Privacy
What we collect, and where it goes.
This site argues that a practice should know where its data lives. It would be a poor argument if this page were vague. Below is every piece of information ndpro.com.au collects, which company holds it, and which country it sits in.
Last updated 20/10/2026 · Santos Technology Pty Ltd · ABN 12 697 662 669
1. What this policy covers
This policy covers the public website at ndpro.com.au, including the behaviour-support page at ndpro.com.au/bsp. It is about people who visit those pages: prospective customers, and anyone who fills in a form or books a call.
It does not cover the NDPRO software itself. Participant, practitioner and clinical records held in the product are governed by the written agreement between Santos Technology Pty Ltd and the practice that operates it, under which the practice is the entity responsible for that information and we act on its instructions. Nothing on this website is connected to those records, and no information collected here is placed into them.
For the optional Google Drive connection in NDPRO Resource Library, see our Google Drive integration privacy notice.
2. Who we are
NDPRO is a product of Santos Technology Pty Ltd (ACN 697 662 669, ABN 12 697 662 669), an Australian company. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
For anything in this policy — a question, a correction, a copy of what we hold, or a request to delete it — write to contact@santostech.com.au.
3. What we collect
The website handles information through the services described below.
3.1 Preparing your walkthrough booking
The form on ndpro.com.au/bsp asks for your practice name, name, work email and number of practitioners. With JavaScript enabled, your name and email are passed to Calendly to prefill the booking. Practice name and practitioner count remain in the page. Without JavaScript, the form submits its fields directly to Calendly. These fields are not sent to our website analytics. We use booking details to arrange your walkthrough, and do not add you to a mailing list.
3.2 Booking a walkthrough
The booking panels on the homepage and /bsp are provided by Calendly LLC, in the United States. Whatever you type into it — typically your name, email address and a note — is collected by Calendly and passed to us as a calendar invitation.
Two things about that panel are worth stating plainly, because they are the reason it is built the way it is. It is closed until you open it, and while closed it contacts nobody: no request leaves your browser for Calendly or anyone else. When you open it, Calendly's booking page loads inside it, and that page brings in a number of its own third-party services — analytics, error reporting and advertising among them — which operate under Calendly's terms rather than ours. We cannot switch those off. Keeping the panel closed by default is how we make sure that reading this site never triggers them.
3.3 Web server logs
This site is hosted by Vercel Inc. and served from their Sydney (ap-southeast-2) region. As with any web server, requests are logged: your IP address, the page requested, the time, and your browser's user-agent string. We use these only to keep the site running and to investigate abuse. We do not use them to build a profile of you.
3.4 Fonts
The typefaces on this site are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Requesting a font discloses your IP address and user-agent to Google, in the ordinary way any request to any server does.
3.5 Website measurement on /bsp
We use Vercel Web Analytics to measure visits to /bsp and interactions with its walkthrough flow: arrival from a known guide, a booking-button click, starting the calendar flow and a scheduling-completion notification. A completion notification is not a record of attendance or a qualified enquiry. Our guides and homepage do not run this analytics integration.
We send the fixed page address /bsp, the interaction name and, for interactions, a permitted source label and guide name. We remove URL parameters, fragments and full referrer addresses. We do not send names, emails, form contents, Calendly identifiers or clinical records to this analytics service. Vercel also processes ordinary request information for aggregate statistics, including browser, device, approximate location and time. Requests reach Vercel with network information such as an IP address; this is not a claim that no information is processed by the provider.
This integration does not enable analytics cookies, identify individual users or store an analytics identifier in your browser. It skips collection when your browser sends Do Not Track or Global Privacy Control. Content blockers can also prevent collection. Vercel's analytics privacy documentation explains its processing. Its privacy notice describes processing in the United States and other jurisdictions where it operates. Analytics processing is not restricted to Australia.
4. What we do not do
These are statements about the pages as they are actually built, not aspirations.
- This site sets no cookies. Neither the homepage nor /bsp sends a Set-Cookie header, and neither writes to your browser's local storage. There is no analytics cookie in this integration. (Calendly's booking page, once you open it, is Calendly's own page and manages its own cookies.)
- Website measurement is limited to section 3.5. No Google Analytics, no Meta pixel, no session recording, no heatmaps, no A/B testing tool.
- There is no advertising and no tracking across other sites. We do not run retargeting, and we do not upload contact lists to advertising platforms.
- We do not sell, rent or trade personal information. Ever, to anyone.
- We do not add you to a mailing list because you filled in a form. If we ever start sending a newsletter, it will be something you opt into separately.
5. Information sent overseas
Australian Privacy Principle 8 requires us to name the countries your information may go to. For this website, they are:
| What | Who holds it | Where |
|---|---|---|
| Legacy application submissions, where retained | Formspree, Inc. | United States |
| Website analytics | Vercel Inc. | United States and other jurisdictions where Vercel operates |
| Walkthrough bookings | Calendly LLC | United States |
| Web server logs | Vercel Inc. | Australia (Sydney) |
| Font requests (IP, user-agent) | Google LLC | United States and elsewhere |
| Email you send us | Santos Technology Pty Ltd | Australia |
We have chosen these providers for the marketing site deliberately and separately from the product. The NDPRO software holds its data in Australia; a form on a website that asks for a business email address is a different question from a clinical record, and we have not pretended the two are the same by putting them in the same sentence.
6. How long we keep it
- Applications we take forward become part of our customer records and are kept for as long as the relationship lasts, and for seven years afterwards, which is the period Australian tax and corporations law requires for business records.
- Applications we do not take forward are deleted within twelve months, from both our inbox and the form provider's system.
- Server logs are retained by our host for their standard period and are not copied into any other system by us.
- Website analytics are available within Vercel's current Pro reporting window of twelve months. Vercel states that it may retain data beyond that window; this is not a twelve-month deletion promise. See its reporting-window documentation.
- Ask us sooner and we will delete sooner. A request to remove your details is honoured; see section 8.
7. How it is protected
Every page on this domain is served over HTTPS only, with HTTP Strict Transport Security, and the site runs under a restrictive Content Security Policy that forbids it from loading or sending anything to a destination not named in this policy. The site itself stores nothing: it has no application database or login. Booking records are handled by Calendly, and aggregate website measurement is handled by Vercel as described above.
No system is perfectly secure, and we will not claim otherwise. If information we hold is involved in a data breach likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
8. Seeing, correcting or deleting what we hold
Write to contact@santostech.com.au and tell us what you want. You can ask us to:
- tell you what personal information we hold about you;
- send you a copy of it;
- correct anything that is wrong; or
- delete it.
We will respond within 30 days. We do not charge for this. If we refuse a request — which would only be for a reason the Privacy Act allows — we will tell you why in writing.
9. Complaints
If you think we have mishandled your personal information, tell us first at contact@santostech.com.au and we will investigate and reply within 30 days.
If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner — oaic.gov.au/privacy/privacy-complaints, or 1300 363 992. You do not need our permission to do that.
10. Changes to this policy
If we change how this site collects information — a new form, a different provider, a new country in the table above — we change this page and move the date at the top. We do not make a change retrospective: information already collected stays under the terms it was collected under.
This policy covers the website only. It is not affiliated with, endorsed by, or an interpretation of guidance from the NDIA or the NDIS Quality and Safeguards Commission.