Privacy Policy

This Privacy Policy explains how Simple Nimble Pty Ltd (“we”, “us”, “our”), trading as Nimble Index, collects, uses, stores, and shares your personal information when you visit nimbleindex.com.au or use the Nimble Index platform.

We are committed to handling your personal information with care and in accordance with the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). We also voluntarily meet the higher standard set by the European Union General Data Protection Regulation (GDPR), because we believe it represents best practice for protecting the people who use our platform.

If you have any questions about this policy, please contact us at:
Email: hello@nimbleindex.com.au
Website: nimbleindex.com.au

Simple Nimble Pty Ltd (ACN 667 855 218) is an Australian company. For the purposes of privacy law, we are the data controller — meaning we determine the purposes and means by which your personal information is processed.

Our platform, Nimble Index, is a team effectiveness diagnostic tool. Organisations purchase access to the platform and invite their team members to complete a survey. We analyse the results and provide the purchasing organisation with a report and coaching tools.

Under GDPR and Australian privacy law, we must have a lawful reason for collecting and using your personal information. The table below sets out our lawful basis for each type of processing.

We do not sell, rent, or trade your personal information. We share it only with the third-party service providers (data processors) listed below, who process data on our behalf to help us deliver the platform. Each provider is bound by a data processing agreement and may not use your data for their own purposes.

As described in Section 5, several of our service providers are based in or process data in the United States. Australia's Privacy Act requires us to take reasonable steps to ensure overseas recipients handle your data appropriately. All of our overseas providers are either:

• Certified under recognised security frameworks (SOC 2, ISO 27001, PCI DSS)
• Subject to Standard Contractual Clauses or equivalent binding data transfer mechanisms where required
• Subject to contractual obligations requiring them to maintain protections equivalent to Australian Privacy Principles

Your primary data — survey responses, scores, and account information — is stored in Australia (Neon, AWS Sydney). Overseas transfers relate to application delivery, email, payments, AI processing, and analytics as described above.

We use cookies and similar technologies on nimbleindex.com.au. Some are essential for the platform to function; others are used for analytics and advertising, and only activated with your consent.

When you first visit our website, a cookie consent banner will ask for your preferences. You can change your preferences at any time using the cookie settings link in the footer. If you decline optional cookies, they will not be set and the associated tracking will not occur.

We retain personal information only for as long as necessary for the purposes described in this policy, or as required by law.

• Individual survey responses: retained for the duration of your organisation's active account, plus 12 months after account closure, then deleted.
• Aggregated report data (dimension scores, archetype, team narrative, recommendations): retained for the duration of your organisation's active account, plus 7 years after account closure.
• Account and contact information (buyer name, email, organisation): retained for the duration of your account, plus 7 years after closure, consistent with Australian taxation and business record requirements.
• Payment and transaction records: 7 years from the date of transaction, as required by Australian taxation law. Card details are held by Stripe, not us.
• Coaching chat conversations: conversation content is processed by Anthropic in real time and deleted from Anthropic's systems within 30 days. A record that a coaching session occurred may be retained for the duration of your account.
• Website analytics data: managed by Google and LinkedIn under their own retention policies. We do not independently store raw analytics data.

Anonymisation instead of deletion: Where we wish to retain insights from your data for the purpose of improving our diagnostic model, we may anonymise data rather than delete it. Genuinely anonymised data — where it is no longer possible to identify an individual — falls outside the scope of privacy law. We will never re-identify anonymised data.

Under Australian privacy law and, where applicable, the GDPR, you have the following rights in relation to your personal information:

• Right of access: you can ask us to confirm whether we hold personal information about you and to provide you with a copy.
• Right to correction: if your information is inaccurate or incomplete, you can ask us to correct it.
• Right to erasure: you can ask us to delete your personal information. We will comply unless we are required to retain it by law or have another legitimate reason.
• Right to data portability: you can ask us to provide your personal information in a structured, commonly used, machine-readable format.
• Right to object: you can object to processing based on our legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to restrict processing: in certain circumstances, you can ask us to restrict how we use your data.
• Right to withdraw consent: where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at hello@nimbleindex.com.au. We will respond within 30 days.

If you are an employee who completed a survey and wish to access or delete your individual responses, please contact us directly. We will coordinate with your organisation as appropriate.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

If you are completing a Nimble Index survey as an employee or team member, this section is specifically for you.

We take data security seriously. The measures we have in place include:

• Your data is stored in Australia on Neon's database infrastructure, hosted on AWS Asia Pacific (Sydney)
• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted using AES-256
• Access to the database and platform is controlled through role-based access and multi-factor authentication
• API keys and credentials are stored as environment variables, never hardcoded in our codebase
• Our application is hosted on Vercel, which is SOC 2 Type II and ISO 27001 certified
• Payment card data is handled entirely by Stripe (PCI DSS Level 1), meaning we never see or store card numbers

Despite these measures, no system is completely secure. In the event of a data breach, we will notify affected individuals and the OAIC in accordance with the Notifiable Data Breaches scheme, and will cooperate fully with any investigation.

Our platform is intended for use by adults in a professional workplace context. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes to our practices, technology, or legal obligations. When we make material changes, we will:

• Update the 'Last reviewed' date at the top of this document
• Notify active account holders by email
• Where required by law, seek fresh consent

We encourage you to review this policy periodically. Continued use of the platform after any change constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact us:

Email: hello@nimbleindex.com.au
Website: nimbleindex.com.au
Postal address: Ground Floor, 162 Macquarie St, Hobart TAS 7000

We aim to respond to all privacy enquiries within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner:
Website: oaic.gov.au
Phone: 1300 363 992