Privacy Policy

1. Who we are

J&L International PTY Ltd (ABN 37 672 976 395, ACN 672 976 395), trading as SIRAM, is the data controller for personal data collected through the SIRAM platform and siramapp.com. Our registered office is at 1/7-9 Churchill Street, Heidelberg Heights VIC 3081, Australia.

SIRAM is a software-as-a-service platform providing safety governance infrastructure to regulated industries, including aviation, construction, mining, maritime, and manufacturing. We operate primarily in Australia and Vietnam and serve organisations subject to ICAO, CASA, and equivalent civil aviation and workplace safety regulatory frameworks.

For the purposes of the Australian Privacy Act 1988 (Cth) and the General Data Protection Regulation (EU) 2016/679 (GDPR), J&L International PTY Ltd is the data controller. For any personal data processed on behalf of our business customers (operators), SIRAM acts as a data processor, and the customer organisation acts as the data controller.

2. What personal data we collect

2.1 Account and identity data

• Full name, job title, and organisational role
• Work email address and phone number
• Authentication credentials (passwords stored as bcrypt hashes; we never store plaintext)
• Multi-factor authentication (MFA) settings and device identifiers
• SSO identity tokens (if your organisation uses Azure AD, Okta, or Google Workspace)

2.2 Safety governance records (operator data)

As part of the SIRAM platform, we process safety-related records on behalf of your organisation. These may include:

• Incident and occurrence reports (including personnel involved, witness statements, flight details)
• Audit records, findings, CAPA plans, and audit trail entries
• Investigation records, root cause analysis, and evidence files
• Risk register entries, KRI data, and corrective action records
• Document library records and version histories
• Names and qualifications of safety personnel (auditors, investigators, risk owners)

2.3 Usage and technical data

• IP address, browser type, device type, and operating system
• Session logs, page views, feature usage events, and error reports
• API access tokens and API call logs (for customers using the SIRAM API)
• Bandwidth and storage consumption metrics (used for utility billing)

2.4 Billing and commercial data

• Organisation name, ABN, and billing address
• Payment method metadata (card type, last 4 digits — full card numbers are not stored; processed by Stripe)
• Invoice history and subscription details

3. How we use your data

We do not use your personal data for advertising, do not sell data to third parties, and do not use safety governance records for any purpose other than delivering the SIRAM service to your organisation.

4. Legal bases for processing

4.1 Australian Privacy Act 1988 (Cth)

SIRAM complies with the 13 Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). We collect personal information only by lawful and fair means, for purposes directly related to our functions, and only to the extent necessary for those purposes. You have the right to access and correct your personal information under APP 12 and APP 13.

4.2 GDPR (for users in the European Economic Area)

Where GDPR applies, our legal bases for processing are:

• Article 6(1)(b) — Contract: Processing necessary to deliver the SIRAM platform services under our agreement with your organisation.
• Article 6(1)(c) — Legal obligation: Where we are required to process data to comply with applicable law, including civil aviation safety regulations (ICAO, CASA).
• Article 6(1)(f) — Legitimate interests: Security monitoring, fraud prevention, and platform analytics (where these interests are not overridden by your rights).
• Article 9(2)(b) — Employment/social security: For safety records containing health data of workers involved in incidents, where your organisation has legal obligations under occupational health and safety law.

4.3 Vietnam Personal Data Protection Decree (PDPD 13/2023/ND-CP)

For users in Vietnam, we comply with the Personal Data Protection Decree effective from 1 July 2023. We collect personal data for lawful, explicit purposes, obtain consent where required, and implement appropriate technical and organisational measures to protect personal data. You may exercise your rights under the PDPD by contacting us using the details in Section 13.

5. Who we share data with

We do not sell, rent, or trade personal data. We share data only in the following circumstances:

All third-party sub-processors are bound by data processing agreements requiring them to implement equivalent privacy and security standards.

6. Data residency, storage, and international transfers

SIRAM stores all customer data in AWS ap-southeast-1 (Singapore). Singapore is recognised as having adequate data protection standards. We do not transfer data to jurisdictions with inadequate protections without appropriate safeguards.

Where international transfers occur (for example, to Stripe in the United States), we rely on:

• Standard contractual clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Binding corporate rules or equivalent frameworks

Customers with specific data residency requirements should contact us at privacy@siramapp.com to discuss options.

7. Retention and deletion

7.1 General retention

7.2 Safety records — regulatory retention obligations

Upon termination of your SIRAM subscription, all non-regulatory data will be deleted within 90 days. You may request an export of your data in machine-readable format before termination.

8. Your rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at privacy@siramapp.com. We will respond within 30 days. In complex cases, we may extend this by a further 60 days and will notify you accordingly. We do not charge for exercising your rights except in cases of manifestly unfounded or excessive requests.

9. Cookies and tracking technologies

SIRAM uses cookies and similar technologies to operate the platform and improve your experience. We do not use advertising cookies or third-party tracking for commercial purposes.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from accessing the SIRAM platform. We do not use cookies for advertising or cross-site tracking.

10. Safety records and regulatory obligations

SIRAM serves regulated industries where safety record integrity is a legal requirement. The following principles apply to all safety governance records processed through the SIRAM platform:

• Immutability: All safety records (incidents, audits, investigations, risk records) are stored as append-only, immutable entries. This is a regulatory requirement under ICAO Annex 13 and equivalent frameworks. Records cannot be edited or deleted after creation — only amendments can be appended.
• Audit trail: Every access to, and action taken on, a safety record is logged with a timestamp and actor identity. These logs are themselves immutable and retained for the full regulatory retention period.
• Mandatory reporting: Where your organisation is required to report an occurrence to a civil aviation authority (e.g. CASA under CASR Part 83, or equivalent), SIRAM may process and transmit the required notification data to the relevant authority on your behalf, as directed by you or by applicable law.
• Just culture protections: SIRAM is designed to support just culture principles. Reporter identities are protected within the platform in accordance with your organisation's privacy and just culture policy. Access to reporter identity data is restricted by role and governance controls.

11. Children and minors

SIRAM is a business-to-business (B2B) platform intended exclusively for use by adults in a professional capacity. We do not knowingly collect personal data from persons under the age of 18. If you become aware that a minor has accessed the platform, please contact us immediately at privacy@siramapp.com.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. We will notify you of material changes by:

• Email notification to the primary contact of your organisation at least 30 days before the change takes effect
• In-platform notice visible to all administrators in your organisation
• Publication of the revised policy at siramapp.com/privacy with the updated effective date

Continued use of the platform after the effective date of any change constitutes acceptance of the updated policy. Previous versions of this policy are available on request.

13. Contact us and complaints

Privacy Officer

For all privacy-related enquiries, access requests, correction requests, and complaints:

• 📧 privacy@siramapp.com
• 📮 Privacy Officer, J&L International PTY Ltd, 1/7-9 Churchill Street, Heidelberg Heights VIC 3081, Australia

Complaints — Australia

If you are not satisfied with our response to a privacy complaint, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• 🌐 www.oaic.gov.au
• 📞 1300 363 992
• 📮 GPO Box 5218, Sydney NSW 2001

Complaints — EEA / UK

If you are located in the European Economic Area or United Kingdom, you have the right to lodge a complaint with your local data protection authority. A full list of EU supervisory authorities is available at edpb.europa.eu.

Complaints — Vietnam

If you are located in Vietnam, you may lodge a complaint with the Ministry of Information and Communications (MIC) or the Ministry of Public Security (MPS), which are the competent authorities under the Personal Data Protection Decree (PDPD 13/2023/ND-CP).