Privacy Policy.

1. About this policy

1.1 25eight Pty Ltd (ABN 35 616 790 213) (25eight, we, us, our) helps small and medium business owners build capability. To do that well we need to understand your situation, which means we collect information about you and your business.

1.2 This policy explains what we collect, why, what we do with it, and what control you have. It covers all four of our web properties:

1.3 We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth). We apply the APPs as our standard regardless of whether any exemption might otherwise be available to us.

1.4 This policy sits alongside our Terms and Conditions. Where the two overlap, they are intended to say the same thing.

2. The short version

If you read nothing else:

• We ask for information so we can understand your business and give you something useful in return
• We do not sell, rent or trade your information. The single exception is if our business is sold, and that is set out in clause 8
• Your information is stored in Australia
• Some AI processing of program artefacts involves providers outside Australia. Those providers are not permitted to use your information to train their models
• What you share in a coaching session stays confidential
• You can ask us what we hold, ask us to correct it, ask us to delete it, and opt out of marketing or public use of your feedback at any time

3. What we collect

3.1 We collect different information depending on how you interact with us.

3.2 Sensitive information. We do not seek sensitive information as defined by the Privacy Act. If you volunteer it, for example in describing a health or personal circumstance affecting your business, we will handle it with the same confidentiality that applies to everything else you share in a session and will not record it beyond what is necessary.

3.3 Children. Our Services are for people aged 18 and over acting for a business. We do not knowingly collect information from anyone under 18.

3.4 Information about other people. If you give us information about someone else, for example a team member you are enrolling, you should make sure they know and are comfortable with it.

4. Why we collect it

4.1 The purpose is to give you something useful in return. A diagnostic that reflects where your business actually is. A pathway built for your circumstances rather than a generic one. Coaching that starts from what is true. None of that is possible without knowing something real about you.

4.2 Specifically, we use your information to:

4.3 We do not collect information we do not need for these purposes.

5. Artificial intelligence and automated processing

5.1 AI is part of how our programs work, both as something we use and as something we teach.

5.2 What we use it for. AI tools assist us in reviewing artefacts and program work, generating feedback, and supporting the diagnostic process. The subject of that processing is your business artefacts and program content.

5.3 Human involvement. Your diagnostic results and recommended pathway are generated by the Platform and delivered to you directly. In the Structured Program and Work Privately 1:1, a coach then works through those results with you at your debrief and can adjust the pathway. In Self-Guided there is no coaching session, so the results and pathway you receive are the Platform's output.

5.4 What the output is, and is not. Diagnostic results and pathway recommendations are a structured reading of the answers you gave. They are a starting point for your judgement, not a decision made about you. Nothing generated by the Platform determines whether you can access a program, what you pay, or any other entitlement.

5.5 Model training. We do not permit our AI providers to use your information to train their models.

5.6 Where the processing happens. Your information is stored in Australia. Some AI processing may involve providers located outside Australia. See clause 8.

5.7 Automated decision-making. From 10 December 2026, Australian privacy law requires organisations to disclose in their privacy policy where a computer program is used to make, or substantially assist in making, a decision that significantly affects a person's rights or interests. Our diagnostic tools generate results and pathway recommendations for your consideration. They do not decide anything about your rights or entitlements. We will update this clause if that changes.

6. Who we share it with

6.1 We share your information only with service providers who help us run our business, and only so they can provide that service to us. They act on our instructions and cannot use your information for their own purposes.

6.2 This table lists the providers that hold or process personal information. It does not list every piece of software we use. Tools that do not touch your information, such as our internal accounting or design software, are not listed.

6.3 We also disclose information where required by law, where necessary to prevent serious harm, or to our professional advisers under obligations of confidence.

6.4 We do not sell your data. We do not sell, rent or trade your personal information or your business information to anyone, and we do not disclose it for another organisation's marketing purposes.

6.5 The one exception. If our business is sold, merged or transferred, your information may transfer to the acquiring entity as part of that transaction. We will only do this where the acquirer agrees to be bound by commitments no less protective than these, and we will notify you before it takes effect. This is a transfer of the business rather than a sale of your data.

7. Confidentiality of coaching and program sessions

7.1 What you share in a coaching session or program session stays in that session. We keep your business information, including any financial information you share, confidential and do not disclose it to any third party.

7.2 We use insights from program delivery in anonymised and aggregated form to improve our programs and to contribute to understanding of small business capability. Nothing published in this way identifies you or your business.

7.3 Webinars are recorded. If you would prefer not to appear, keep your camera off and use the chat rather than speaking.

7.4 Coaching sessions are not video recorded. We do use the automated note-taking feature in Google Meet. It produces a written summary of the session, and it also produces and retains a transcript of what was said. Both the summary and the transcript are stored with your program records in Google Workspace and are available to you and your coach.

7.5 Your consent, and how to withdraw it. By enrolling in a program that includes coaching, you consent to summaries and transcripts being produced in this way. Your coach will confirm at the start of each session that the feature is on. You can ask for it to be turned off for a single session or for all of your sessions, at any time, without giving a reason. Ask your coach, or email programs@25eight.co.

7.6 Transcripts and summaries are kept for the period set out in clause 11. You can ask us to delete a transcript or summary at any time under clause 13.

7.7 Feedback and testimonials. How we use your feedback publicly, and how to opt out, is set out in clause 9 of our Terms and Conditions. In short: we may publish short extracts attributed to your first name and industry only, anything more identifying requires your express consent, and you can opt out at any time by emailing programs@25eight.co.

8. Where your information is held

8.1 Storage. Your account information, program data, diagnostic results and artefacts are stored in Australia.

8.2 Processing. Some processing involves service providers outside Australia, principally AI providers used for artefact feedback and analysis, and potentially payment, email and video conferencing providers depending on their infrastructure.

8.3 Where information is disclosed to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

8.4 Artefacts. Program artefacts are provided as templates you copy into your own document storage. Once copied, those documents sit in your account with that provider and under your control, not ours. We do not have access to them unless you share them with us.

9. Marketing and the newsletter

9.1 We send our newsletter to people who have asked for it. You can unsubscribe from any newsletter using the link in every message, or by emailing hello@25eight.co.

9.2 If you enrol in a program or complete the Capability Snapshot, we may send you information about your program and about related 25eight offerings. You can opt out of the marketing messages at any time. We will still send you messages necessary to deliver what you have purchased.

9.3 We do not send marketing on behalf of anyone else, and we do not provide your details to anyone else for their marketing.

9.4 Where our existing contact database predates this policy, we are re-confirming consent with those contacts rather than assuming it.

10. Cookies and analytics

10.1 Our websites use cookies to keep you logged in, remember your preferences, and understand how the sites are used.

10.2 We use Google Analytics to understand which pages people visit and how they arrive. This tells us what is useful and what is not. Google may set its own cookies for this purpose, and its handling of that information is governed by Google's privacy policy.

10.3 You can block or delete cookies through your browser settings. Some parts of the Platform will not work correctly without them.

10.4 We do not use advertising or tracking cookies.

11. How long we keep it

11.1 We keep your information for as long as we need it for the purposes in clause 4, and then for as long as we are required to keep it by law.

11.2 When we no longer need information, we delete it or de-identify it.

12. Keeping it secure

12.1 We take reasonable steps to protect your information, including access controls, encryption in transit and at rest, and limiting access to those who need it to do their work.

12.2 No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.

13. Your control over your information

13.1 You can ask us to:

13.2 We will respond within 10 business days. We do not charge for access requests.

13.3 There are limits. We may need to keep some information to meet legal obligations, particularly financial records, and we cannot recover information you have already copied into your own document storage. If we cannot do what you have asked, we will tell you why.

13.4 We may need to verify your identity before acting on a request.

14. If something goes wrong

14.1 If you think we have mishandled your information, tell us first. Email hello@25eight.co with the detail. We will acknowledge within 10 business days and respond substantively within 30 days.

14.2 If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

15. Changes to this policy

15.1 We may update this policy. Each version is numbered and dated, and the current version is published on our website.

15.2 If a change materially affects how we handle your information, we will notify you by email before it takes effect.

16. Contact

25eight Pty Ltd ABN 35 616 790 213, Melbourne, Australia

Privacy enquiries and requests: hello@25eight.co Feedback and testimonial opt-out: programs@25eight.co