Sell with confidence — Privacy Act & Consumer Law compliance for Australian teams

Privacy Act 1988 & the Australian Privacy Principles

The Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) govern how personal information is collected, used, stored, and disclosed in Australia. When your team stores a lead's name, phone number, or WhatsApp conversation in HelloGrowthCRM, that is personal information under the Act — and your CRM has to make compliance practical, not theoretical.

HelloGrowthCRM supports APP obligations operationally: consent is recorded against every contact at capture (APP 3 — collection), data is used for the sales and service purposes your business defines (APP 6 — use and disclosure), records are stored encrypted in transit and at rest (APP 11 — security), and individuals' access and correction requests can be served from a single record export (APPs 12 and 13). Marketing opt-outs apply automatically across email and WhatsApp sequences, so a withdrawn consent is enforced everywhere at once.

Data collection, handling, and protection

HelloGrowthCRM processes two kinds of data: account data about your business (users, billing, settings) and customer data your team stores in the CRM (contacts, deals, calls, messages). Customer data belongs to your business. We process it on your instructions under a Data Processing Agreement, we do not sell it, and we do not use your customers' data to train AI models for anyone else.

Protection is independently audited: Soor LLC is SOC 2 Type II (examination period February–June 2025), covering security, availability, confidentiality, processing integrity, and privacy controls operating over a sustained period. Infrastructure runs on AWS with encryption at rest, role-based access controls limit who on your team sees what, and audit logs record changes on Enterprise plans. Data export is self-serve — your data is never held hostage.

Spam Act 2003: consent, identification, and unsubscribes

The Spam Act 2003 covers commercial electronic messages — email, SMS, MMS, and instant messages such as WhatsApp — sent to or from Australia. Every marketing message your team sends must meet three conditions: the recipient consented to receive it (expressly, or by inference from an existing relationship), the message clearly identifies your business as the sender, and it contains a functional unsubscribe that you honour within five working days. The Australian Communications and Media Authority (ACMA) enforces the Act, and penalties apply per message, so a single bulk campaign to the wrong list is a real exposure rather than a technicality.

HelloGrowthCRM is built to make those three conditions routine. Consent is recorded against the contact at capture, with the source and date, so you can show how someone came to be on a list. Templates carry your business name and contact details, so identification is not left to whoever wrote the campaign. And an opt-out on one channel is applied across email and WhatsApp sequences automatically, so nobody who unsubscribed is messaged again by a sequence someone forgot to pause. Before a campaign goes out, you can filter the audience to contacts with a recorded consent rather than everyone who was ever imported.

Two things remain your responsibility. First, consent you did not collect cannot be created by software — a purchased list or a scraped directory is not consent under the Act, whatever tool sends to it. Second, the Spam Act governs messages, not calls: telemarketing calls are covered by the Do Not Call Register Act 2006, so check numbers against the Register before your team uses the dialer for outbound marketing. HelloGrowthCRM stores consent status and call history on the record so you have the evidence trail; washing numbers against the Register and deciding who may be contacted is a decision your business makes.

Australian Consumer Law & your rights as a customer

Australian Consumer Law (ACL) consumer guarantees apply to services supplied to Australian consumers and qualifying small businesses: services must be provided with due care and skill, be fit for the purpose communicated, and be delivered within a reasonable time. Nothing in HelloGrowthCRM's terms excludes, restricts, or modifies guarantees that cannot lawfully be excluded.

In practice that means: the product must do what the pricing page and feature pages say it does. We back that with a 14-day free trial on paid plans so you can verify fit before paying, a pro-rated refund within the first 30 days on annual plans, and self-serve cancellation with no exit penalty on Free, Starter, and Growth tiers. If something we shipped does not work as described, support remediates it — that is a service obligation, not a favour.

Transparent billing & service obligations

Australian pricing is published in AUD on the pricing page — Free Forever at A$0, Starter and Growth per-user rates, and custom Enterprise contracts. All prices exclude GST unless otherwise stated, and applicable GST is added visibly during checkout, so the invoice your finance team receives matches the price your sales team approved.

Service obligations are written down: uptime commitments and support SLAs on Enterprise contracts, published support channels for every tier, and a documented data retention and export policy when you leave. Renewal dates are visible in the billing console, and plan changes are pro-rated. No hidden per-module fees, no compulsory onboarding charges, no cancellation penalties on self-serve plans.