Privacy Policy

Diveboard is operated by Bruins Group Pty Ltd, trading as Poolwerx South Australia, across five franchise locations (North Brighton, Kings Park, Morphett Vale, Salisbury, West Lakes). Diveboard is our internal business-management platform. It is not a public-facing product, but it holds personal information about our customers, so this policy explains what we hold and why.

ABN: 83606001174

We hold, on customers who have used or enquired about our pool services:

• Contact details: name, phone number(s), email address, service address
• Service and job history: visits, technicians assigned, work performed, products used
• Quotes: pricing, job type, status, and the follow-up history against them
• Communications: calls, SMS, and emails exchanged with our stores, and reviews or feedback left with us

To run pool service and retail operations: scheduling and carrying out jobs, quoting work, processing sales, following up with customers, sending service reminders, and responding to enquiries and complaints. We also use aggregated, de-identified data internally to measure how our stores and technicians are performing.

We use a number of third-party services to run the business. Each is given only the information it needs to do its job:

We do not sell personal information, and we do not share it beyond the processors above except where required by law.

Customer and job records are kept for as long as the customer relationship is active and for a reasonable period afterwards, to meet our record-keeping and legal obligations. Cached call, SMS and email history is kept for 12 months from the date of the communication and then automatically removed on a nightly basis; the underlying job, quote and financial records are retained separately per the above. Retention periods are reviewed periodically and may change.

Data synced from Lightspeed (point-of-sale) or Xero (accounting) is retained for as long as that integration stays connected. If we disconnect an integration (for example, to re-authenticate after an expired token), the previously synced data is kept so we don't have to re-sync from scratch. If we deliberately uninstall an integration, its locally cached data for our franchise is permanently deleted at that point.

Access to Diveboard is restricted to authorised staff by individual login, with permissions scoped to each person's role, and sensitive access is logged. Credentials and tokens for the third-party services above are encrypted at rest; traffic to and from Diveboard is encrypted in transit (HTTPS). We apply rate limits and monitoring to guard against bulk extraction of customer data, whether by an outside party or a compromised staff account.

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, by contacting us. See our support page for how, or contact your local Poolwerx store directly. You can also email gad.admin@poolwerx.com.au.

What deleting actually does. We de-identify your record rather than erase it outright. We remove your name, email address, phone numbers and address, and we delete the staff notes, call, SMS and email history held against you. We keep the underlying job, quote, repair and sales records (the dates, amounts and what work was done) because we are required to retain those; once de-identified they are no longer linked to your name or contact details. Free-text comments a technician typed on an individual job are not searched or edited, so one may still mention a name; tell us if that matters to you and we will look.

One thing we keep, and it is the only one. We retain the internal reference that ties your past payments to our accounting system (Xero), so those payments remain reconcilable for the seven-year accounting-retention period. That reference is an internal identifier only. It contains no name, address, email or phone number, and it is removed automatically once the seven years have passed. Nothing else about you is retained.

Other systems hold their own copies. Deleting your information in Diveboard does not by itself delete it from the third-party services listed above. Pooltrackr, Lightspeed, Xero, Gmail and our phone provider each keep their own records. We action those separately when you ask us to, and we will tell you what was done and where.

If we become aware of a data breach that is likely to result in serious harm, we will assess and respond in line with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth), including notifying the Office of the Australian Information Commissioner (OAIC) and any individuals affected, where required.