Privacy Policy

Privacy at a glance

This summary is for convenience only. The full Privacy Policy below is legally binding.

Our role: We're a controller when you sign up, use our website, or interact with us; we're a processor when customers use our platform to process User Data under our DPA.

What we collect: Contact and account details, usage/technical analytics, and payment details (if you purchase), plus recruiting and event data where relevant.

How we collect it: From you directly, from partners/co-marketing, public sources, and third parties that help us run our business.

Why we use it: To deliver and operate the platform, improve products and websites, manage billing/contracts, support relationships, recruit, and meet legal obligations.

Who we share it with: Our affiliates, partners, and trusted service providers/sub-processors that support hosting, security, communications, CRM/billing, automation, meetings, and analytics.

International transfers: We transfer personal data internationally using Standard Contractual Clauses (SCCs) for EEA transfers, the UK Addendum for UK transfers, Swiss-modified SCCs for Switzerland, standard contractual clauses for Canada, and contractual safeguards consistent with the Australian Privacy Principles for APAC and other jurisdictions. California residents' data is handled in accordance with the CCPA, under which 6clicks acts as a Service Provider.

Your choices and rights: You can control cookies in your browser, unsubscribe from marketing, and request access/correction/deletion, restriction/objection/portability, or withdraw consent (where applicable).

Questions or complaints: Email our Data Protection Point of Contact at privacy@6clicks.com - we generally respond quickly and aim to resolve complaints promptly.

6clicks’ commitment to privacy

6clicks Trading Pty Ltd ACN 634 263 166 and its subsidiaries and affiliates in Australia, the United Kingdom, the United States of America, and other jurisdictions globally (6clicks) take your privacy seriously and are committed to responsible privacy practices.

This document referred to as our Privacy Policy describes how 6clicks manages your personal data including details of what types of personal data 6clicks collects, how 6clicks collects your personal data, the purposes for which 6clicks uses your personal data and to whom your personal data is disclosed.

In this Privacy Policy, "we" and "us" refers to 6clicks and "you" refers to any individual about whom we collect personal data. Terms not otherwise defined in this Privacy Policy have the meaning given to them in the 6clicks EULA General Terms.

6clicks Trading Pty Ltd ACN 634 263 166 and its subsidiaries and affiliates in Australia, the United Kingdom and the United States of America (6clicks) take your privacy seriously and are committed to responsible privacy practices.

This document referred to as our Privacy Policy describes how 6clicks manages your personal data including details of what types of personal data 6clicks collects, how 6clicks collects your personal data, the purposes for which 6clicks uses your personal data and to whom your personal data is disclosed. In this Privacy Policy, "we" and "us" refers to 6clicks and "you" refers to any individual about whom we collect personal data. Terms not otherwise defined in this Privacy Policy have the meaning given to them in the 6clicks EULA General Terms.

6clicks’ roles

6clicks acts in different ways when processing data:

6clicks acts as a controller of your personal data when you sign up for our products and services, visit our website or interact with us through other channels (for example in person events). We use this data for a variety of purposes, including to provide our products and services to you, contact you about relevant content, and improve and promote our products and services;
6clicks acts as a processor when our customers use our products and services to collect and process personal data in connection with their business activities. In this case, we act as a processor (or service provider) on behalf of our customers (who are controllers of personal data) under the 6clicks Data Processing Agreement published on our website and included in the EULA General Terms; and
6clicks also acts as a controller when we collect and process personal data about individuals in their professional capacity, and make that information available to customers for their own business activities. This includes personal data we may collect indirectly about you, such as from publicly available sources, our customers, or other third parties. For more information see the “What types of personal data do we collect?” section below.

What is personal data?

In this Privacy Policy, “personal data” means any information relating to an identified or identifiable individual.

What types of personal data do we collect?

The types of personal data 6clicks collects about you will depend on the purpose for which the information is collected.

Customers and users of our products and services

6clicks may collect the following types of personal data:

first name and last name;
email address;
job title;
associated risk and compliance activity data (such as assessments, questionnaires, audit records, and compliance summaries submitted or generated via the Platform);
usage and interaction data such as metrics, clicks, scrolls, page views, and navigation paths;
session identifiers and IP addresses arising from your use of 6clicks' websites or products;
your mobile phone information (such as model, version and operating system) where you access our products and services via your mobile phone);
payment information (where you register for paid products/services);
testimonials or comments you provide us for our website;
AI-generated outputs derived from your data, including risk assessments, compliance summaries, meeting transcriptions, and action items generated via the Hailey AI feature; and
voice recordings and meeting notes where you participate in calls or meetings that are recorded using tools such as Fireflies.ai, which may include participant names, voice recordings, and meeting content.

Like most websites and technology services delivered over the internet, 6clicks also collects general analytics and other technical information (such as your IP address, device type, unique device identification numbers, browser types, Internet Service Provider details, geolocation data, browsing preferences, searches, and usage of 6clicks’ websites or products) arising from your use of 6clicks’ websites or products.

Information we collect from other sources

We may receive information about you, or users of your 6clicks account (if applicable), from our global network of partners. We may receive this data through a number of ways, including through our deal and lead registration processes.

We may also collect information about you through our partner co-marketing partnerships. For example, you may sign up to a webinar or download a white paper published by 6clicks and a 6clicks co-marketing partner.

6clicks may collect personal data about other individuals who are not customers of 6clicks. This includes customers and members of the public who participate in events we are involved with; individual service providers and contractors to 6clicks; and other individuals who interact with 6clicks on a commercial basis.

The kinds of personal data we collect will depend on the capacity in which you are dealing with 6clicks. If you are participating in an event we are managing or delivering, we may take images or audio-visual recordings which identify you.

Information we process of behalf of our customers

When our customers use our products they may process personal data such as first and last name, email address, job title, physical address, phone number, or other information about you. We call the information that our customers submit or collect via the product ‘User Data’ under our EULA General Terms.

6clicks generally stores and processes information about and on behalf of our customers on our servers as a processor (or service provider) and in accordance with our EULA General Terms and 6clicks Data Processing Agreement. Customers, as controllers of personal data, are solely responsible for: (a) establishing and maintaining a lawful basis for the processing of personal data before transferring it to 6clicks; (b) obtaining all required consents from individuals whose data is to be processed; (c) providing all required notices to those individuals; and (d) complying with all applicable privacy and data protection laws in respect of the personal data they submit to the Platform. 6clicks processes such data only on the instructions of the customer and in accordance with the DPA.

Prospective employees/applicants

We collect personal data when recruiting personnel, such as your name, contact details, qualifications and work history. Generally, we will collect this information directly from you. We may also collect personal data from third parties in ways which you would expect (for example, from recruitment agencies or referees you have nominated). Before offering you a position, we may collect additional details such as your tax file number and pension/superannuation information (or their equivalent in your jurisdiction) and other information necessary to conduct background checks to determine your suitability for certain positions.

Visitors to our website

The way in which we handle the personal data of visitors to our websites is discussed below.

How do we collect Personal Data?

Often 6clicks will collect your personal data directly from you, including when you:

use 6clicks’ website, products or services;
apply to work with 6clicks or are engaged by 6clicks as a contractor/supplier;
communicate with 6clicks by email, by telephone, in person, via a website or otherwise.
6clicks partners;
our affiliated and related companies;
publicly available sources;
third party entities who assist us in operating our business (including Sub-Processors as set out in Annexure 3 of the 6clicks Data Processing Agreement); and
other third parties (for example, from referees if you apply for a position as an employee or contractor with us).

In some cases 6clicks may also collect personal data from:

6clicks also collects and uses personal data for market research purposes and to innovate our delivery of products and services.

Why do we collect, use and disclose personal data?

6clicks collects personal data reasonably necessary to carry out our business, to assess and manage our customers' needs, and provide services including our governance risk and compliance solution. We may also collect information to fulfil administrative functions associated with these services, for example billing, entering into contracts with you and/or third parties and managing customer relationships.

6clicks will only collect, use, and disclose personal data about you if it has lawful basis to do so, for example:

where you have given 6clicks your consent. For the purposes of this Privacy Policy consent means consent that is voluntary, informed, current, specific, and unambiguous. Consent must be a clear affirmative act; silence, pre-ticked boxes, or inactivity do not constitute consent;
where processing of your personal data is necessary for the performance of a contract with you such as the EULA General Terms in connection with the Subscription Scope;
to meet 6clicks’ legal obligations; and
to pursue 6clicks’ legitimate business interests.
for the purposes for which 6clicks collected it (and related purposes which would be reasonably expected by you);
for other purposes to which you have consented; and
as otherwise authorized or required by law.
to provide its products and services to its users;
to enable the proper operation and functionality of its products and services;
to improve its products and services;
to verify your identity (for example, if you request access to the personal data 6clicks holds about you);
to consider you for a job at 6clicks (whether as an employee or contractor) or other relationships with 6clicks;
to provide goods or services to you or to receive goods or services from you;
to address any issues or complaints that 6clicks has or you have regarding our relationship;
to comply with its legal obligations;
to develop and improve the quality of its websites and products and customize its websites and products according to your preferences, tailor search results, and show relevant advertising;
for direct marketing purposes (see the “Direct marketing” section below); and
to contact you regarding the above, including via electronic messaging such as SMS and email, by mail, by phone or in any other lawful manner.

6clicks may use or disclose your personal data:

Some of the specific purposes for which 6clicks collects, uses and discloses personal data are as follows:

If 6clicks is unable to collect your personal data then 6clicks may not be able to provide you with the products, services and opportunities that depend on the collection of that information.

To whom do we disclose personal data?

6clicks may disclose your personal data to third parties in connection with the purposes described above.

This may include disclosing your personal data to the following types of third parties:

6clicks related or affiliated companies;
6clicks partners such as our resellers, referrers, and advisors;
third party service providers we use to support our websites, products, and services;
Sub-Processors as set out in Annexure 3 of the DPA;
managed service providers (MSPs) and resellers who sub-license or resell the 6clicks Platform to their own end customers, where 6clicks acts as processor and the MSP or reseller acts as controller or processor in respect of those end customers' data. End customers who access the Platform through an MSP or reseller should refer to that MSP's or reseller's own privacy terms as their primary point of contact. 6clicks processes data in those arrangements solely in accordance with the instructions of the MSP or reseller under the applicable Data Processing Agreement;
any potential third party acquirer of 6clicks or its business or assets, and advisors to that third party;
its professional advisers (such as lawyers, accountants or auditors) and insurers;
its employees, contractors and third party service providers who assist 6clicks in performing its functions and activities e.g. payment systems operators and financial institutions, cloud service providers, data storage providers, telecommunications providers and IT support services providers;
organizations authorized by 6clicks to conduct promotional, research or marketing activities;
third parties to whom you have authorized 6clicks to disclose your information (e.g. referees); and
any other person as required or permitted by law.

6clicks will ensure that all sub-processors and third parties to whom personal data is disclosed are bound by data protection obligations at least equivalent to those contained in the 6clicks Data Processing Agreement, including obligations regarding security, confidentiality, and restrictions on further processing. 6clicks remains liable to customers for the acts and omissions of its sub-processors to the extent provided in the DPA.

How does 6clicks interact with you via the internet?

You may visit our websites (https://www.6clicks.com/) without identifying yourself. If you identify yourself (for example, by providing your contact details in an enquiry), any personal data you provide to 6clicks will be managed in accordance with this Privacy Policy.

6clicks' websites use cookies. A "cookie" is a small file stored on your computer's browser, which assists in managing customized settings of the website and delivering content. We collect certain information such as your device type, browser type, IP address, pages you have accessed on our websites and on third-party websites. Some of this information, including IP addresses and device identifiers, may constitute personal data when combined with other information we hold about you.

You can use the settings in your browser to control how your browser deals with cookies. However, in doing so, you may be unable to access certain pages or content on our website.

We use the following categories of cookies: (a) Essential cookies, which are necessary for the website to function and cannot be switched off; (b) Functional cookies, which enable enhanced functionality and personalization; (c) Analytics cookies, which allow us to count visits and traffic sources to measure and improve website performance (including through tools such as Microsoft Clarity, which records session interactions including clicks, scrolls, and navigation paths); and (d) Advertising cookies, which may be set by our advertising partners to build a profile of your interests.

We obtain your consent for non-essential cookies (categories (b), (c), and (d)) in accordance with applicable law, including applicable US state privacy laws and EU/UK cookie consent requirements. You may withdraw or update your cookie consent at any time through the cookie preference center on our website.

6clicks' websites may contain links to third-party websites. 6clicks is not responsible for the content or privacy practices of websites that are linked to our website.

Can you deal with 6clicks anonymously?

6clicks will provide individuals with the opportunity of remaining anonymous or using a pseudonym in their dealings with us where it is lawful and practicable (for example, when making a general enquiry). Generally, it is not practicable for 6clicks to deal with individuals anonymously or pseudonymously on an ongoing basis. If we do not collect personal data about you, you may be unable to utilize our services or participate in our events, programs or activities we manage or deliver.

Do we disclose your personal data overseas?

International transfers within the 6clicks group

To facilitate our global operations, we may transfer information that may include personal data to other 6clicks affiliates or related companies who act as sub-processors, where we have operations for the purposes described in this Privacy Policy. This Privacy Policy will apply even if we transfer personal data to other countries. We have taken appropriate safeguards to require that your personal data will remain protected wherever it is transferred.

The following summarizes the transfer mechanisms we rely on by jurisdiction, distinguishing between transfers where 6clicks acts as a controller (for example, intra-group transfers of employee or website visitor data) and transfers where 6clicks acts as a processor (for example, transfers of Customer Personal Data to sub-processors):

European Economic Area (EEA): Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by a Transfer Impact Assessment (TIA) where required.
United Kingdom: UK Addendum to the SCCs, approved by the UK Information Commissioner's Office (ICO).
Switzerland: SCCs as modified to reflect Swiss law and the jurisdiction of Swiss courts, in accordance with the Swiss Federal Act on Data Protection (Swiss DPA).
Canada: Standard contractual clauses for transfers to or from Canada. 6clicks is also subject to the regulatory oversight of the Office of the Privacy Commissioner of Canada in respect of data received from or transferred to Canada.
APAC and other jurisdictions: Where personal information is disclosed to recipients in countries without equivalent data protection laws, 6clicks takes reasonable steps to ensure the recipient handles the information in accordance with the Australian Privacy Principles (APP 8, Privacy Act 1988 (Cth)), including through contractual safeguards.

We also have additional safeguards where appropriate, including commercial industry standard secure encryption methods to protect customer data at rest and in transit, TLS for 6clicks hosted sites, web application firewall protection, and other appropriate contractual and organizational measures, as described in more detail in the 6clicks Knowledge Base.

International transfers to third parties

Some of the third parties described in this Privacy Policy, which provide services to us under contract, are based in other countries that may not have equivalent privacy and data protection laws to the country in which you reside. Some of these providers are located overseas, including in the United States, European Union, and other jurisdictions. Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled in accordance with the Australian Privacy Principles, including through contractual safeguards.

When we share personal data of individuals in the EEA, Switzerland or UK with third parties as part of our sub-processor arrangements, we use Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by a Transfer Impact Assessment (TIA) where required. For transfers to or from the United Kingdom, we use the UK Addendum to the SCCs approved by the UK Information Commissioner's Office. For transfers to or from Switzerland, we use SCCs as modified to reflect Swiss law in accordance with the Swiss Federal Act on Data Protection (Swiss DPA). Where 6clicks acts as controller in relation to intra-group transfers, we rely on the same mechanisms as set out above. Note: the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses are distinct transfer mechanisms. Where a sub-processor participates in the DPF, that participation may be relied upon as a separate or supplementary transfer basis in addition to SCCs.

For transfers to or from Canada, we use standard contractual clauses and 6clicks is subject to the regulatory enforcement powers of the Office of the Privacy Commissioner of Canada.

Applicable US State Privacy Laws: When 6clicks processes personal information of US residents on behalf of a customer, 6clicks acts as a Service Provider (or equivalent role under applicable state law) and processes that information solely for the Business Purpose described in the applicable Data Processing Agreement. 6clicks does not sell or share such personal information and does not use it for any purpose other than performing services for the customer.

Under the California Consumer Privacy Act (CCPA) and other applicable US state privacy laws (including those in Virginia, Colorado, Connecticut, Texas, and other states with enacted privacy legislation), individuals may have the right to know what personal information is collected, the right to request deletion, the right to opt out of sale or sharing (which does not apply to 6clicks as a Service Provider), and the right to non-discrimination for exercising these rights. These rights apply to the extent provided under the laws of the relevant state.

How do we protect your personal data?

6clicks uses a variety of security technologies and procedures to help protect your personal data from unauthorized access, use or disclosure. We secure the personal data you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use or disclosure. All personal data is protected using appropriate physical, technical and organizational measures. 6clicks maintains certification to ISO/IEC 27001 (Information Security Management) and ISO/IEC 42001 (AI Management System). For customers in the Australian Government sector, 6clicks also maintains an IRAP (Information Security Registered Assessors Program) assessment. For more on security at 6clicks please refer to Annexure 2 of our Data Processing Agreement and our security documents and certifications available within the 6clicks Knowledge Base.

6clicks engages service providers (sub-processors) to facilitate the delivery of our products and services including the storing of your personal data, including Microsoft Azure and Azure Storage.

6clicks recommends that you review these companies' privacy policies to understand how they use and store your personal data. For more information regarding our sub-processors please refer to Annexure 3 of our Data Processing Agreement or the following section.

6clicks will provide reasonable assistance to customers (as controllers) in conducting Data Protection Impact Assessments (DPIAs) where required under applicable law. Such assistance may include providing relevant security documentation, ISO certifications, completed questionnaires, and responses to reasonable information requests. For the avoidance of doubt, this obligation is one of assistance to the customer as controller; 6clicks is not responsible for conducting DPIAs on the customer's behalf.

In the event of a personal data breach, 6clicks' obligations differ depending on its role:

Where 6clicks acts as a processor: 6clicks will notify the affected customer without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting Company Personal Data. A full written incident report will be provided to the customer within 14 calendar days of the initial notification. 6clicks will provide reasonable cooperation and assistance to customers in meeting their own breach notification obligations to regulators and affected individuals.
Where 6clicks acts as a controller: 6clicks will comply with the notification obligations applicable in each relevant jurisdiction, including: notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable following completion of its assessment under the Notifiable Data Breach scheme (Part IIIC of the Privacy Act 1988 (Cth)), with all reasonable steps taken to complete that assessment within 30 days; and notifying the relevant supervisory authority within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals, as required under Article 33 of the UK GDPR and EU GDPR and equivalent regimes in other jurisdictions.

In all cases, where required by applicable law, 6clicks will also notify affected individuals directly.

Third-Party Service Providers and Analytics

We engage trusted third-party service providers to support our operations and deliver services. These providers may process limited personal information on our behalf for specific purposes, as outlined below:

Hosting and Infrastructure

Microsoft Azure – Provides cloud hosting and infrastructure services for our platform.
Google reCAPTCHA – Helps prevent spam and abuse in form submissions.
Cloudflare – Provides web infrastructure, content delivery, and security services.
DocuSign – Enables electronic signature functionality.
Twilio (SendGrid) – Facilitates email notifications.
HubSpot – Supports customer relationship management.
Maxio – Handles invoicing and revenue tracking.
Workato – Provides workflow automation.
Fireflies.ai – Records and transcribes calls for meeting notes and action tracking. This may include participant names, voice recordings, and meeting notes.
Notion – Used for internal documentation and project management. This may include participant names and project-related content.
Microsoft Clarity – Collects information about how visitors interact with our websites, including clicks, scrolls, navigation paths, and technical details such as device type, browser information, IP address, and session identifiers. We use this data to improve website functionality and user experience. Microsoft may process this information on our behalf in locations outside Australia. Clarity is configured to avoid capturing sensitive content and excludes authenticated areas where appropriate.
the categories of personal data that may be used in automated decision-making include account details, usage and interaction data, risk and compliance activity data, and AI-generated outputs as described in the "What types of personal data do we collect?" section above;
where 6clicks acts as a controller (for example, in relation to its own internal operations and marketing activities), automated systems may play a substantial and direct role in assisting human decision-making (Hailey and similar AI tools are assistive decision-support systems, not autonomous decision-makers), and final decisions remain with the relevant human;
where 6clicks acts as a processor, it is the customer (as controller) who directs the use of the platform's AI features and who makes or takes responsibility for decisions made using those features. 6clicks will not make decisions based solely on automated processing of Company Personal Data without the customer's prior documented instructions, consistent with the DPA; and
where an automated decision made by 6clicks in its controller capacity could significantly affect your rights or interests, you may request that a human review that decision by contacting 6clicks as described in the "How to contact us" section below.

Security and Website Functionality

Electronic Signatures and Communications

Customer Relationship Management and Billing

Meeting and Documentation Tools

Code Repository and Development

GitHub, Inc. (Microsoft) – Hosts 6clicks' code repositories and supports software development. Located in the United States.
OpenAI (Azure Hosted) – Provides the AI engine and model inference capability underpinning the Hailey AI feature, hosted within Microsoft Azure infrastructure on a region-specific basis aligned to the operational platform. 6clicks contractually prohibits OpenAI from using any Company Personal Data or User Data to train, fine-tune, develop, or improve any AI or machine learning model. Located in the United States.
Anthropic, PBC – Used for internal operational activities and development tooling. Located in the United States.
Export Window: upon termination or expiry of the agreement, customers have a 30-day window from the cessation date to export their data from the Platform.
Deletion: following expiry of the Export Window, 6clicks will delete all copies of Company Personal Data (including copies held by sub-processors) within 10 business days and will, on request, provide written certification of that deletion.
Retention carve-outs: 6clicks may retain data for longer where required by applicable law, regulation, or court order, or as necessary to maintain backup integrity or disaster recovery systems, in which case the retained data is isolated, not used for any other purpose, and deleted as soon as the retention obligation expires.
No AI training on your data: 6clicks does not use, and contractually prohibits its sub-processors (including AI inference providers such as OpenAI (Azure Hosted) and meeting/recording tools such as Fireflies.ai) from using, Company Personal Data or User Data to train, fine-tune, develop, or improve any AI or machine learning model. This prohibition applies to Company Personal Data and User Data in identifiable form, and does not extend to data that has been genuinely anonymized or de-identified in accordance with applicable Data Protection Laws, provided it cannot reasonably be used to identify a natural person or the Company.
Permitted analytics: 6clicks may use aggregated, de-identified, and anonymized usage data derived from the Platform to improve platform functionality and perform analytics. This does not constitute AI model training and does not involve personal data in identifiable form. Session and interaction data collected via tools such as Microsoft Clarity is used solely for website improvement purposes and is subject to the same prohibition on AI model training.
AI output is not professional advice. Output generated by AI or Generative AI features on the Platform is provided for informational purposes only and does not constitute legal, financial, compliance, or other professional advice. Users are responsible for independently verifying AI output before relying on it.
Co-Mingled Data. Where AI output is generated using a combination of 6clicks content and User Data (Co-Mingled Data), 6clicks retains all intellectual property rights in the underlying platform content and templates. The customer retains ownership of the User Data input and receives an irrevocable, non-exclusive licence to use the resulting output for the purposes contemplated by the EULA General Terms.

AI Engine and Model Inference

Internal Operational Activities and Development Tooling

Website Analytics

Sub-processors may be added or changed from time to time. Where 6clicks proposes to add a new sub-processor or make a material change to an existing sub-processor arrangement, 6clicks will provide at least 45 days' prior written notice before the change takes effect. For more information regarding our sub-processors please refer to Annexure 3 of our Data Processing Agreement.

Direct Marketing

6clicks may use and disclose your personal data for the purpose of direct marketing to you where permitted by law, including where you have consented to 6clicks doing so. You may opt out of direct marketing communications from 6clicks at any time, without condition, by using the unsubscribe mechanism in any marketing communication or by contacting 6clicks as described in the "How to contact us" section below. 6clicks will give effect to your opt-out promptly.

Direct marketing involves communicating directly with you for the purpose of promoting goods or services, upcoming promotions and events, or other opportunities that may interest you. Direct marketing can be delivered by a range of methods including mail, telephone, email or SMS.

Targeted and interest-based advertising

In addition to direct marketing, 6clicks may engage in targeted or interest-based advertising using cookies and similar tracking technologies on our websites. This type of advertising is distinct from direct marketing and is governed by our cookie consent process described in the "How does 6clicks interact with you via the internet?" section above. You may opt out of interest-based advertising at any time through your cookie preferences or by using browser-based opt-out tools where available. Where applicable US state privacy laws or other laws treat targeted advertising as requiring a separate opt-out or consent, 6clicks will comply with those requirements.

You can unsubscribe from 6clicks’ direct marketing, or change your contact preferences, by contacting 6clicks (see the “How to contact us” section below).

How long do we keep your Personal Data?

Generally, 6clicks will retain your personal data where we have an ongoing legitimate business need to do so (for example, as needed to comply with our legal obligations, resolve disputes and enforce our agreements) unless a longer retention period is required by law.

If you have elected to receive marketing communications from us, we retain information about your marketing preferences for a reasonable period of time from the date you last expressed interest in our content, products, or services, such as when you last opened an email from us or ceased using your 6clicks account. We retain information derived from cookies and other tracking technologies for a reasonable period of time from the date such information was created.

The data we process on behalf of customers in connection with the Subscription Scope is stored and secured according to the 6clicks EULA General Terms and the 6clicks Data Processing Agreement.

For personal data processed on behalf of customers, the following specific timelines apply upon termination or expiry of the agreement:

6clicks may retain your personal data for a longer period of time if it is reasonably necessary to comply with 6clicks’ legal obligations, resolve a dispute or maintain security.

When personal data is no longer required, 6clicks will take reasonable steps to delete the personal data from 6clicks’ systems or de-identify the personal data. We will delete this information at an earlier date if you request, as described in the "Your Rights and Choices" section.

AI and Generative AI — How We Handle Your Data

6clicks uses artificial intelligence (AI) and generative AI features within the Platform, including the Hailey AI feature. The following principles govern how personal data and customer data interact with those features:

Automated Decision-Making: 6clicks uses automated systems, including the Hailey AI feature, that may substantially assist in making decisions using personal data. In compliance with the Privacy and Other Legislation Amendment Act 2024 (Cth), 6clicks discloses the following:

Your Rights and Choices

Depending on your location and applicable laws, you may have the following data protection rights:

Access, Correction or Deletion: You can request access, correction, updates or deletion of your personal data. The right to request deletion (erasure) applies where the personal data is no longer necessary for the purpose for which it was collected, where you have withdrawn your consent and there is no other lawful basis for processing, or where you object to processing and there are no overriding legitimate grounds. Deletion requests are subject to the following carve-outs: (a) where retention is required to comply with a legal obligation; (b) where the data is required to resolve a dispute or enforce an agreement; or (c) where retention is necessary to maintain backup integrity or disaster recovery systems, in which case the retained data is isolated and deleted as soon as the retention obligation expires. These carve-outs mirror those in the "How long do we keep your Personal Data?" section above;
Objection or Restriction: You can object to our processing of your personal data, ask us to restrict processing of your personal data or request portability of your personal data; and
Withdraw Consent. If we have collected and processed your personal data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent.

How you can access and seek correction of your Personal Data?

We will take reasonable steps to ensure that the personal data we collect, use or disclose is accurate, complete and up-to-date. You can help us to do this by letting us know if you notice errors or discrepancies in information we hold about you and letting us know if your personal details change.

However, if you consider any personal data we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading you are entitled to request correction of the information. Please contact 6clicks as described in the “How to contact us” section below. After receiving a request from you, we will take reasonable steps to correct your information.

You may seek access to personal data 6clicks holds about you by contacting 6clicks as described in the “How to contact us” section below.

6clicks will provide access to that information in accordance with applicable legal requirements, subject to certain exemptions which may apply. 6clicks may require that the person requesting access provide suitable identification and where permitted by law 6clicks may charge a fee for giving access to your personal data.

If you’d like your information to be removed from our commercial dataset, or would like to opt out from the sharing of your Personal Data for our advertising and marketing activities, please contact 6clicks as described in the “How to contact us” section below.

How can you complain about a privacy issue?

You may make a privacy complaint in relation to personal data 6clicks holds about you by contacting 6clicks as described in the “How to contact us” section below.

If you make a privacy complaint, 6clicks' Data Protection Point of Contact or another suitable staff member of 6clicks will investigate the matter and attempt to resolve it as soon as reasonably possible.

The 6clicks Data Protection Point of Contact will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. We will generally respond to your complaint within a week.

If your complaint requires more detailed consideration or investigation, we will acknowledge receipt of your complaint within a week and endeavor to complete our investigation into your complaint promptly. We may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents and speak with individuals involved.

In most cases, we will investigate and respond to a complaint within 30 days of receipt of the complaint. If the matter is more complex or our investigation may take longer, we will let you know.

If you consider your privacy concerns have not been resolved satisfactorily by 6clicks, or you wish to obtain more information on privacy requirements:

you can contact the Office of the Australian Information Commissioner on 1300 363 992 or visit their website at https://www.oaic.gov.au/; and
if you are located in the European Union, you can contact your local data protection authority: https://edpb.europa.eu/about-edpb/board/members_en;
if you are located in the United Kingdom, you can contact the Information Commissioner's Office (ICO) at https://ico.org.uk/ or by calling 0303 123 1113;
if you are located in Canada, you can contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/ or by calling 1-800-282-1376; and
if you are a California resident, you may exercise your rights under the CCPA by contacting 6clicks as described in the 'How to contact us' section below.

Changes to this policy

6clicks may change this policy from time to time at its discretion. This policy was last updated on 22 July 2026. If 6clicks makes further updates to this policy that are material, 6clicks will provide at least 30 days' prior written notice before the changes take effect (for example, by sending you an email notification) and will post the amended policy on its websites. Your continued use of 6clicks' websites, products or services after the notice period constitutes your agreement to this policy as amended. Where required by applicable law, 6clicks will seek your consent before implementing material changes.

How to contact us

If you have a query, concern or complaint about the manner in which your personal data has been collected or handled by 6clicks or would like to request access to or correction of the personal data 6clicks holds about you please contact 6clicks' Data Protection Point of Contact via email to privacy@6clicks.com .