Privacy policy

1. Who this policy covers

This Privacy Policy explains how PT Next Step Projects, trading as Tenement Track (NPWP 65.745.459.1-905.000) ("Tenement Track", "we", "us") collects, holds, uses and discloses personal information when you use the Tenement Track website and application (the "Service").

PT Next Step Projects is an Indonesian company, which means two privacy regimes are relevant to how we handle your data: Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "PDP Law"), which applies to us as an Indonesia-domiciled data controller, and the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), which apply because our customers and the individuals whose data we collect are based in Australia. We've written this policy to meet both standards, rather than relying on any exemption either regime might otherwise offer a business our size — because our customers are ASX-listed companies who reasonably expect that bar to be met regardless.

If you have questions about this policy, contact us at privacy@tenementtrack.com.

2. Information we collect

Account and contact information — name, work email, phone number, job title, and the entity/entities you're associated with, collected when you register or when a colleague adds you to their account.

Company and tenement data — the exploration entity details, tenement register data, expenditure figures, and quarterly reporting content you or your team enter or upload, including any files you attach (e.g. Competent Person reports, maps, drill data).

Billing information — handled directly by our payment processor, Stripe. We receive your name, billing email, subscription tier, and transaction history, but we never see or store your full card number.

Usage and technical data — log data, device/browser information, IP address, and how you interact with the Service, collected automatically to keep the Service secure and working.

Cookies — we use essential cookies to keep you logged in and, if enabled, limited analytics cookies to understand product usage. We don't use third-party advertising cookies.

3. Why we collect and use it

We use your information to:

• provide the Service — maintain your tenement register, generate report drafts, and store your files;
• authenticate and secure your account;
• process subscription billing, including the peak-usage true-up described in our Terms of Service;
• communicate with you about your account, billing, and material changes to the Service;
• improve the Service based on aggregated usage patterns;
• meet our own legal and accounting obligations.

We do not sell your personal information, and we do not use your tenement or exploration data to train third-party AI models or share it with data brokers.

4. Who we share it with

We share information with the service providers who run Tenement Track's infrastructure, strictly to operate the Service — never for their own marketing purposes:

Each of these providers is contractually bound to protect your data and use it only to provide their service to us. We otherwise disclose personal information only: with your consent; to comply with a legal obligation (e.g. a valid court order); or in connection with a business transfer (e.g. if Tenement Track were acquired), in which case we'd notify you first.

5. Overseas disclosure

Your data crosses borders in a few directions, and it's worth being explicit about that:

• We are based in Indonesia. As an Indonesian company, personal information we collect from you (an individual in Australia, in most cases) is disclosed to us in Indonesia, and then to our infrastructure providers, as part of operating the Service.
• Our infrastructure providers (Supabase, Cloudflare, Stripe, Resend) operate servers and support functions in various countries. Our primary database is hosted in Australia (Sydney) — we keep your tenement and reporting data on Australian infrastructure where our providers offer that option.

Under the Australian Privacy Principles, where we disclose your information overseas (including to ourselves in Indonesia, and onward to our providers), we take reasonable steps to ensure it's handled consistently with the APPs — including relying on providers' standard data protection commitments and, where required under Indonesia's PDP Law for us as the sending party, an adequate legal basis for the cross-border transfer (such as the recipient country's data protection standard, contractual safeguards, or your consent).

6. Data security

We rely on our providers' infrastructure-level security (encryption in transit and at rest, access controls, row-level security scoped to your organisation) and restrict our own internal access to what's needed to support you. No system is completely secure, but we take reasonable technical and organisational steps to protect your information against misuse, loss, and unauthorised access.

7. Data breach notification

If we experience a data breach that is likely to result in serious harm to affected individuals, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in line with the Notifiable Data Breaches scheme, as soon as practicable after becoming aware of it.

8. How long we keep your data

We retain account and tenement/report data for as long as your account is active, plus a reasonable period afterward to meet accounting, audit-substantiation, and legal obligations. Compliance records like filed reports are often expected to be retrievable for several years, so we retain them for 7 years post-cancellation, matching typical AU financial record-keeping expectations. You can request earlier deletion of personal information that we're not otherwise required to retain.

9. Access, correction, and complaints

You can access and correct most of your account information directly in the Service. For anything else — including a request to access, correct, or delete personal information we hold about you — email privacy@tenementtrack.com. We'll respond within a reasonable time.

If you're unhappy with how we've handled a privacy complaint, you can escalate it to the OAIC at oaic.gov.au, which oversees complaints under the Privacy Act regardless of where the entity you're complaining about is domiciled, provided it has the required link to Australia (which we do, as a business serving ASX-listed customers).

10. Children's privacy

The Service is a business tool for professionals working at ASX-listed exploration companies. It's not directed at, and we don't knowingly collect information from, children.

11. Changes to this policy

We'll update this policy as the Service evolves and post the revised version here with an updated "Last updated" date. Material changes affecting how we handle your data will be communicated directly (e.g. by email) before they take effect.

12. Contact us

Email: privacy@tenementtrack.com

Postal address: Banjar Sala, Jalan Buung Said Pura Dalem, Ubud, Pejeng Kawan, Kec. Tampaksiring, Kab. Gianyar, Prov. Bali 80571, Indonesia