Holiday Privacy Policy
Last updated: 8 September 2026
Holiday is operated by One Custom Software Pty Ltd (“Holiday”, “we”, “us” or “our”).
We respect the privacy of individuals whose personal information is handled through our website, services and business operations.
This Privacy Policy explains how we collect, hold, use and disclose personal information and how individuals can access, correct or raise concerns about that information.
We intend to handle personal information consistently with the Privacy Act 1988 (Cth) and Australian Privacy Principles where they apply to us.
1. Information We May Collect
Depending on how you interact with Holiday, we may collect:
- name and contact information;
- business and employment information;
- account and user information;
- authentication and access information;
- communications with Holiday;
- support requests;
- website and device information;
- IP addresses and technical logs;
- usage and interaction information; and
- other personal information reasonably necessary to provide our services.
Where an organisation uses Holiday, Customer Data processed through the organisation's Holiday environment may also contain personal information relating to its employees, contractors, customers, suppliers or other individuals.
2. Customer Data
Holiday may process information from business systems connected by a Customer.
Depending on the Customer's configuration, this may include information from accounting systems, email and communication systems, document storage, project management platforms, customer relationship systems and other authorised data sources.
The Customer determines which systems and information it authorises Holiday to access.
Where Holiday processes personal information contained in Customer Data on behalf of a Customer, the Customer remains responsible for determining that it has an appropriate basis to collect and provide that information.
3. How We Collect Information
We may collect personal information:
- directly from you;
- from your employer or organisation;
- when an account is created;
- when you communicate with us;
- through your use of Holiday;
- from business systems an authorised Customer connects to Holiday;
- from authorised integrations and APIs;
- from service providers acting on our behalf; and
- from publicly available sources where lawful and reasonably necessary.
We seek to collect only information reasonably required for the relevant purpose.
4. Why We Use Personal Information
We may use personal information to:
- provide and operate Holiday;
- authenticate users;
- configure and maintain Customer environments;
- connect authorised third-party systems;
- ingest and organise Customer Data;
- perform authorised digital-worker tasks;
- generate AI-assisted responses and outputs;
- provide support;
- secure and monitor the service;
- investigate incidents;
- maintain audit records;
- communicate with Customers;
- improve service reliability and functionality;
- comply with legal obligations; and
- protect the rights and security of Holiday, Customers and other persons.
5. Artificial Intelligence
Holiday uses artificial intelligence as part of providing its services.
Where a Customer uses an AI-enabled Holiday function, relevant information may be processed by an AI model to perform the requested function.
This may include personal information where that information forms part of Customer Data relevant to the task.
Holiday may use third-party commercial AI providers to process information for these purposes.
Holiday does not use identifiable Customer Data to train a general-purpose AI model for use by unrelated customers.
We seek to configure third-party AI processing so that Customer Data is used to provide the requested service rather than to train a provider's general-purpose model.
6. Automated Actions and Decisions
Holiday can assist users and organisations with automated workflows and digital-worker activity.
Depending on the Customer's configuration, this may include retrieving information, preparing content, recommending actions and performing authorised actions in connected business systems.
The organisation using Holiday determines the authority and permissions granted to its digital workforce.
Holiday is designed to allow technical and organisational controls around that authority. The appropriate level of human review will depend on the use case, the Customer's configuration and applicable legal obligations.
Where applicable, we will provide information about the kinds of personal information used in automated processes and the types of decisions or actions enabled by Holiday.
7. Disclosure to Service Providers
We may disclose or make personal information available to service providers that help us provide Holiday, including providers of:
- cloud infrastructure;
- hosting and database services;
- artificial intelligence and machine-learning services;
- communications;
- security and monitoring;
- software development;
- support systems; and
- other technical infrastructure.
We limit access to information to what is reasonably required for the service being provided.
8. Connected Third-Party Services
Customers may choose to connect Holiday with third-party systems.
When such a connection is authorised, Holiday may send information to or receive information from that provider as required to perform the requested integration.
The third-party provider's own privacy policy and terms may also apply.
9. Overseas Processing
Some technology providers used by Holiday may operate infrastructure or personnel outside Australia.
As a result, personal information may in some circumstances be processed or accessed from overseas.
Relevant locations may include the United States and other jurisdictions in which our technology providers operate.
Where practicable, Holiday will maintain information about material subprocessors and processing locations used in delivering the service.
10. Data Security
Holiday uses technical and organisational controls intended to protect information from unauthorised access, loss, alteration or disclosure.
Depending on the service, these controls may include:
- isolated Customer environments;
- access controls;
- credential restrictions;
- logging and audit records;
- encrypted network connections;
- cloud infrastructure security;
- backups; and
- operational monitoring.
No online service can guarantee absolute security.
Customers also have responsibility for securing their own users, devices, accounts and connected systems.
11. Data Retention
We retain personal information for as long as reasonably required to provide the relevant service, meet legal requirements, resolve disputes, maintain security records or fulfil legitimate operational requirements.
Customer Data is generally retained while the Customer's Holiday environment remains active or subject to an agreed retention arrangement.
Following termination, Customer Data may be retained for a limited export period and then deleted from active systems in accordance with our Terms of Service.
Residual copies may remain temporarily in backups until overwritten or removed through ordinary backup retention processes.
12. Data Breaches
Where we become aware of a suspected data breach, we will investigate and assess the incident.
Where the Notifiable Data Breaches scheme or another applicable law requires notification, we will take the steps required by that law.
13. Access and Correction
You may ask us to provide access to personal information we hold about you or request that inaccurate information be corrected.
In some circumstances, information contained within a Customer's Holiday environment is controlled by that Customer. We may therefore need to refer a request to the relevant Customer or organisation.
We may ask for reasonable verification of identity before providing access or making a correction.
14. Marketing Communications
We may use business contact information to communicate about Holiday and related services where permitted by law.
Recipients may opt out of electronic marketing communications using the unsubscribe mechanism provided or by contacting us.
Operational, account, security and service communications are not marketing communications and may still be sent where necessary.
15. Website Data and Cookies
Our website may use cookies or similar technologies to operate the site, understand usage, maintain security and improve performance.
Browser settings can generally be used to manage cookies, although disabling some technologies may affect website functionality.
16. Complaints
If you believe we have mishandled your personal information, please contact us.
We will review the issue and seek to respond within a reasonable period.
If you are dissatisfied with our response and the Privacy Act applies, you may also have the right to make a complaint to the Office of the Australian Information Commissioner.
17. Changes to This Policy
We may update this Privacy Policy as our services, technologies, providers or legal obligations change.
The current version will be published on the Holiday website and will show the date on which it was last updated.
18. Contact
Privacy enquiries may be directed to:
Privacy Officer
One Custom Software Pty Ltd
Queensland, Australia
support@holidayworks.com.au
holidayworks.com.au