Privacy Policy

This Privacy Policy explains how Currello collects, holds, uses, and discloses personal information. It is intended to be consistent with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Notifiable Data Breaches scheme, and — where NDIS participant information is involved — the National Disability Insurance Scheme Act 2013 (Cth), the NDIS Practice Standards (including Information Management), and the NDIS Code of Conduct.

Currello is a software product of Currello Pty Ltd and of Felix Group (including related bodies corporate under the Corporations Act 2001 (Cth), together the Felix Group). In this policy, “we”, “us”, and “our” means Currello, Currello Pty Ltd, Felix Group, and each company in the Felix Group. This policy covers the marketing website (https://currello.com.au) and the Currello application (https://app.currello.io).

1. Who this policy covers

We provide a cloud case-management and workflow platform used by organisations, including NDIS providers and Support Coordinators. This policy covers:

• organisation administrators, staff, and invited users of the platform;
• people who visit our website, register an organisation, complete the contact form, or email us; and
• personal information that organisations store in the platform about their clients, contacts, participants, and other individuals (including NDIS participants).

If you are an NDIS participant or client of an organisation using Currello, that organisation is generally the APP entity responsible for your information. We process that information as a contracted service provider so the organisation can deliver its services. Questions about how your provider uses your information should first be directed to that organisation.

2. What we collect

Depending on how the website and platform are used, we may collect:

• Account and organisation details — names, email addresses, phone numbers, role, organisation name, ABN or other organisation identifiers, address, time zone, and billing details.
• Operational records — cases, workflows, tasks, notes, forms, files, timesheets, invoices, calendar entries, communications metadata, and audit or history records that organisations enter.
• Sensitive information — health, disability, NDIS plan, support, and related information that organisations choose to record. Sensitive information is only collected where reasonably necessary for the functions of the platform and where a lawful basis exists (including consent obtained by the organisation, or another exception under the Privacy Act).
• Website and contact details — information you submit on this site (for example the contact form), and technical data such as IP address, browser type, and pages requested that are needed to operate and secure the site.
• Technical data — login times, device or browser information, diagnostic logs, and cookies needed to keep you signed in and to operate the service.

We collect information directly from you, from your organisation’s authorised users, and from services your organisation connects (for example Microsoft 365, Google, Xero, or QuickBooks) where those integrations are enabled.

3. NDIS participant information

Where organisations use Currello in connection with NDIS supports, participant records may include highly sensitive information. Organisations remain responsible for:

• collecting information only with consent or another lawful basis, and only to the extent needed to deliver supports or coordination;
• telling participants how their information will be used, stored, and shared;
• complying with the NDIS Practice Standards (Information Management), the NDIS Code of Conduct, record-keeping duties, and any direction of the NDIS Quality and Safeguards Commission; and
• responding to participant access, correction, and complaint requests about records they control.

We do not use NDIS participant information for our own marketing. We do not sell personal information. Our staff and contractors may access organisation data only as needed to operate, secure, support, or improve the platform, or where required by law.

4. Why we collect and how we use information (APPs 3 and 6)

We collect and use personal information to:

• operate this marketing website and respond to enquiries;
• create and administer organisation accounts, users, and subscriptions;
• provide, maintain, secure, and support the platform;
• process billing and communicate about the service;
• detect, prevent, and investigate security incidents, misuse, or fraud;
• meet legal obligations; and
• improve the product in a way that does not involve selling participant data.

We will not use or disclose personal information for another purpose unless you would reasonably expect it, you have consented, or the Privacy Act otherwise permits or requires it (including where use or disclosure is required or authorised by Australian law).

5. Disclosure

We may disclose personal information to:

• authorised users within your organisation, according to roles your organisation assigns;
• hosting, email, identity, payment, and other subprocessors that help us run the website and platform (including cloud infrastructure typically hosted in Australia);
• professional advisers, insurers, and auditors under confidentiality obligations; and
• regulators, courts, or law enforcement where required or authorised by law, including the Office of the Australian Information Commissioner (OAIC) or the NDIS Quality and Safeguards Commission.

If we disclose personal information to Currello Pty Ltd or a related body corporate in the Felix Group, that company must handle it in accordance with this policy and Australian privacy law.

6. Overseas disclosure (APP 8)

We aim to store platform data in Australia. Some support, security, email, or payment providers may process limited information outside Australia. Before an overseas disclosure we take reasonable steps so the recipient does not breach the APPs, unless an APP 8 exception applies (for example, you consent, or the disclosure is required by Australian law).

7. Storage, security, and data loss (APP 11)

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. That includes access controls, encryption in transit, organisational permissions, and operational monitoring. No method of electronic storage or transmission is completely secure.

If we have reasonable grounds to believe an eligible data breach has occurred, we will assess and, where required, notify affected individuals and the OAIC under the Notifiable Data Breaches scheme. Organisations using the platform may also have their own notification duties to participants, the NDIS Commission, or other regulators.

8. Access and correction (APPs 12 and 13)

You may request access to, or correction of, personal information we hold about you by contacting us at contact@felixsoftware.au. We will respond within a reasonable period. There is no charge for making a request; we may charge a reasonable fee for providing access if permitted by the APPs.

If you are a participant or client, please contact the organisation that recorded your information first. We may need that organisation’s authority before we can change or release records they control.

9. Direct marketing (APP 7)

We may send service and account messages that are reasonably necessary to operate your organisation’s subscription. We will only send promotional marketing where permitted, and you can opt out using the contact details below. We do not use NDIS participant records for our marketing.

10. Cookies

This website and the Currello application use cookies and similar technologies that are essential for security, sign-in, and remembering display preferences. We do not use advertising cookies to track you across unrelated third-party sites.

11. Retention and destruction

We keep personal information only as long as needed for the purposes above, including to provide the service, resolve disputes, and meet legal record-keeping requirements. When information is no longer needed, we take reasonable steps to destroy or de-identify it, subject to backup cycles and any legal hold.

Organisations remain responsible for retaining NDIS and other regulated records for the periods required of them, including after they stop using Currello. Export or copy those records before closing an account if you still need them.

12. Complaints

If you have a privacy complaint, contact us at contact@felixsoftware.au. We will investigate and respond. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner. NDIS participants may also raise concerns with the NDIS Quality and Safeguards Commission or with their provider.

13. Changes

We may update this policy from time to time. The current version will be published on this page with a revised “Last updated” date. Continued use of the website or platform after a change constitutes acceptance of the updated policy where permitted by law.

14. Contact

Privacy Officer, Currello / Currello Pty Ltd / Felix Group
Email: contact@felixsoftware.au
Web: https://currello.com.au

See also our Terms of Service.