SDG Align
Australian Privacy Principles compliant
Version 1.1 | Effective September 2026 |
We take privacy seriously, not because we have to, but because it’s the right way to operate. This policy explains clearly what information we collect, why we collect it, who we share it with, and how you can access or correct it.
SDG Align Pty Ltd has opted in to the Privacy Act 1988 (Cth) under section 6EA. This means we are voluntarily bound by the Australian Privacy Principles, referred to throughout this policy as APPs and numbered 1 to 13 (for example, APP 3 refers to Australian Privacy Principle 3), and subject to the jurisdiction of the Office of the Australian Information Commissioner (OAIC).
SDG Align Pty Ltd (ABN 34 645 295 361) operates the SDG Align platform and website at sdgalign.com.au and the Toolkit at toolkit.sdgalign.com.au. We provide sustainability strategy, SDG and circular economy services and software to businesses, councils and organisations across Australia.
Contact: contact@sdgalign.com.au | sdgalign.com.au
Workspace: the shared environment you access when you join a business, council, or program through SDG Align, for example, a council’s business network or a company’s Toolkit account. A Workspace is administered by that business, council, or program (its Workspace administrator), and is separate from SDG Align’s own platform. This is distinct from an “Organisation” as used elsewhere in this policy (see Section 2), which refers to a business’s record in our Global Organisation Directory.
We collect personal information only when it is reasonably necessary for our business functions. The types of information we collect include:
APP 3 — Collection of solicited personal information
We do not collect sensitive information such as health data, racial or ethnic origin, political opinions, religious beliefs, or financial account details beyond what is necessary for billing.
APP 2 — Anonymity and pseudonymity
To use the SDG Align Toolkit you must create a named account. Anonymous or pseudonymous access is not available for the platform, as account identification is necessary to provide the service. You may contact us via our website without identifying yourself where possible.
APP 4 — Unsolicited personal information
If we receive personal information we did not ask for, for example information volunteered in an email, we will assess whether we could have collected it under APP 3. If not, we will destroy or de-identify it as soon as practicable.
We collect personal information directly from you when you:
We also collect information automatically through Google Analytics (website usage and behaviour) and Firestore (platform data storage). See Section 6 for details on these third parties.
APP 5 — Notification of collection
At the point of collection, such as sign-up or contact forms, we will make clear what information is being collected, why, and how it will be used. This policy serves as the overarching notice.
APP 6 — Use and disclosure
We collect and use personal information to:
We will not use your personal information for any other purpose without your consent, unless required by law or to prevent a serious threat to life or safety.
We also use organisation reference data to operate the Global Organisation Directory, a shared resource used across all our customers so that sustainability assessments can be benchmarked consistently rather than built from scratch for every customer. Where relevant, elements of this reference data are shared with our data partners (see Section 6) to generate additional insights, such as waste and circular economy estimates. Named individuals are not entered into the Directory.
APP 7 — Direct marketing
We only send marketing emails, about our services, events or sustainability insights, if you have given separate, express opt-in consent, such as a marketing checkbox. Using the Toolkit or agreeing to these terms does not by itself constitute that consent.
Marketing communications are managed via HubSpot. Every marketing email includes an unsubscribe link, and we do not sell or share your contact details for third-party marketing.
Transactional emails (account confirmations, invoices, notifications) are sent via Mandrill and are not marketing communications.
To opt out of marketing at any time: contact@sdgalign.com.au or use the unsubscribe link in any email.
APP 8 — Cross-border disclosure of personal information
Our platform infrastructure is hosted on Google Cloud Platform in the Sydney region (australia-southeast1). Your data is stored in Australia.
However, some of the third-party services we use may process data in other countries. These include:
Before disclosing personal information to any overseas recipient, we take reasonable steps to ensure they handle it in a manner consistent with the Australian Privacy Principles. By using our services, you consent to this disclosure where necessary to deliver the service.
APP 9 — Adoption, use or disclosure of government related identifiers
We do not adopt, use or disclose government-related identifiers (such as Tax File Numbers or Medicare numbers) as our own identifier for individuals.
We share personal information only with the third parties necessary to operate our services:
We do not sell personal information. We do not share it with advertisers. We do not use it for purposes beyond those described in this policy.
Your Workspace administrator
If you access the Toolkit as part of a Workspace, for example, a council program or business network you’ve joined, that Workspace’s administrator can see the information you’ve provided within their Workspace. They may also contact you directly about that program, using the contact details you provided when you joined.
Messages directly related to the program you’re participating in, such as reminders or updates, are part of that relationship. Promotional messages beyond the program you joined require your Workspace administrator’s separate consent, which is their responsibility to obtain and manage, not SDG Align’s.
SDG Align acts as the platform provider for these communications. We do not control what your Workspace administrator sends you, and this is separate from SDG Align’s own communications described elsewhere in this policy.
APP 10 — Quality of personal information
We take reasonable steps to ensure personal information we hold is accurate, up to date, complete and relevant. You can update most of your personal information yourself at any time by logging in at toolkit.sdgalign.com.au. For anything you can’t update directly, contact us.
APP 11 — Security of personal information
We take the security of your data seriously. Our measures include:
If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the OAIC as required under the Notifiable Data Breaches scheme.
APP 12 — Access to personal information
You have the right to request access to the personal information we hold about you. To make a request, contact us at contact@sdgalign.com.au. We will respond within 30 days. In some limited circumstances we may decline access; if so, we will tell you why in writing.
APP 13 — Correction of personal information
You can correct most personal information yourself by logging in at toolkit.sdgalign.com.au. If you believe personal information we hold about you is inaccurate, out of date, incomplete or misleading and can’t correct it yourself, you can ask us to correct it. We will take reasonable steps to correct it within 30 days. If we disagree that a correction is warranted, we will tell you why and note your request alongside the information.
Our website uses cookies and Google Analytics to understand how visitors use our site. This data is aggregated and does not personally identify you. You can disable cookies in your browser settings; some features of the site may not function as intended if you do.
We do not use tracking pixels for advertising purposes.
Our services are intended for business users and are not directed at children under 18. We do not knowingly collect personal information from children.
If you have a concern about how we’ve handled your personal information, please contact us first:
Email: contact@sdgalign.com.au
Subject line: Privacy Complaint
We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
OAIC website: oaic.gov.au
Phone: 1300 363 992
We may update this policy from time to time to reflect changes in our services or legal obligations. The version number and effective date are shown at the top of this document. Material changes will be communicated to existing users via email. The current version is always published at sdgalign.com.au/privacy-policy
sdgalign.com.au | contact@sdgalign.com.au
SDG Align Pty Ltd ABN 34 645 295 361 | Version 1.1 | © 2026 SDG Align. All rights reserved.
