Privacy Policy

1. Overview

This Privacy Policy explains how KWICKSHOP PTY LTD ("Kwickshop", "we", "us" or "our") handles information through Kwickshop Lead CRM.

The CRM is an internal business application for authorised Kwickshop staff. It supports customer enquiries, finance applications, follow-up tasks, internal notes, staff communication, reporting and shared business email functionality.

2. Information handled by the CRM

The CRM may handle information entered by customers, staff or connected business systems, including:

• customer names, email addresses, telephone numbers and addresses;
• lead source, product enquiry and finance application information;
• application documents and attachments supplied for business processing;
• staff assignments, notes, reminders, status changes, finance outcomes and activity history;
• internal staff messages and account activity;
• technical information required to operate, secure and troubleshoot the service.

3. Google Gmail API data

When an authorised Kwickshop administrator connects the shared sales mailbox, the CRM uses Google OAuth and Gmail API permissions to provide email functionality inside the CRM. The connected mailbox is used only for authorised Kwickshop business communication.

The CRM requests the following Gmail scopes and uses them only for these staff-facing functions:

• gmail.modify: display and search mailbox messages and folders; open message threads, including message bodies, headers, participants and attachments; compose, send, reply, forward and save drafts; apply labels; and change message status such as read, archived, Spam or Trash.
• gmail.settings.basic: display and update the connected shared mailbox's approved send-as identity and business email signature. The CRM does not use this scope to manage unrelated Google Account settings.

Google user data is used only to provide and improve the user-facing CRM email functions requested by authorised Kwickshop staff. We do not use Google user data for advertising, sell it, or use it to train general-purpose artificial intelligence or machine-learning models. We do not transfer Google user data to third-party AI or machine-learning services for training.

The CRM may create internal, aggregated operational information such as message counts, queue status and activity reports. Those summaries do not include the body of a Gmail message. Raw Gmail content is handled only where it is needed to display or perform an authorised CRM email function.

4. How information is used

We use information handled by the CRM to:

• respond to customer enquiries and manage sales and finance workflows;
• send and organise authorised business communications;
• assign work, schedule follow-ups and maintain an activity history;
• produce internal operational and staff-performance reports;
• protect the CRM, detect misuse and investigate technical problems;
• meet legal, regulatory, audit and record-keeping obligations.

5. Storage and security

The CRM operates on Kwickshop-controlled hosting and connected service infrastructure. Information may be stored in the CRM database, server file storage, system logs and connected Google services where necessary to provide the requested feature.

OAuth access and refresh tokens are encrypted before storage. Temporary Gmail mailbox and conversation caches are stored in private, non-public locations with restrictive file permissions. Access is limited through user authentication, role-based permissions and administrative controls. Staff are required to protect login credentials and access customer information only for authorised business purposes.

No internet or storage system is completely secure. We use reasonable administrative, technical and organisational safeguards appropriate to the nature of the information and the internal business use of the CRM.

6. Sharing and disclosure

We do not sell personal information or Google user data. Google Gmail content is not disclosed to finance, delivery or other business partners by the CRM. An authorised staff member may send a business email to a recipient when that staff member chooses to do so through the CRM.

Information may otherwise be disclosed only where reasonably necessary:

• to authorised Kwickshop staff and contractors who require access for their work;
• to hosting, email, security or technical service providers acting for Kwickshop;
• to finance, delivery or other business partners where required to process a customer request and permitted by law, using the relevant customer information rather than transferring Gmail API data as a separate product or service;
• to comply with law, legal process, regulator requests or to protect rights, safety and security.

Service providers are expected to handle information only for the services they provide to Kwickshop and in accordance with applicable obligations.

7. Retention and deletion

Information is retained for as long as reasonably required for customer service, lead management, finance processing, audit, security, dispute resolution and legal obligations. Retention periods may vary by information type and business purpose.

Gmail message-list metadata is cached temporarily to improve the CRM mailbox interface. Full Gmail conversation and message caches are treated as temporary and are removed after their short cache lifetime (normally no more than two hours). Messages and mailbox information remain subject to the retention and deletion controls of the connected Gmail account.

Disconnecting the Gmail integration revokes the connection where possible and removes stored OAuth tokens and CRM Gmail cache entries. CRM records, attachments and audit history may be removed when no longer required or when an authorised administrator performs an approved deletion, subject to legal and business record-keeping obligations.

8. Access, correction and choices

Authorised users can ask Kwickshop to review, correct or delete information where applicable. Access to Google data can also be revoked through the connected Google Account's security settings or by an authorised administrator disconnecting the Gmail integration in the CRM.

Some information may need to be retained where required by law, for legitimate business records, fraud prevention, security or dispute handling.

9. Changes to this policy

We may update this Privacy Policy when the CRM, connected services or legal requirements change. The effective date at the top of this page will be updated when material changes are published.

10. Contact

For questions about this policy, Google data access, or a privacy request, contact:

KWICKSHOP PTY LTD
Email: sales@kwickshop.com.au
CRM information page: https://crm.kwickshop.com.au/about.php