Back to the site

Legal

Privacy policy

How Grid Pass handles personal information — yours, and your customers'.

Last updated

The short version

This is a plain summary. The full policy below is what actually applies, and it is worth reading if any of this matters to you.

  • We lodge grid connection applications for solar retailers and installers. That means we handle two kinds of personal information: yours, and your customers'.
  • We use your customers' details for one thing — preparing, lodging and tracking their connection application. Doing that means giving those details to their electricity network. That is the service.
  • We don't sell personal information, and we don't use it for advertising.
  • If you sign in with Google, we use your Google account only to sign you in — see section 2.5.
  • This website doesn't track you. No analytics, no advertising cookies, no third-party scripts.
  • Before you send us a customer's details, make sure they know and that you are allowed to share them. That part is yours — see section 5.
  • You can ask what we hold about you, ask us to fix it, and complain if we get it wrong — sections 12 and 14.

Who we are, and what this covers

Grid Pass is an engineering service that prepares, lodges and tracks electricity grid connection applications on behalf of solar retailers and installers. We are Grid Pass Pty Ltd, ABN 72 700 045 807.

This policy covers personal information we handle through this website at gridpass.com.au and through the Grid Pass platform at app.gridpass.com.au. We handle personal information in accordance with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth).

Throughout this policy, "personal information" means information about an individual who is identified, or who can reasonably be identified from that information. In our line of work that is worth spelling out: a site address on its own is not personal information, but a site address next to a person's name is. So is a National Meter Identifier once it is tied to a household.

"You" means the retailer, installer or other business we work for, and the people at that business who use Grid Pass. "Your customers" means the owners and occupiers of the sites you are connecting.

The information we collect

2.1 Information about you

When you deal with us as a customer or a prospective customer, we collect:

  • your name, work email address, phone number, job title and the business you work for;
  • your business's name, ABN, address, and where relevant its electrical contractor licence and accreditation numbers;
  • your Grid Pass account details, including the record of what you did in the platform and when;
  • billing and payment details, and the record of what you have been invoiced and have paid;
  • what you have said to us — emails, support requests, notes from calls and meetings.

2.2 Information about your customers

This is the bulk of what we handle, and it is information about people who are not our customers. To lodge a connection application we collect, from you or on your behalf:

  • the site owner's or occupier's name, and their phone number and email address where the network asks for them;
  • the site address, and its National Meter Identifier (NMI);
  • the retailer and account details for the site, where the network needs them;
  • details of the electrical installation — existing and proposed inverter, panel and battery equipment, export limits, phase configuration, and switchboard and metering arrangements;
  • supporting documents you upload, such as site photographs, single-line diagrams, meter and switchboard photos, and signed customer authorisations;
  • the correspondence about the application, including what the network sends back.

Some of those documents contain more than we need. If you send us something with unnecessary personal information in it, we will not use that information, and we will delete it where we practicably can.

2.3 Information we collect automatically

When you visit this website, our hosting provider records the usual technical details of the request — the IP address, the page requested, the time, the browser and referring page. We use those logs to keep the site up and secure, not to build a picture of you. We do not run analytics on this site.Section 11 has the detail.

The Grid Pass platform keeps its own activity logs, so that an application's history can be traced — who submitted what, when, and what changed.

2.4 Sensitive information

We do not ask for sensitive information — health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, biometric or genetic data — and we have no use for it. Please do not send it to us. If you do, we will delete it.

2.5 Information from Google, if you sign in with Google

You can sign in to the Grid Pass platform with your Google account. If you do, Google shares your name, email address, profile picture and Google account ID with us, and tells us whether your email address is verified. We ask Google for nothing else — no access to your Gmail, contacts, calendar, files or anything else in your Google account.

We use that information only to sign you in. We check the verified email address against a Grid Pass account that already exists, then link your Google account ID to it so your next sign-in reaches the same account. Signing in with Google never creates an account on its own.

We store your email address and your Google account ID with your Grid Pass account. We do not keep your name or profile picture from Google. We do not sell Google user data, use it for advertising, or use it to train AI models, and we share it only with the service providers that run our sign-in system and platform for us, in Australia.

We remove the link to your Google account when your Grid Pass account is closed, or sooner if you email support@gridpass.com.au and ask — you can keep signing in with your email address instead. You can also stop Google sharing your information with us at any time from your Google Account, under Third-party apps and services.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy.

How we collect it

We collect personal information:

  • directly from you, when you contact us, set up an account, or enter and upload job details into the platform;
  • from Google, if you choose to sign in with your Google account — see section 2.5;
  • from the electricity networks, when they respond to an application — approvals, conditions, requests for more information, rejections;
  • from public and industry sources, where we need to confirm a detail an application depends on, such as looking up a site's NMI or checking an accreditation number;
  • from your colleagues, when someone at your business creates an account for you or submits a job on your behalf.

Where we collect information about someone from a source other than that person, we do so because it is unreasonable or impracticable to collect it from them directly — a network's response about a connection, for instance, comes to us and not to the site owner.

Why we collect it, and what we do with it

We use personal information to:

  • prepare, lodge and track grid connection applications, which is the service you are paying for;
  • review applications technically, so that they are right the first time and meet the network's current requirements;
  • correspond with networks about an application, and pass their response back to you;
  • run your account — logging you in, showing you your jobs, invoicing you, and providing support;
  • keep records we are required or reasonably need to keep, including for compliance and for resolving disputes about what was lodged;
  • improve the service, using aggregated information about how applications move through the system rather than information about individuals;
  • meet our legal obligations.

We do not use personal information for automated decision-making that has a legal or similarly significant effect on anyone. Applications are reviewed by engineers.

We do not sell personal information, and we do not disclose it to anyone for their own marketing.

Your responsibility for your customers' information

When you send us a customer's details, you are disclosing someone else's personal information. That brings obligations, and they are yours rather than ours.

Before you give us a customer's details, you need to have told them what you are collecting, why, and that you will pass it to a service like ours and to their electricity network — and you need to be entitled to share it with us.

Most networks require a signed customer authorisation before an application can be lodged. Where one is required, you are responsible for obtaining it and providing it to us. We may ask you to confirm that you have it.

If one of your customers contacts us directly about their information, we will usually refer them to you, because you hold the relationship and the authorisation. Where we can help them directly, we will.

Who we share it with

We disclose personal information to:

  • the relevant electricity distribution network, and where the connection requires it, the market operator and the site's electricity retailer. This is the point of the service: an application cannot be lodged without disclosing the site and customer details it contains. Once a network holds that information, the network's own privacy policy governs what it does with it.
  • the business you work for, if you use Grid Pass through a business account — your colleagues and account administrators can see the jobs on that account.
  • our service providers, who help us run Grid Pass: hosting and infrastructure, sign-in, email delivery, error monitoring, payment processing, and support tooling. They may only handle the information to provide their service to us, and are bound to keep it confidential and secure.
  • Google, for address lookup. When you type a site address into the platform, the text you type is sent to Google's Places service to suggest matching addresses. Only that address text goes to Google — never the customer's name or any other detail of the job.
  • our professional advisers — lawyers, accountants, auditors and insurers — where they need it to advise us.
  • anyone we are required or authorised by law to disclose it to, including a court, tribunal or regulator.
  • a buyer, if we sell or restructure the business. Any buyer would be bound to handle the information consistently with this policy.

We will otherwise only disclose personal information with consent.

Sending information overseas

Grid Pass and its backups are hosted in Australia.

Some of the service providers described above operate from outside Australia, which means some personal information is stored or accessed overseas. The countries this is likely to involve are the United States and Singapore.

Before we send personal information overseas, we take reasonable steps to satisfy ourselves that the recipient will handle it in a way consistent with the Australian Privacy Principles.

How we keep it safe

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. In practice that means:

  • information is encrypted in transit, and at rest in our databases and backups;
  • access is limited to the people who need it to do their job, and is logged;
  • accounts are individual, never shared, and we require strong authentication;
  • we keep our systems patched, and we review who has access to what;
  • our service providers are chosen partly on the strength of their own security.

No system is perfectly secure, and we will not pretend otherwise. Section 13 explains what happens if something goes wrong.

How long we keep it

We keep personal information for as long as we need it for the purposes described in section 4, and then for as long as we are required to keep it.

A lodged grid application is a compliance record. It shows what was submitted, on whose authority, and what the network approved — and that matters years later, when a site is inspected, modified, or disputed. We therefore keep application records for seven years after the application is completed or withdrawn.

Account and billing records are kept for seven years, as tax law requires. When we no longer need personal information, we destroy it or de-identify it.

Marketing emails

We may send you emails about Grid Pass — product updates, changes to network requirements, and occasionally something we think would be useful to you. Every marketing email has an unsubscribe link, and we act on it. You can also just reply and ask.

Unsubscribing does not stop the emails you need in order to use the service — application updates, invoices, security notices and the like.

We never send marketing to your customers.

Cookies, analytics and this website

This website is a set of static pages. It sets no cookies, runs no analytics, and loads no third-party scripts — nothing here follows you between sites or reports back on what you looked at.

One thing is stored on your device: if you play the maze in the footer, your best times are saved in your browser's local storage. They stay on your device and are never sent to us. Clearing your browsing data clears them.

The Grid Pass platform at app.gridpass.com.au does use cookies, because it has to — they keep you logged in and keep your session secure. If we ever add analytics, we will update this section before we turn it on.

Seeing and correcting your information

You can ask us what personal information we hold about you, and ask for a copy. Email support@gridpass.com.au and tell us what you are after. We will ask you to verify who you are, then respond within 30 days.

If what we hold is wrong, out of date, incomplete or misleading, tell us and we will fix it. There is no charge for correcting information.

There are limited situations where we cannot give access — for example, where doing so would reveal someone else's personal information, or where the law requires us to refuse. If that happens we will explain why in writing, and tell you how to complain about it.

If you are one of our customer's customers, start with the retailer or installer who lodged your application. They hold the relationship and the authorisation. We will help them help you.

If something goes wrong

If we suspect a data breach, we assess it promptly. Where a breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires — and we will tell you what happened, what information was involved, and what to do about it.

If the breach involves information you gave us about your customers, we will tell you as soon as we can, so you can act too.

Making a complaint

If you think we have mishandled personal information, tell us first. Email support@gridpass.com.au with what happened and what you would like us to do about it.

We will acknowledge your complaint within 5 business days and respond within 30 days. If we need longer, we will tell you why and when to expect an answer. If we got it wrong, we will say so and fix it.

If you are not satisfied with our response, or we do not respond within 30 days, you can take the complaint to the Office of the Australian Information Commissioner:

Website
oaic.gov.au/privacy/privacy-complaints
Phone
1300 363 992

Changes to this policy

We update this policy when what we do changes. The current version is always at gridpass.com.au/privacy, and the date at the top tells you when it last changed.

If we make a change that materially affects how we handle your personal information, we will tell you before it takes effect, by email or in the platform.

Contact us

For anything in this policy — a question, a request, or a complaint:

Email
support@gridpass.com.au
Post
Grid Pass Pty Ltd, Level 2/88 Jolimont Street, East Melbourne VIC 3002