1. About this Policy
This policy describes the handling of personal information by Lucid Solutions Pty Ltd (ACN 646 525 242) as trustee for The Lucid Group Trust (ABN 74 429 387 826), referred to as "Lucid Solutions", "we", "us" or "our". It covers our business administration, hosting, development and related services, and our own website.
Our contact for privacy, access, correction and deletion requests is privacy@getlucid.solutions. General service enquiries may be sent to hello@getlucid.solutions.
Clicki Digital has separate business systems and activities. Its own collection and use of information must be addressed in its privacy policy. Providing hosting to a Clicki customer does not make all Clicki information handling an activity of Lucid Solutions. Any sharing must be assessed according to the actual service and relationship.
2. Information We Handle
Depending on the service, we handle customer and authorised-contact details, billing and transaction records, enquiries and support communications, project materials, account information, technical logs and information contained in hosted websites, databases, files and backups.
The contents of a customer's website or database may include personal or sensitive information supplied by that customer or its users. Customers are responsible for their own collection notices and lawful collection/use of that information. Our responsibilities depend on the services we provide, our actual involvement and applicable law.
3. Collection and Use
Information is supplied through enquiries, quotations, onboarding, service communications, payment and billing processes, project work and hosted systems. Technical information is also generated when people access websites or services.
We use information to arrange and provide contracted services, communicate with customers, maintain accounts and billing, provide support, maintain and secure systems, investigate complaints, recover services and comply with applicable legal obligations.
Where information reasonably needed to arrange or deliver a service is not supplied, we may be unable to provide that service or respond fully to a request.
4. Providers and Business Systems
Our service arrangements include:
- Xero for billing and invoicing.
- Stripe for payment processing and storage of payment-card details as part of that processing.
- Cloudways to manage customer hosting and hosting backups.
- DigitalOcean for Sydney-region bucket storage and DigitalOcean Spaces CDN for public assets.
- Apple iCloud for Lucid email, including support and privacy enquiries.
- ClickUp for relevant onboarding and administration.
Clicki Digital uses Google Workspace, while Lucid email uses Apple iCloud. Where information is shared with Clicki Digital or through its systems, its handling is subject to the relevant service arrangements and applicable requirements.
Service providers may handle information needed to perform their functions. Other disclosures may be necessary to authorised advisers, relevant authorities or parties involved in a legitimate complaint or legal process, where permitted or required by law.
5. Hosting Locations and Overseas Processing
Customer hosting and hosting-backup storage are located in Sydney, Australia through our Cloudways arrangements, and bucket storage in DigitalOcean's Sydney region.
Public assets may be delivered through DigitalOcean Spaces CDN and other confirmed delivery services. CDN processing can involve visitor network/request information as well as public files.
Our billing, payment, email and task-management providers may store or process personal information outside Australia. Depending on the provider, service and account configuration, locations may include the United States, New Zealand, India, Singapore and Ireland. These arrangements are separate from our Sydney-based customer hosting and storage.
CDN delivery and providers' support and security operations may also involve processing outside Australia.
Provider disclosures:
The providers' published disclosures describe their general arrangements, not a confirmation of the storage or processing locations for every individual account. Contact us for information relevant to your service.
6. Our Website and Contact Verification
GitHub Pages serves our website. It loads third-party resources including Bootstrap from jsDelivr, Font Awesome and Unsplash imagery. These requests disclose technical request information to the respective providers. Their processing may include logging, cookies and device information, depending on the resource and provider.
The Service updates page requests public incident records from GitHub’s API. That request sends technical network/request information to GitHub; the displayed incident titles link to public records.
Our contact-reveal feature uses Cloudflare Turnstile and a Cloudflare Worker. When a visitor completes the challenge, the Worker sends the Turnstile token and connecting IP address to Cloudflare's verification service. It checks the result before returning our public business email. Our Worker code does not intentionally persist these verification requests, but provider-level logging, retention and processing may also apply.
Additional embedded content and website tools, where used, may involve processing by their respective providers. The absence of a first-party analytics script does not mean there is no third-party processing.
7. Retention and Backups
Billing and customer records held in Xero are retained for seven years. Support emails are retained for 180 days. These periods are subject to applicable legal requirements and retention exceptions.
SOW approval and staging acceptance emails copied to ClickUp are retained for 365 days from the approval date. Project files in ClickUp are retained for 365 days from project completion.
Complaint records, including supporting evidence and attachments, are retained in ClickUp for 180 days after the complaint is marked Closed, then deleted subject to the preservation requirements below. Cases requiring legal preservation remain open. If a preservation requirement arises after closure, pending deletion must be stopped.
Cloudways server logs are typically retained for seven days under our configuration. Hosting backups are typically retained for 28 days. Retention may vary with the selected service, settings and applicable obligations.
After a hosting service ends, live website files, databases and associated bucket storage are retained for 72 hours and then deleted, subject to applicable legal retention and lawful preservation requirements. Backup copies follow their separate retention arrangements; the 72-hour live-data period does not mean all backups are deleted at that time.
Relevant information may need to be preserved longer for a lawful hold, unresolved complaint, dispute or legal obligation. Deletion from a live system does not necessarily remove every backup immediately; recovery copies expire according to their applicable retention arrangements.
8. Security
We seek to use reasonable technical and organisational measures appropriate to the information and services involved. No internet-connected system can be guaranteed completely secure.
Payment-card details are handled through Stripe. Customers should not email card details or other unnecessary sensitive information to our support or privacy inboxes.
9. Access, Correction and Deletion Requests
Send requests concerning information held by Lucid Solutions to privacy@getlucid.solutions. Include enough detail to identify the relevant account or information, but do not send unnecessary sensitive documents. We may need to verify identity and authority before releasing or changing information.
We will assess requests according to applicable rights, legal obligations, security considerations and the actual services. Access, correction and deletion may be subject to lawful exceptions, third-party rights, retention duties and backup arrangements. Backup copies may remain until their scheduled expiry, subject to applicable preservation obligations.
Requests concerning information collected by a customer through its own website may need to be addressed to that customer. Where Lucid acts on the customer's behalf, we will assess what assistance is appropriate under the service arrangements and applicable law.
10. Privacy Complaints and Australian Law
Raise a privacy concern with privacy@getlucid.solutions, including the circumstances and desired resolution. We acknowledge receipt of privacy complaints within one business day and provide an update within three business days of receipt. The update is not necessarily a final response or confirmation that the investigation is complete.
A business day means Monday to Friday, excluding Queensland public holidays. Business-day timeframes use Brisbane time (Australia/Brisbane).
We assess privacy complaints in good faith and respond within a reasonable period, taking account of the circumstances and applicable requirements.
We handle personal information in accordance with Australian privacy laws applicable to our activities, including the Privacy Act 1988 (Cth), Australian Privacy Principles and Notifiable Data Breaches scheme where they apply. This policy does not limit rights or obligations imposed by applicable law. Where applicable, unresolved privacy concerns may be referred to the Office of the Australian Information Commissioner.
11. Changes and Contact Details
Versions of this policy carry effective dates and version numbers. Publishing a new policy does not by itself alter contractual rights or replace any consent required by law. Earlier versions are retained with the publication record.
Lucid Solutions Pty Ltd as trustee for The Lucid Group Trust
ABN: 74 429 387 826
ACN: 646 525 242
Registered office: 2 Boree Street, Ashmore QLD 4214, Australia
Postal address: PO Box 3118, Helensvale Town Centre QLD 4212, Australia
Privacy: privacy@getlucid.solutions
General enquiries: hello@getlucid.solutions