Privacy Policy

Buildkite Pty Ltd ABN 70 601 137 508 (Buildkite, we, us or our) has prepared this Privacy Policy to set out the standards we have in place to protect the personal information that we hold about individuals.

Buildkite is based in Australia and is subject to the Australian Privacy Principles under the Privacy Act 1988 (Cth) (Privacy Act). This policy applies to Buildkite and its related bodies corporate.

To the extent that Buildkite processes personal data of individuals located in the EU or the UK and the processing is related to:

1. the offering of goods or services to such individuals located in the EU or UK; or
2. the monitoring of the behaviour of such individuals in the EU or UK,

then those processing activities will also be subject to the EU or UK General Data Protection Regulation (GDPR).

Buildkite will also comply with the data privacy laws of any other country which are applicable to it.

By publishing this Privacy Policy, we aim to make it easy for our customers and the public to understand what personal information we collect and store, why we do so, how we receive, obtain, store and/or use that personal information, and the rights an individual has with respect to the personal information we hold about them.

1. we hold Personal Information of our customers, suppliers and business contacts for our own purposes (as a “controller” for the purposes of the GDPR);
2. we may hold any Personal Information contained in code which a customer uploads to Buildkite on behalf of that customer (as a “processor” for the purposes of the GDPR).

1. individual customers - when an individual registers or subscribes to use Buildkite or another service we provide;
2. customer representatives/users – when an organisation registers or subscribes to use Buildkite or another service we provide, we may collect Personal Information about their representatives or users;
3. individual suppliers - when an individual supplies us with goods or services;
4. supplier representatives - when an organisation supplies us with goods or services, we may collect Personal Information about their representatives;
5. contact - when an individual contacts us in any way, they may provide us with Personal Information in the course of that communication, including resumes of Buildkite job applicants;
6. physical access - when an individual accesses our premises, we may require them to provide us with their details;
7. electronic access - when a user accesses our website, we may collect Personal Information using cookies (if relevant – an individual can adjust their browser’s setting to accept or reject cookies) or analytical services;
8. from our services providers or other third parties who have provided your details to us in connection with using Buildkite’s services; and/or
9. pixel tags - pixel tags enable us to send email messages in a format customers can read and they tell us whether mail has been opened.

1. identifying information - we may collect personal details such as an individual’s name, location, date of birth, nationality, family details, job title, and other information that allows us to identify who the individual is. This may be collected directly from you or from third party databases containing information to enrich, cleanse or augment information;
2. contact information - we may collect information such as an individual’s email address, telephone number, usernames, residential, business and postal addresses and other information that allows us to contact the individual;
3. financial information - we may collect financial information related to an individual such as bank or credit card details used to transact with us and other information that allows us to transact with the individual and/or provide them with our services;
4. preference and activity information - we may collect information about an individual’s online and offline preferences both directly and from third parties (such as our vendors, resellers and partners, Reddit and LinkedIn), habits, movements, trends, decisions, associations, community and forum activity, memberships, finances, purchases and other information for statistical and prospecting purposes; and
5. information an individual sends us - we may collect any correspondence that an individual sends us (including call or video conference recordings), or that is sent to us by others about the individual, including in relation to customer support.

The purposes for which we will use your Personal Information and the third parties to whom we disclose your Personal Information will depend on the situation in which that Personal Information is collected. We will inform you of the purposes for which we intend to use your Personal Information and the types of third parties to which we may disclose your Personal Information at or before the time we collect your Personal Information.

As a general principle, we will only use and disclose Personal Information as necessary for:

1. the primary purpose for which it was collected;
2. purposes which are related to the primary purpose for which it was collected and within the reasonable expectations of the individual;
3. any other purposes to which the individual has consented; and
4. any other purposes which are permitted or required by law.

The purposes for which we use Personal Information include to:

1. provide Buildkite or other services to a customer;
2. contact customer representatives or users about our services or a related issue;
3. contacting representatives of a prospective customer about becoming a Buildkite customer;
4. obtain services from a supplier;
5. contact supplier representatives about their services or a related issue;
6. verify an individual’s identity;
7. send direct marketing communications to customers and prospects (subject to paragraph 5.5 below);
8. carry out surveys and questionnaires;
9. respond to questions, comments or complaints made by an individual;8. The individual shall have the right to object at any time to the processing of their Personal Information for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing. If we receive such a request, we will stop the processing of Personal Information for direct marketing purposes immediately without charge or penalty.
10. investigate any complaints about or made by an individual;
11. investigate a suspected breach of any of our terms and conditions or unlawful use of our services; and
12. monitor and improve Buildkite, our website and our other services, including the Buildklite Solution.

We may disclose Personal Information for the above purposes to third parties including to:

1. service providers and contractors that help us operate our business (including providers of IT and data storage services, data processing services, marketing and mailout services, and professional and administrative services);
2. our related companies;
3. law enforcement, where we reasonably believe that an individual may be engaged in fraudulent, deceptive or unlawful activity; and
4. a purchaser, prospective purchaser or joint venture partner, in the course of a sale of part or all of our business.

You may object to the use or disclosure of your Personal Information for direct marketing purposes at any time by contacting our Data Privacy Officer using the contact details below. If we receive such a request, we will stop processing your Personal Information for direct marketing purposes as soon as possible.

When our processing of Personal Information is subject to the GDPR, we will only process Personal Information when we can identify a lawful basis to do so. It is always our responsibility to ensure that we can demonstrate which lawful basis applies to the particular processing purpose. The most common lawful bases relied upon are:

1. consent - we will only rely upon express, clear and informed consent. Any consent provided may specify and/or restrict the purpose, and can be withdrawn at any time without penalty;
2. legitimate interests - we will only rely upon an identifiable legitimate interest where we can demonstrate that the processing of Personal Information is necessary to achieve it by balancing it against the individual’s interests, rights and freedoms.

We will keep a record of our lawful bases for processing Personal Information.

Buildkite is a software developer which operates a software development and delivery platform and provides related services to its customers. As such, for the purposes of paragraph 5.6 above, Buildkite has “legitimate interests” in:

1. providing the Buildkite platform and related services to its clients, ensuring those services are of high quality, and complying with all regulations which apply to the provision of those services; and
2. developing and growing its business and its relationships and understanding the needs of its customers and prospective customers.

We will take reasonable steps to ensure any Personal Information we use or disclose is accurate, up-to-date, complete and relevant, having regard to the purposes for which it is used.

We will only retain Personal Information for as long as we have a legitimate purpose to do so. Buildkite needs to retain Personal Information for commercial and legal purposes. How long it will need to retain Personal Information for these purposes will depend on the specific Personal Information. Once Buildkite has no legal or commercial reasons to retain Personal Information, it will be securely deleted or destroyed.

We do not process Personal Information for the purposes of automated decision-making or profiling.

If a Buildkite user uploads code that contains Personal Information, we do not use or disclose that Personal Information for any purpose. We simply store that Personal Information on the Buildkite platform as instructed by the user. The user has sole control over how long that code is retained on the Buildkite platform and to whom the code is disclosed, and Buildkite simply processes the Personal Information in accordance with the user’s instructions.

1. the entity is subject to a law, or binding scheme, that has the effect of protecting the Personal Information in a way that, overall, is at least substantially similar to the way in which the Australian Privacy Principles protect the Personal Information;
2. the entity has agreed in writing with us to treat that Personal Information in accordance with the Australian Privacy Principles; or
3. the disclosure is otherwise permitted under Australian Privacy Principle 8.

1. we will promptly start work to assess the likelihood and severity of the resulting risk to the individuals; and
2. if we determine there is a likely risk of serious harm to any individual, we will notify the relevant authority and affected individuals in accordance with the Privacy Act and/or GDPR, as applicable.

Buildkite users can access and update their Personal Information from within Buildkite at any time.

You have the right to request access to Personal Information Buildkite holds about you. You may request access to your Personal Information by sending a request to:

The Data Protection Officer
Buildkite Pty Ltd
Level 17, 31 Queen St
Melbourne VIC 3000
privacy@buildkite.com

Buildkite will require you to provide proof of identity before providing access. Buildkite will endeavour to respond to your request for access within 30 days. There are certain situations under the Privacy Act in which we may decline to provide access. In some cases, we may charge an administrative fee which reflects our costs of providing access.

If you consider that the Personal Information we hold about you is incorrect, incomplete or out of date, you may request correction by sending a request to the Data Protection Officer at the address specified above. If we agree the Personal Information needs correction, we will take reasonable steps to correct it. If instead we do not agree the Personal Information needs correction, you may ask us to include a statement on the relevant record explaining why you consider it needs correction.

If you are located in the EU or UK and the GDPR applies to our processing of your Personal Information, you also have additional rights under the GDPR to:

1. request that we erase Personal Information we hold about you;
2. request that we restrict the processing of Personal Information we hold about you;
3. request that we provide a copy of the Personal Information we hold about you in a structured, commonly used and machine-readable format; and
4. object to certain types of processing of Personal Information we hold about you.

You may exercise these rights by sending a request to the Data Protection Officer at the address specified above.

It is an individual’s responsibility to provide us with accurate and truthful Personal Information. We cannot be liable for any Personal Information that is provided to us that is incorrect.

We have appointed a Data Protection Officer to oversee the management of this Privacy Policy and compliance with applicable privacy laws. This officer may have other duties within our business and also be assisted by internal and external professionals and advisors.

If you have a comment, question or complaint about our handling of your Personal Information, please address your complaint in writing to:

The Data Protection Officer
Buildkite Pty Ltd
Level 17, 31 Queen St
Melbourne VIC 3000
privacy@buildkite.com

All complaints will be acknowledged within five business days of receipt. The contact details of the person dealing with the complaint will be advised to the individual making the complaint at this time. We will consider and respond to a complaint within 30 days.

If you are not satisfied with our response to your complaint, you may submit your complaint to:

Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001
1300 363 992
enquiries@oaic.gov.au

If you are located in the EU or UK and the GDPR applies to our processing of your Personal Information, you may also complain to your local supervisory authority.