Tool Integrity Management System (TiMS) at tims.nattsdigital.com
This policy applies to TiMS (Tool Integrity Management System) at tims.nattsdigital.com. Natts Digital (ABN 81 405 788 167), Queensland, Australia ("we", "us") operates TiMS. Our other products have their own policies.
Our role. TiMS is used by companies ("customers") and their vendors. The customer decides what information is entered into its TiMS account and owns it. We store and process that information to provide TiMS to the customer and keep it secure. For information about the people who use TiMS (names, work email addresses, sign-in activity), we are responsible for handling it as described here.
| Type | Examples | Source |
|---|---|---|
| Account and organisation | Company name, legal name, country, ABN or tax ID, administrator and billing contacts | The customer |
| Users | Name, work email, role, company and site access, saved signature | The user or their administrator |
| Operational records | Equipment registers, inspection and repair orders, results, quotes, packing lists, purchase orders, uploaded reports, certificates and drawings | Customer and vendor users |
| Sign-in and security | Email address typed at sign-in, IP address, country (derived from the IP address), browser, time, pages and files accessed, failed attempts, authenticator setup | Collected automatically |
| Audit records | Who changed what and when, including administrator actions | Collected automatically |
| Billing | Stripe customer ID, invoice references and subscription status. We do not store card numbers; Stripe handles them. | Stripe, the customer |
| Email delivery | Recipient addresses and the content of notification emails we send | Generated by TiMS |
We do not knowingly collect information about children. TiMS is a business application for adults.
How we use it. To provide and run TiMS for the customer; manage accounts, roles and site access; send notifications (such as inspection order updates and reminders); keep TiMS secure, including detecting unusual sign-in and download activity; bill customers; give support; and meet our legal obligations. We do not sell or rent personal information and we do not use it for advertising.
Who sees it inside TiMS. Information is visible to users of the same customer according to their role. A vendor or machine shop user sees only the requests and records that a customer has granted them access to. A vendor who works for several customers cannot see one customer's records through another. Our platform administrators can access accounts only to run, support and secure TiMS.
Who we share it with. Only the providers below, to the extent needed to deliver TiMS, and when the law requires it.
| Provider | What it does | Information involved | Location |
|---|---|---|---|
| Render | Hosts the application and the database, including the network and content delivery that carries web traffic | All TiMS records and user details | Singapore |
| Microsoft Azure | Stores uploaded files | Reports, certificates, drawings, logos | Australia East |
| Resend | Sends notification emails | Recipient addresses and email content | United States (emails sent from North Virginia; account data and logs stored in the US) |
| Stripe | Processes subscription payments | Billing contact details and payment data | As stated in Stripe's policy |
| Anthropic | Optional AI features, only if the customer turns them on | Only what an enabled AI feature submits, for example an equipment description | Stored in the United States; requests may be processed in other countries, including in Europe, Asia and Australia |
AI features. TiMS has optional AI-assisted features. They are off unless a customer's administrator turns them on. When off, no information from that customer is sent to the AI provider. We use providers whose commercial terms do not allow them to train their models on information submitted through TiMS.
Legal requests. We may disclose information if the law requires it. Where the law allows, we tell the customer first.
Where information is stored. The TiMS database is hosted by Render in Singapore. Uploaded files are stored in Microsoft Azure Blob Storage in Australia East, in a separate private container for each customer. Some providers in section 2 handle limited information outside Australia, for example email delivery and optional AI. When we send personal information overseas we take reasonable steps to make sure the provider handles it appropriately, and we remain responsible for it.
No system is completely secure, and we cannot guarantee that information will never be accessed without authorisation. If we confirm a breach that affects your information, we follow our incident response plan and notify as set out in section 4.
| Information | Kept for |
|---|---|
| Customer records and files | While the customer's agreement is in place, then deleted under that agreement (after any export period). |
| Security events (sign-ins, downloads, refused requests) | 90 days, then deleted automatically. |
| Closed security alerts | 365 days. |
| Audit log | At least 5 years, then removed when no longer needed. |
| Database backups | Up to 7 days. |
| Deleted files | Recoverable for 14 days after deletion. Earlier versions of replaced or deleted files are kept for up to 90 days, then permanently removed. |
| Billing records | As the law requires, typically 5 years. |
We may keep information longer where the law requires it, or to resolve a dispute. If an incident is being investigated, relevant logs are kept until it closes.
Your rights. You can ask us for access to personal information we hold about you, ask us to correct it, or ask us to delete it, subject to legal retention requirements. Information that a customer entered belongs to the customer, so for requests about it we may need to involve the customer. We aim to respond within 30 days.
Cookies. TiMS uses only essential cookies: a session cookie to keep you signed in (it expires after 12 hours without activity) and, only if you tick "Trust this device", a cookie that lets that device skip the sign-in code for 7 days. They are secure and not used for advertising or tracking. We do not use third-party analytics or advertising cookies.
Data breaches. If we confirm a breach that affects your information, we notify the affected customer as its agreement requires, and notify the people and authorities required by Australian law.
Complaints. Contact us first and we will investigate and reply. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Changes. We may update this policy. Material changes are emailed to customer administrators, and the new version with its effective date is posted at tims.nattsdigital.com/privacy.
Governing law. Queensland, Australia. We handle personal information in line with the Australian Privacy Principles.