Last updated: 18 October 2026 (version 1.0 (draft for legal review))
1. About this policy
360 SaaS Pty Ltd (ABN 79 681 731 340) (we, us, our) operates Portal 360, practice management software for Australian accountants, bookkeepers, fractional CFOs and advisory firms. We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs), including the Notifiable Data Breaches scheme in Part IIIC and the Privacy (Tax File Number) Rule 2015.
This policy explains what personal information we collect, how we collect, hold, use and disclose it, and how you can access or correct it or make a complaint. Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true.
It applies to visitors to our website, people who contact us, users of Portal 360 and our mobile apps, and other people we deal with in running our business. It does not apply to other websites we link to.
2. Two roles: our own information and your practice's information
We handle personal information in two different capacities, and who to contact depends on which one applies.
- Our own information. We decide why and how we collect information about website visitors, prospects, customer account users, billing contacts, suppliers and job applicants. For that information we are the entity responsible under the Privacy Act, and this policy applies directly.
- Practice data. Accounting practices that use Portal 360 (our customers) store information about their own clients in the platform, such as client contact details, tax file numbers, financial records and documents. We hold that information on the practice's behalf, to provide the service and only on its instructions. The practice decides what to collect and why, is responsible for telling its clients and obtaining any consents it needs, and is usually the right first contact for access, correction and complaints about that information.
If you are a client of a practice that uses Portal 360 and you contact us about your information, we will tell you who to contact and pass your request to the practice, unless you ask us not to or the law requires otherwise. We will help the practice respond.
3. The kinds of personal information we collect and hold
Depending on how you deal with us, we collect and hold:
- Identity and contact details: name, business name, position, email address, phone number and address.
- Account and security details: username, hashed credentials, multi-factor authentication data, role and permissions, and single sign-on identifiers from Microsoft, Google or Xero when you choose to sign in that way.
- Billing details: plan, invoices and payment history. Card details are collected and held by our payment provider, Stripe, and card numbers are not stored on our systems.
- Usage and device information: IP address, browser and device type, pages viewed, actions in the platform, and security and audit logs.
- Communications: enquiries, support requests, call and meeting notes, survey responses and the content of messages you send us.
- Marketing information: your preferences, campaign engagement and subscription status.
- Recruitment information, if you apply to work with us: your application, résumé and referee details.
Practice data that we host for our customers can include names, residential and business addresses, email addresses and phone numbers, tax file numbers (TFNs) and ABNs, financial and tax records, accounting data synced from accounting software, identity documents submitted for verification, and communications and documents uploaded by the practice or its clients.
We do not ask for sensitive information (such as health, racial or ethnic origin, political or religious beliefs, or criminal records) for our own purposes. A practice may upload documents that contain it. We treat that information as practice data, protect it accordingly and use it only to provide the service.
4. How we collect personal information
- Directly from you, when you create an account, start a trial, book a demo, fill in a form, contact support or deal with us by email, phone or meeting.
- Automatically, through cookies, server logs and similar technologies when you use our website and platform (see section 10).
- From your practice, when it adds you as a user or uploads information about you or your business.
- From connected services at your practice's direction, such as the ATO, Xero, MYOB, QuickBooks, Xero Practice Manager, Microsoft 365, Google Workspace and our identity verification provider.
- From our service providers and publicly available sources, for example to confirm an ABN or business details.
We collect personal information only by lawful and fair means and, where practical, from the individual concerned. If we receive personal information we did not ask for and could not have collected under the APPs, we destroy or de-identify it as soon as it is lawful and practical to do so.
5. Why we collect, hold, use and disclose personal information
We use personal information for the following purposes, and for related purposes you would reasonably expect:
- Providing, operating, supporting and securing Portal 360, including authenticating users, running integrations and delivering the features a practice turns on.
- Setting up and managing accounts, trials, subscriptions, invoices and payments.
- Responding to enquiries, bookings and support requests.
- Detecting, preventing and investigating fraud, misuse and security incidents, and keeping audit logs.
- Improving and developing the platform, using usage data that is aggregated or de-identified where practical.
- Sending service notices, and marketing about Portal 360 where the law allows (section 11).
- Meeting legal, tax and regulatory obligations, including our obligations as an ATO Digital Service Provider, and establishing or defending legal claims.
- Assessing job applications and managing our suppliers and business relationships.
We do not sell personal information. We do not use practice data for our own marketing, and we use it only to provide the service to the practice, except where the law requires or permits otherwise.
6. Who we disclose personal information to
We disclose personal information only as needed for the purposes above, and only to:
- Service providers that help us run Portal 360 (for example cloud hosting, security, payments, email and SMS delivery, identity verification and analytics). Our current list, and where each is located, is on the Trust Centre.
- Your practice and its authorised users, where we hold information on that practice's behalf.
- The ATO, accounting software providers and other services you or your practice connect, and only to the extent you authorise.
- Professional advisers such as lawyers, auditors and insurers, who are bound by confidentiality.
- Government agencies, regulators and courts, where the law requires or authorises it.
- A buyer or other party in a sale, merger or financing of our business, who would be required to handle the information in line with this policy.
Where a provider handles personal information for us, we require it by contract to protect that information and use it only for the purposes we specify.
7. Overseas disclosure
Portal 360 stores and processes practice data in Microsoft Azure Australia East (Sydney) by default, and our AI features run in an Australian Azure region.
Some of our providers are located, or process limited information, outside Australia. The countries involved are mainly the United States, and the locations of accounting software providers you choose to connect (for example New Zealand, the United Kingdom, Canada and the United States). Examples include payment processing by Stripe, email and SMS delivery by Twilio and SendGrid, and the global network of Cloudflare. Our source code is hosted by GitHub and does not contain customer data.
Before we disclose personal information overseas we take reasonable steps in the circumstances to ensure the recipient does not breach the APPs in relation to that information, usually through contract terms and by assessing the provider's security. Where an overseas disclosure happens because you or your practice connect a third-party service, that service's own privacy terms also apply.
8. Artificial intelligence and automated processing
Portal 360 includes AI-assisted features, such as the Pi assistant, AI auto-fill for tasks and automations that you set up.
- These features process the content a user submits to them, which can include personal information in the practice's data, so that the feature can produce a result for that user.
- AI features are provided through Microsoft Azure OpenAI in an Australian region. We do not train external AI models on practice data.
- AI output is a suggestion. A person at the practice reviews and decides, and we do not use these features to make decisions about individuals that have a legal or similarly significant effect without a person involved.
From 10 December 2026 the APPs require privacy policies to describe certain computer-assisted decisions that significantly affect individuals. We will update this section if our features change in a way that brings them within those rules.
9. Tax file numbers and government identifiers
Practice data may include TFNs. We handle TFN information only as the Privacy (Tax File Number) Rule 2015 and the tax laws allow.
We hold TFNs to provide the service to the practice, protect them with encryption and strict access controls, do not use a TFN to identify an individual in our own records, and do not disclose a TFN except as the law allows. A suspected unauthorised disclosure of TFN information is treated as a critical incident under our breach procedure.
11. Direct marketing
We may send you information about Portal 360 by email, SMS, phone or other channels if you have asked for it, or you are a customer or have dealt with us and would reasonably expect it, and the law allows.
Every marketing email includes a working unsubscribe option, and you can also ask us to stop at any time by emailing the Chief Privacy Officer. We honour opt-outs promptly, and we comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth). We will not use or disclose sensitive information for direct marketing without your consent.
12. How we keep personal information secure
We take reasonable steps in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.
- Hosting in Australian Microsoft Azure data centres, with encryption of data at rest and in transit.
- Role-based access, single sign-on, multi-factor authentication for our team, and access reviews.
- Logging, monitoring, continuous vulnerability scanning, patching and secure development practice.
- Daily backups and business continuity and disaster recovery plans.
- Confidentiality obligations and security awareness training for our team, and security assessments of our suppliers.
- A group information security management system, which includes Portal 360, certified to ISO/IEC 27001:2022. More detail is on the Trust Centre.
No system is completely secure. Please keep your login details confidential, use multi-factor authentication and tell us promptly if you suspect your account has been compromised.
13. Data breaches
If we suspect or discover a data breach we follow a documented procedure to contain it, assess whether it is likely to result in serious harm, and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) where the Privacy Act requires. Where we hold information for a practice, we also tell the practice.
The full process, our contact points and the role of our Chief Privacy Officer are set out on our Notifiable Data Breaches page.
14. How long we keep personal information
We keep personal information only for as long as we need it for the purposes in this policy or the law requires. When it is no longer needed, we destroy or de-identify it.
- Practice data is kept while the practice's account is active. On a written instruction at the end of the service, we return it in a standard format or delete it from live systems within 30 days, and it is purged from backups within 90 days after that, unless the law requires us to keep it.
- Billing and contract records are generally kept for 7 years to meet tax and corporate record-keeping requirements.
- Support records are generally kept for 3 years after resolution, and audit and security logs for about 2 years.
- Sales and marketing records are kept while the relationship continues and for a short period afterwards, unless you ask us to remove you.
- Records of data breach assessments are kept for at least 7 years.
15. Accessing and correcting your information
You can ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.
Email the Chief Privacy Officer at privacy@portal360.ai. We may need to verify your identity first. We respond within a reasonable time, and normally within 30 days. We do not charge for making a request, and we will not charge more than the reasonable cost of giving access.
If we refuse a request, for example because the law allows or requires it, we will tell you why in writing and how you can complain. If we refuse to correct information, you can ask us to attach a statement that you believe it is wrong.
If your request is about information held by a practice that uses Portal 360, we will refer you to the practice (section 2).
16. Making a privacy complaint
If you think we have breached the Privacy Act or this policy, tell us so we can fix it.
Write to the Chief Privacy Officer at privacy@portal360.ai or at 5 Lavington Avenue, Chipping Norton NSW 2170. We acknowledge complaints promptly, investigate them fairly, and aim to give you a considered written response within 30 days.
If you are not satisfied, you can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au, telephone 1300 363 992, GPO Box 5288, Sydney NSW 2001. The OAIC usually expects you to have given us the chance to respond first.
17. Anonymity and children
Where it is lawful and practical, you can deal with us anonymously or under a pseudonym, for example when browsing our website or asking a general question. We usually cannot do this when you use the platform or buy a plan.
Portal 360 is a business service and is not directed at people under 18. We do not knowingly collect personal information from children on our own account. If you believe a child has given us personal information, contact us and we will deal with it.
18. Our Chief Privacy Officer
We have a Chief Privacy Officer, who is accountable to our Director for privacy compliance at 360 SaaS.
The Chief Privacy Officer oversees this policy, privacy training and privacy assessments, handles access, correction and complaint requests, leads the assessment of suspected data breaches, and is our contact with the OAIC. You can read more about the role on our Notifiable Data Breaches page.
Contact: Chief Privacy Officer, 360 SaaS Pty Ltd, 5 Lavington Avenue, Chipping Norton NSW 2170. Email privacy@portal360.ai.
19. Changes to this policy
We review this policy regularly and may update it as our business, our services or the law change. We publish the current version on this page with its date, and tell customers about material changes by email or in the platform.
This policy describes how we handle personal information. It does not limit your rights under the Privacy Act or the Australian Consumer Law, and it is governed by the laws of New South Wales and the Commonwealth of Australia. Our Terms and Conditions set out the terms of your use of the service.