowingly collect data from or market to children under 18 years of
age. If you become aware of any data, we have collected from children under age
18, please contact us via contact@spvalue.com.au

5. Exceptions and Compliance

All stakeholders can

  • Raise concerns or breaches through designated channels communication channels confidentially and without fear of retaliation. The designated communication channel is via contact@spvalue.com.au

6. Ownership and revision

This policy is reviewed annually and updated as needed to reflect changes in
technology, regulation, stakeholder feedback or SPV’s operations. The latest
version will always be available on our website.