Data protection and processing.

Website enquiries and client data are different

Allevic handles its own enquiries and business contacts as described in our privacy policy. For a client automation, the client usually decides what the workflow is for and which records it may use. Allevic's role, instructions and access need to be documented for the particular service.

This page is a practical processing overview. It is not a signed data-processing agreement, an independent security certification or a blanket statement of compliance.

What to agree before connecting personal data

1. Purpose and scope: the work to automate, the data fields required and activities that are excluded.
2. Instructions and permissions: who can approve changes, which systems may be accessed and what each integration may read or write.
3. People and notices: whose information is involved, the basis for using it and any notices or recording consent that the workflow needs.
4. Providers and locations: the actual services used, their roles, processing locations and any restrictions on overseas access.
5. Retention and exit: how long records, logs, transcripts and backups are needed, plus return, deletion and access removal when work ends.
6. Incidents and rights requests: contact people, escalation, assistance and the legal notification requirements that apply.

These details belong in the project scope and, where needed, a data-processing agreement. Fees, liability, incident deadlines and audit rights are agreed in the contract, not invented by this overview.

Design around the data you actually need

Use the minimum fields needed for the task. Keep human review for judgement calls and exceptions. Confirm account permissions, credential handling, logging and the response to failed or repeated actions during testing. Use representative or de-identified examples where possible before allowing live processing.

Health information, financial records, identity documents and other sensitive material need an explicit assessment of the workflow, providers and legal requirements. Do not assume a public website assistant or an ordinary integration is a suitable place to upload them.

AI, voice and third-party services

AI models can produce incomplete or inaccurate output. Agree which outputs need review, how a person can take over and what the automation must not decide. For voice, confirm whether recording or transcription is enabled and what the caller is told.

Provider choices vary by project. The public website currently uses services listed in our provider notice; a client deployment can use a different set. Ask for the actual processing schedule rather than assuming that all data stays in Australia or that every provider has identical retention and model-training terms.

Australian privacy context

The Australian Privacy Act 1988 and Australian Privacy Principles apply where the organisation and activity are covered. Coverage can depend on the services, information and circumstances involved. The client's own obligations do not disappear because a workflow uses an external provider.

For a project, identify which party is responsible for collection notices, access and correction requests, overseas disclosures, retention and any required breach notifications. Document how Allevic will assist and which providers will receive information. A signed agreement should reflect the actual deployment and applicable law.

Official guidance: Australian Privacy Principles, privacy coverage for small business and overseas disclosure guidance. Obtain legal advice for the obligations and agreement required for your circumstances.

Request processing details or report a concern

Contact hello@allevic.com or +61 480 529 338 with the service, client or project name and the information you need. Ask for a project-specific data-processing schedule, provider list or agreement before sharing production records. For an urgent suspected incident, say so in the subject and include a safe summary, not passwords or a public copy of affected records.