Privacy Policy

This policy explains how Summit Electrical & Air collects, uses, stores and protects personal information through the Referral Portal — used by our staff and by referral partner businesses to submit and track ducted air-conditioning referrals.

Summit Electrical & Air is bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

From referral partners (and their staff): name, work email address, phone number, and company details, collected when an admin authorises access and when you complete your account setup.

About referred customers: name, phone number, email address, and property address, submitted by a partner when they lodge a referral, along with the type of work being referred.

Account and activity data: your Google account email (used only to verify who you are when signing in — we never see or store your Google password), and a record of logins and account changes (see "Audit and security records" below).

• Directly from you, when a staff member authorises your access and you complete the onboarding form.
• Directly from referral partners, when they submit a customer's details through the portal.
• Via Google Sign-In, which confirms your identity but does not grant access on its own — a staff member must have separately authorised your email address.

• To operate the referral program: track referrals, contact referred customers about their enquiry, arrange quotes and installations, and calculate and pay referral rewards.
• To manage partner and staff accounts, and to communicate with you about your account or a specific referral.
• To maintain the security and integrity of the system, including detecting misuse.

We do not use referred customer information for marketing unrelated to the referred enquiry, and referring a customer does not add them to a general marketing list.

We do not sell personal information, and we do not share it with other referral partners. Limited, necessary sharing occurs with:

• Our infrastructure providers, who host and run the portal (Supabase for the database and authentication, Vercel for hosting) — bound by their own security and confidentiality obligations, and never permitted to use the data for their own purposes.
• Our transactional email provider (Resend), used only to send account and referral-status emails — never marketing.
• Google, solely to verify your identity when you sign in.

• All access requires Google sign-in — there are no passwords to be stolen or leaked, because none exist.
• Row-level security at the database enforces that a partner can only ever see their own company's referrals, never another partner's.
• Commercially sensitive fields (job cost, internal job numbers) and staff-only internal notes are locked at the database level so a partner account cannot reach them under any circumstance, not just hidden in the interface.
• All traffic to the portal is encrypted (HTTPS).
• Access is logged (see below), so unusual activity can be identified.

We keep a record of logins and of changes made in the portal (who made a change, what it was, and when) for security and accountability. This record is visible only to Summit administrators, never to partners, and is used solely to keep the system secure and to resolve disputes about who changed what.

Before submitting a referral, a partner must confirm the customer has agreed to their details being provided to Summit Electrical & Air and to being contacted about the referred enquiry. That consent covers contact about the referred work — it does not authorise unrelated marketing.

We keep account and referral information for as long as the partner relationship is active, plus any period required by tax, accounting or legal obligations afterward. You can ask us to delete information that we are not otherwise required to keep — see "Your rights" below.

The portal uses only the cookies necessary to keep you signed in securely. We do not use advertising or tracking cookies.

Under the Australian Privacy Principles, you can ask us what personal information we hold about you, ask us to correct it if it's wrong, and raise a concern about how we've handled it. Contact us using the details below — if you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

We may update this policy as the portal changes. Material changes will be reflected here with an updated date.

Questions or concerns about how your information is handled: ops@summitelectricalandair.com.au.