Security Statement

Version 2.9 - Effective from May 2022

Harvest Digital Planning (Harvest) understands the importance of an effective information security management system to protect the confidentiality, integrity and availability of all information assets from potential threats.

Our strong commitment to security is reflected in the implementation of our security policies, processes, controls and alignment and compliance with international standards.

The Security Statement is aimed at being transparent about our security infrastructure and practices, to help reassure you that your data is appropriately protected.

Security Policies

Harvest has established an information security policy foundation, as part of its Information Security Management System (ISMS) to provide clear guidance for management and staff in order to protect the confidentiality, integrity, and availability of customer data. Harvest maintains, regularly reviews and updates its information security policies on a regular basis.

Compliance

Information Security

Harvest has achieved ISO 27001 certification. The certification process involves an extensive independent, expert assessment of an international set of standards for developing an Information Security Management System (ISMS) to ensure that our systems effectively identify and manage security risks with the entire organisation.

A copy of the ISO 27001 certificate can be provided by Harvest upon request.

Privacy

Harvest respects the rights and privacy of all individuals and is committed to protecting the personal information it holds and complying with various Privacy Acts and Principles including Europe’s General Data Protection Regulation (GDPR).

More information: https://the-hive.com.au/legal/privacy-policy-curre...

Technical review

Harvest undertakes annual independent penetration testing of its product, services and infrastructure. The last penetration test was performed in November 2021.

In addition, security and penetration testing has been performed on the service, organized by the customer themselves. Several customers have undertaken a security audit and penetration tests of the service within the last 24 months.

Each customer has various standards with regards to the frequency of security and vulnerability testing. Some customers test annually, others test more frequently, such as monthly. Additionally, we are often subject to penetration tests before sites are launched. Overall, the application would be subject to many security and vulnerability tests over the course of a year, and any remediation work entailed would be applied to all customer sites and infrastructure.

Data Hosting and Physical Security

Harvest utilises the public cloud to develop, build and deploy all its infrastructure and services. Speciﬁcally, Harvest utilises Amazon Web Services (AWS) for all its cloud hosting and server infrastructure.

All data, including backups, are hosted within the customers federal jurisdiction, or closest acceptable location. For instance, Australian and New Zealand customers are hosted within a data centre in Sydney, NSW, Australia. USA customers are hosted within a data centre in Oregon, USA. Canadian customers are hosted within a data centre in Montreal, Québec, Canada. European customers are hosted within a data centre in Ireland.

The AWS Data Centres that host Harvest's customer information assets are housed in secure nondescript facilities and physical access is strictly controlled both at the perimeter and at the building ingress points.

Personnel Security

All Harvest personnel are required to complete a Police Check and undergo other identity and background screening checks at the time of hire. In addition, Harvest communicates its information security policies and conducts speciﬁc security training to all personnel.

All new personnel are required to acknowledge and sign non-disclosure and conﬁdentiality clauses as part of their employment agreements.

Asset Management

Harvest information assets are managed in accordance with its information security and asset management policies. which includes the identiﬁcation, classiﬁcation, labeling, handling, retention, and disposal of information and assets.

Access Control

Administration

Harvest has established an Access Control Policy and procedures, which outlines the general principles of access control, including how personnel should be provided access to Harvest premises, applications, and networks and infrastructure.

Harvest grants access initially with least privilege rules, reviews permissions regularly, and revokes access immediately after employee termination.

Harvest has established a Password Management Policy, which outlines how passwords should be selected by personnel and managed within Harvest applications.

Harvest personnel access to The HiVE requires multi-factor authentication.

Server access

The HiVE server infrastructure is protected by network security and solutions (AWS VPC controls) to secure data at rest. All production servers are in a private subnet -there is no ability to connect to the servers directly.

A select number of authorised staﬀ have access to manage infrastructure and services as well as create, modify and delete data. Access and authentication to Harvest servers requires the use of a valid SSH key via a jump host.

User and role based access

Only privileged access is granted to personal or submission data through the platform. Privileged access is restricted and controlled through role-based access and user group permissions.

Each group and role have diﬀerent permissions and access to diﬀerent features of the platform. Additionally, access control within The HiVE can be customised for each user role if required.

User passwords

The HiVE provides the ability to establish minimum complex password requirements. Complex passwords can include several requirements such as:

Minimum length
Maximum length
Uppercase characters
Lowercase characters
Numbers
Special Characters

All passwords stored in the database are hashed.

Managing user access

Site Administrator accounts within The HiVE can manage all user accounts including adding new users and deactivating old user accounts. Site Administrators are responsible for maintaining and reviewing all user accounts and access.

Encryption

Data in-transit

The HiVE uses Transport Layer Security (TLS) encryption (also known as HTTPS) for all transmitted data, including user submissions and reporting. Internal API requests are required to pass through a secure gateway and are validated via an encrypted JSON Web Token (JWT).

Data at-rest

The HiVE uses Amazon’s Aurora Cloud Database Service for its cloud database storage. Each Aurora instance has encryption enabled meaning data is encrypted at rest, including the underlying storage for a database (DB) instance, its automated backups, read replicas, and snapshots. This capability uses the open standard

AES-256 encryption algorithm to encrypt the data.

Software Development

Harvest has established a Secure Development Policy which outlines how development and operational activities should be managed and conducted in a secure manner.

Development, testing, and production environments are separated. Harvest uses a strict development workﬂow to test all new releases. All application changes must be peer reviewed, tested and accepted prior to deployment into the production environment.

All Harvest source code is stored within a dedicated and secure code repository.

Backup and Recovery

Harvest’s databases are protected by backups of the database and ﬁles occurring every 24 hours. This service is intended for the purposes of Disaster Recovery relating to data corruption.

Backups of the data are stored in the same region as the customer's production data. Harvest uses AWS S3 for data and backups, and for redundancy purposes S3 objects are stored across multiple devices spanning a minimum of three Availability Zones.

Furthermore, Harvest maintains a formal Business Continuity & Disaster Recovery Plan (BCP). The BCP is tested and updated on a regular basis to ensure its eﬀectiveness in the event of a disaster.

Data restoration is only possible from the time of the nearest daily recovery point closest to the corrupting incident.

Logging, Monitoring and Availability

Logging

The HiVE stores a range of logs at both the infrastructure and application levels.

Infrastructure logs are sent to and ingested by a centrally managed application and are kept on a 90-day rolling cycle. Access to the application logs is controlled and limited to authorised staﬀ who have a valid login.

The HiVE application logs a number of events related to the following key functions:

User events
Page events
Block (content editing) events

Application event logs are kept indeﬁnitely, unless the service requires historic event logs to be archived due to size concerns. By default, application events can only be accessed by authorised Harvest administrators via the dashboard and downloaded via csv.

Harvest will provide customers with reasonable assistance and access to logs in the event of a security incident impacting their site and data.

Monitoring

The Server infrastructure, application and automation scripts are continually monitored, and internal staﬀ are notiﬁed via email and instant messaging of any exceptions or downtime.

Availability

Harvest will use commercially reasonable eﬀorts to provide a Service that has a Monthly Uptime Percentage of at least 99.9%, unless otherwise noted within the terms of the contract agreement. Ongoing monitoring of the Service is undertaken by Harvest to calculate uptime however the uptime percentage does not include any time for scheduled maintenance.

Information Security Incident Management

Harvest has established an Information Security Incident Management Policy which outlines Harvest’s methodology for identifying, investigating, resolving and reviewing all types of information security incidents.

If a security incident has occurred or is suspected we would follow the following process:

1. Contain - Our immediate goal, once a security incident has been discovered, would be to immediately take action to limit the incident or breach.

2. Assess - We would gather and evaluate as much information about the incident or data breach as possible. This would include:

a. A determination of the impact and number of aﬀected users

b. the types of personal information involved in the data breach

c. the circumstances of the data breach, including its cause and extent

d. the nature of the harm to aﬀected individuals, and if this harm can be removed through remedial action

3. Notify - We would notify the customer as soon as the incident has been contained and assessed. If the security incident was ongoing, or the assessment was taking longer than expected we would provide the customer continual updates as to the status of the incident.

4. Review - We would undertake a review of the incident, to better understand its root cause and determine methods for preventing similar incidents in the future.

5. Incident Management Report - Lastly, a report would be supplied to the customer to formally document and outline the cause of the incident, the duration, impact, resolution and future prevention methods.

Additional information

For additional information regarding security and privacy please refer to the Terms of Service provided to each customer or contact Harvest directly to discuss.

Version 2.0 - Effective from September 2021

This Privacy Policy describes how Social Pinpoint Pty Ltd (“Social Pinpoint”, “we”, “us” or “our”) (ABN: 12 148 958 927) collects, protects, discloses, stores and uses your personal information through its provision of online software applications and other digital products (the “Software”) and services (together, the “Services”).

Our Software is operated by an external operator (the “Operator”) who licences the Software from Social Pinpoint and may, from time to time, collect information for various reasons outlined in their Privacy Policy, Privacy Statement, or any other applicable Agreement. You should check these documents and ensure you are comfortable with how the Operator will collect and handle your personal information.

This Privacy Policy has been prepared to take into account the following privacy laws:

Australia - Privacy Act 1988 (Cth) (“Privacy Act") and the Australian Privacy Principles (“APPs"). See Appendix 1 for Privacy Act and APP specific provisions.
Canada - The Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA).
European Union - General Data Protection Regulation 2016/679 (“GDPR”). See Appendix 2 for GDPR specific provisions.
New Zealand - Privacy Act 2020.

If the Operator is a government entity or located in another jurisdiction, we may also contractually agree to comply with additional privacy laws.

What information is collected?

Personal Information

Customers:

In providing its Services, the type of personal information collected by Social Pinpoint may include (but may not be limited to) the following types of information, when this information is shared:

Your name
Email address
Phone number
The organisation you work for
Your job title
Your preferences and opinions with respect to the Services
Details of the Services requested by you and provided to you and Social Pinpoint’s response to you, including with respect to any support requests
Any feedback you provide to Social Pinpoint, including in any feedback surveys
Your IP address
Other unique ID numbers
Any other personal information requested by Social Pinpoint and/or provided to Social Pinpoint by you or by a third party.

Users of our Services:

The Operator may collect a range of personal information from you when you use our Services (whether as a staff admin user for the Operator or as a visitor to the Operator’s website), depending on their specific requirements and needs. Personal information may be collected in a range of ways including through a registration process or through various activities and interactions on the site.

The type of personal information collected will vary between Operators and may include (but may not be limited to) the following types of information, when this information is shared:

Your name
Email address
Username
Profile picture
Phone number
Your IP address
User-agent string
Other unique ID numbers
Social network account IDs
Physical address, postcode, or other locational attributes
Demographic information such as age, gender, etc.
Information about your preferences
Your recorded thoughts, ideas, opinions, etc. as expressed by you. This may include sensitive information if you provide political opinions.

You will need to check the Privacy Policy of the Operator to confirm what personal information is collected.

Where an Operator collects your personal information, this personal information may also be collected and accessed by Social Pinpoint in fulfilling our duties and responsibilities to the Operator and to internally analyse and improve our Services and Software.

Cookie Policy

Our websites use cookies to record and log data. We use both session-based and persistent cookies, dependent upon how you use or interact with our websites.

Cookies are small data files sent by us to your computer, or from your computer or mobile device to us each time you visit our website. They are unique to you or your web browser. Session-based cookies last only while your browser is open and are automatically deleted when you close your browser. Persistent cookies last until you or your browser delete them, or until they expire.

When you use one of our websites, we may use technologies such as cookies to store information about your visit. If you have provided us with personal information, cookies may be associated with this information.

We use this information to better understand how people use our websites, to improve our products, to ensure that we give you the best experience we can, to detect fraud or abuse and to help our customers learn about which engagements and content most matter to their communities.

If you do not wish to have cookies enabled, or wish to be notified of their use, most modern browsers will allow you to adjust this in the settings. Please note that disabling the use of cookies on our software may result in restricted/impacted functionality, and you may not be able to take full advantage of the service.

We use the following categories of cookies on our sites:

Necessary cookies

These cookies are essential to enable you to browse around our websites and use its features. Without these cookies, functionality related to certain tools and accessing secure areas of the site could not be provided.

Preferences cookies

Also known as “functionality cookies,” these cookies allow a website to remember the choices you have made in the past, like what language you prefer or what your username and password is so that you can automatically log in next time.

Statistical cookies

Also known as “performance cookies,” these cookies collect information about how you use a website, like which pages you visited and which links you clicked on. The purpose of this information is to help understand how users are engaging with the website and to improve website functions.

Operators may also use cookies on our Software. Operators are responsible for notifying you of the cookies they use and how you can control which cookies are enabled.

Links

This Privacy Policy does not apply to third party websites or digital services which may be linked to content published by either Social Pinpoint or the Operator. We recommend you read the privacy statement of the relevant service when you access these third party sites.

How do we use your information?

Customers:

Social Pinpoint may use information it collects (personal or otherwise) in order to:

provide our Services to you
allow you to access our Software
send you updates and information where you have consented or would reasonably expect to receive them
respond to your enquiries
to request your feedback
maintain our licenced Software
for internal record keeping, administrative, invoicing and billing purposes
detect and rectify fraud or other behavior that violates any terms of use
comply with our contractual or legal obligations and resolve any disputes that we may have
conduct de-identified research, analytics and business development
improve our Services, Software and our website
if otherwise required or authorised by law

Users of our Services:

Social Pinpoint may access and use the information collected by the Operator (personal or otherwise) in order to:

allow you to access our Software
respond to your enquiries
maintain our licenced Software
detect and rectify fraud or other behaviour that violates any terms of use
respond to service requests from the Operator
comply with our contractual or legal obligations and resolve any disputes that we may have
monitor sites to ensure adequate safety and security
conduct de-identified research, analytics and business development
improve our Software and services
if otherwise required or authorised by law

How do we protect your information?

Social Pinpoint takes the privacy of your information very seriously, and we use industry standard practices to keep your data safe and secure.

How do we disclose your personal information?

Customers:

In providing the Services, our Software and our website Social Pinpoint may disclose your personal information to:

our third party helpdesk management provider for customer support tickets
our third party email management system to send email updates and notifications
our employees, contractors and/or related entities
our existing or potential agents or business partners
anyone to whom our business or assets (or any part of them) are, or may (in good faith) be, transferred
credit reporting agencies, courts, tribunals and regulatory authorities, in the event you fail to pay for goods or services we have provided to you
courts, tribunals, regulatory authorities and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights
any other third parties as required or permitted by law, such as where we receive a subpoena

Users of our Services:

In providing the Services and our website, Social Pinpoint may disclose your personal information to:

our third party email management system to send email updates and notifications
our third party authentication and authorisation provider for our Software, if enabled
other third party service providers for the management of security, fraud detection, internal logs, basemaps and geocoding services, content moderators, graphic providers, web mapping tools and software which allows for the functionality of a browser
Social media sites when you choose to share content or authenticate your user account through them
any other third parties as required or permitted by law, such as where we receive a subpoena

Contact us

To contact us about our Privacy Policy, compliance with any applicable privacy laws, or to modify or delete your personal data, please email our Privacy Officer at: info@socialpinpoint.com

The Privacy Officer will review all messages received and respond to each message upon due consideration. We may require further information to respond to your message, or may refer you to the Operator when appropriate.

Changes to this Policy

We reserve the right to modify this policy from time to time, at our sole discretion. If we make a material change to the Privacy Policy we will notify you and the modified policy shall be effective once we notify you of the change. If we do not make any material amendments then we will post the modified policy on our website and it shall be effective once posted. We recommend that you regularly check our website to make sure you are aware of our most up-to-date policy.

Appendix 1 – The Privacy Act and the APPs

The Privacy Act and the APPs set out the core requirements for the protection of personal information in Australia. Please read the Privacy Policy above and this Appendix carefully and contact us at the details at the end of the Privacy Policy if you have any questions

How do I access, change or delete my personal information?

In some cases you may be able to access and correct your personal information by logging into your account (if the Software provides this functionality), where you can update your personal details.

You may also request a copy of, changes to, or deletion of, the personal information we hold, and we will act on this request within a reasonable period of time unless we are legally permitted to refuse to do so, in which case we will provide you with details of our refusal in writing.

Before acting on your request we may be contractually required to provide notification to or seek the consent of the Operator.

Social Pinpoint will endeavour to respond to your request or inquiry within 30 days.

How do I make a complaint?

If you wish to make a complaint, please contact us using the details in the contact section above and provide us with full details of the complaint. We will promptly investigate your complaint and respond to you, in writing, setting out the outcome of our investigation and the steps we will take in response to your complaint. If you are not satisfied with our response you also have the right to contact the Office of the Australian Information Commissioner.

Will my personal information be transferred overseas?

Where we disclose your personal information to third parties in our Privacy Policy, these third parties may store, transfer or access personal information outside of Australia, including but not limited to the United States of America and the Philippines.

We will only disclose your personal information to countries with laws which protect your personal information in a way which is substantially similar to the Australian Privacy Principles or we will take such steps as are reasonable in the circumstances to ensure the third party protects your personal information in accordance with the Australian Privacy Principles.

Appendix 2 – The GDPR

Under the GDPR individuals located in the EU have extra rights which apply to their personal information. Personal information under the GDPR is often referred to as personal data and is defined as information relating to an identified or identifiable natural person (individual). This Appendix sets out the additional rights we give to individuals located in the EU when we sign a GDPR compliant data processing agreement with an Operator, including how we process personal information lawfully, transparently and fairly. Please read the Privacy Policy above and this Appendix carefully and contact us at the details at the end of the Privacy Policy if you have any questions.

What personal information is relevant?

This Appendix applies to the personal information set out in the Privacy Policy above where we sign a GDPR compliant data processing agreement with an Operator. This includes any sensitive information also listed in the Privacy Policy above which is known as ‘special categories of data’ under the GDPR.

Our commitment to you

Your personal information will:

be processed lawfully, fairly and in a transparent manner by us;
only be collected for the specific purposes we have identified in the ‘collection and use of personal information’ clause above and personal information will not be further processed in a manner that is incompatible with the purposes we have identified;
be collected in a way that is adequate, relevant and limited to what is necessary in relation to the purpose for which the personal information is processed;
be kept up to date, where it is possible and within our control to do so (please let us know if you would like us to rectify any of your personal information);
be kept in a form which permits us to identify you, but only for so long as necessary for the purposes for which the personal information was collected or required by an applicable controller; and
be processed securely and in a way that protects against unauthorised or unlawful processing and against accidental loss, destruction or damage.

How do we process personal information?

If the GDPR applies and we act as a controller, we must have a legal basis to process your personal information. We will process your personal information in accordance with the following legal bases:

Legitimate interests: We will process your personal information for our legitimate interests to allow you to access and use our website, to send you marketing content we think may be of interest to you, to contact you if you leave your contact details with us or if you otherwise initiate contact with us, to review and improve our Services and for our internal business purposes.
Performing a contract: We will rely on performing a contract to process your personal information where we are preparing to enter into a contract with you or we are carrying out our obligations under a contract with you, including where you have entered into a contract with us for our Services or the licensing of our Software.
Legal obligation: We will rely on a legal obligation to process your personal information where we are subject to a legal obligation, including to respond to any illegal activity and for taxation purposes.
Consent: If we need to rely on consent, we will ask for consent to process any of your personal information for that specific purpose before we process your personal information for that purpose.

Upon written request, we may provide you with a list of the third parties we use to process your personal information and the locations of those third parties.

Data retention

If the GDPR applies or we have signed a GDPR compliant data processing agreement, and we act as a processor:

We will only retain your personal information in accordance with the controller’s instructions and we will delete or return your personal information to the controller in accordance with the terms of the applicable data processing agreement.

If the GDPR applies and we act as a controller:

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information, whether we can achieve those purposes through other means and the applicable legal requirements.

In some circumstances you can ask us to delete your data: see ‘access, erasure and data portability’ below for further information.

In some circumstances we may anonymise your personal information (so that it can no longer be associated with you) for analytics, research or statistical purposes in which case we may use this anonymised information indefinitely without further notice to you.

Data transfers

The countries to which we send data for the purposes listed above may not have the same data protection laws as the country in which you initially provided the information. If we transfer your personal information to third parties in other countries:

we will perform those transfers in accordance with the requirements of the GDPR (for example, by using the Standard Contractual Clauses as a safeguard); and
we will protect the transferred personal information in accordance with the Privacy Policy, as supplemented by this Appendix.

Countries to which we may transfer personal data include Australia, the Philippines and the United States of America.

Extra rights for EU individuals

Objecting to processing:

You have the right to object to processing of your personal information that is based on our legitimate interests or public interest. If this is done, we must provide compelling legitimate grounds for the processing which overrides your interests, rights and freedoms, in order to proceed with the processing of your personal information.

Restricting processing:

You have the right to request that we restrict the processing of your personal information if:

you are concerned about the accuracy of your personal information
you believe your personal information has been unlawfully processed
you need us to maintain the personal information solely for the purpose of a legal claim
we are in the process of considering your objection in relation to processing on the basis of legitimate interests

Access, erasure and data portability:

You may have the right to request details of the personal information we hold about you, or to request that we erase the personal information we hold about you, or that we transfer this information to a third party.

Rectification:

If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us using the details below. We will take reasonable steps to promptly correct any information found to be inaccurate, incomplete, misleading or out of date.

Note that if we are acting as a processor of your personal information, before acting on a rights request we will need to seek the instructions of the relevant Operator.

If the GDPR applies and we act as a controller of your personal information, we will endeavour to respond to your request or inquiry within 30 days.

Social Pinpoint

Security Statement

Security Policies

Compliance

Information Security

Privacy

Technical review

Data Hosting and Physical Security

Personnel Security

Asset Management

Access Control

Administration

Server access

User and role based access

User passwords

Managing user access

Encryption

Data in-transit

Data at-rest

Software Development

Backup and Recovery

Logging, Monitoring and Availability

Logging

Monitoring

Availability

Information Security Incident Management

Additional information

The HiVE is a complete community engagement solution that supports you in the online participation process, broadens your reach and informs better decision making.

Company

LEGAL

Software

Resources

Support

Participation tools