Your data is yours. Here is exactly what we do with it.

Who we are

Yarta is an environmental sustainability reporting service operated as a Recycle Group initiative ("Yarta", "we", "us"). This policy covers the yes.com.au website, the Yarta customer portal, and the data customers send us to produce their reports. We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles.

The short version

What we collect

From customers. The organisation's name, sites, sector and profile settings; the names, work email addresses and roles of the people who use the portal or send us records; the operational figures and documents you send each period, such as electricity and gas bills, fuel-card statements, water bills, waste and recycling contractor reports, weighbridge records, planting records, program registers and invoices; and the bookings you make through the roadmap.

From website visitors. What you type into the contact form (name, organisation, email, message). The website does not use advertising trackers. We may use privacy-respecting analytics that do not identify you; if we do, this policy will say which.

What we do not want. Please do not send us personal information about residents, patients, students or employees that is not needed for the report. Where a document you send contains such information (for example a fuel-card statement that names a driver), we use only the figures the report needs and hold the document as evidence under the access limits below.

Why we collect it and what we do with it

• To enter, grade and verify your figures, calculate your scores and emissions, and issue your Yarta Report, dashboard and roadmap.
• To send the monthly fill-in-the-gaps email and to answer your questions.
• To introduce an accredited provider when you book a suggestion from the roadmap: we pass the provider only what that booking needs, and only after you ask us to.
• To keep the evidence behind every figure so that a report can be reproduced and audited later.
• To run and secure the service.

We do not use your data to train models, to build a product for someone else, to market to you beyond your own account, or for any purpose that is not part of producing and supporting your report.

Benchmarks and other customers

Every benchmark on a Yarta Report is a published figure from a public source, named on the report with its edition. We do not pool customer data into averages, and we do not show any customer where another sits. If Yarta ever proposes a de-identified industry index, it will be opt-in, aggregated so that no organisation can be identified, and described in the Yarta Method before it is used.

Who can see your data

• The people at your organisation you have authorised, through their own accounts.
• Yarta staff who enter, verify and support your account, limited to what their role needs. Access is logged.
• Service providers we use to run Yarta, such as hosting, email delivery and document storage, under contracts that limit them to providing that service. We will tell you on request which providers hold your data and where.
• A provider you have asked us to introduce, for that booking only.
• Anyone you choose to give the report to. A Yarta Report is yours to publish.
• A regulator, auditor or court where the law requires it.

Recycle Group businesses that deliver work booked through your roadmap see the details of that booking, and the report discloses that a group business did the work. They do not otherwise see your account.

Where your data is stored

Yarta stores customer data in Australia wherever the service allows it, and tells you before you sign if any provider we rely on stores data elsewhere. Customer data is never stored on a Yarta staff member's personal device beyond the working copy needed to enter a month, and that copy is removed when the month is verified.

How long we keep it

Reports and the evidence behind them are kept for as long as you are a customer and for seven years after, so that a figure in a published report can be reproduced and audited. You can ask us to delete evidence documents earlier; we will tell you which reports that would leave without their evidence before we do it. Contact-form messages are kept for two years.

Security

Portal access is by individual account. Staff access is limited by role and logged. Documents are held in encrypted storage. Where we discover a data breach that is likely to cause serious harm, we notify the affected customers and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires, and we tell you what happened and what we are doing about it.

Your rights

You can ask to see the personal information we hold about you, correct it, export your organisation's data (the portal provides CSV and PDF exports at any time), or delete your account. Ask by email and we will respond within 30 days. If you think we have mishandled your information, tell us first; if you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Cookies

The website sets no advertising or tracking cookies. The customer portal uses a session cookie or local storage to keep you signed in and to remember settings such as the month you were viewing.

Changes

When this policy changes, the version and date at the top change with it, and customers are told by email before a change that affects how their data is used takes effect.

Contact

Privacy questions and requests: contact@yes.com.au. Please put "Privacy" in the subject line.

This policy is issued at version 0.1 ahead of the first customer agreement and is under legal review. Where the customer agreement and this policy differ, the customer agreement applies.