Privacy
What we collect, and where it goes.
This site argues that a practice should know where its data lives. It would be a poor argument if this page were vague. Below is every piece of information ndpro.com.au collects, which company holds it, and which country it sits in.
Last updated 27/08/2026 · Santos Technology Pty Ltd · ABN 12 697 662 669
1. What this policy covers
This policy covers the public website at ndpro.com.au, including the behaviour-support page at ndpro.com.au/bsp. It is about people who visit those pages: prospective customers, and anyone who fills in a form or books a call.
It does not cover the NDPRO software itself. Participant, practitioner and clinical records held in the product are governed by the written agreement between Santos Technology Pty Ltd and the practice that operates it, under which the practice is the entity responsible for that information and we act on its instructions. Nothing on this website is connected to those records, and no information collected here is placed into them.
For the optional Google Drive connection in NDPRO Resource Library, see our Google Drive integration privacy notice.
2. Who we are
NDPRO is a product of Santos Technology Pty Ltd (ACN 697 662 669, ABN 12 697 662 669), an Australian company. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
For anything in this policy — a question, a correction, a copy of what we hold, or a request to delete it — write to contact@santostech.com.au.
3. What we collect
There are four ways this website receives information about you, and no others.
3.1 The founding-cohort application form
The form on ndpro.com.au/bsp asks for your practice name, your name, your email address, the size of your practice, and — optionally — a phone number. We use it to answer your application and for nothing else. There is no mailing list, and we do not sell or rent it.
Submissions are delivered to us by Formspree, Inc., a form-handling service whose infrastructure is in the United States. Your submission is stored in their system as well as reaching our inbox. Their privacy policy is at formspree.io/legal/privacy-policy.
3.2 Booking a walkthrough
The booking panel in the homepage footer is provided by Calendly LLC, in the United States. Whatever you type into it — typically your name, email address and a note — is collected by Calendly and passed to us as a calendar invitation.
Two things about that panel are worth stating plainly, because they are the reason it is built the way it is. It is closed until you open it, and while closed it contacts nobody: no request leaves your browser for Calendly or anyone else. When you open it, Calendly's booking page loads inside it, and that page brings in a number of its own third-party services — analytics, error reporting and advertising among them — which operate under Calendly's terms rather than ours. We cannot switch those off. Keeping the panel closed by default is how we make sure that reading this site never triggers them.
3.3 Web server logs
This site is hosted by Vercel Inc. and served from their Sydney (ap-southeast-2) region. As with any web server, requests are logged: your IP address, the page requested, the time, and your browser's user-agent string. We use these only to keep the site running and to investigate abuse. We do not use them to build a profile of you.
3.4 Fonts
The typefaces on this site are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Requesting a font discloses your IP address and user-agent to Google, in the ordinary way any request to any server does. No other content on this site comes from a third party.
4. What we do not do
These are statements about the pages as they are actually built, not aspirations.
- This site sets no cookies. Neither the homepage nor /bsp sends a Set-Cookie header, and neither writes to your browser's local storage. There is no consent banner because there is nothing to consent to. (Calendly's booking page, once you open it, is Calendly's own page and manages its own cookies.)
- There is no analytics on our pages. No Google Analytics, no Meta pixel, no session recording, no heatmaps, no A/B testing tool.
- There is no advertising and no tracking across other sites. We do not run retargeting, and we do not upload contact lists to advertising platforms.
- We do not sell, rent or trade personal information. Ever, to anyone.
- We do not add you to a mailing list because you filled in a form. If we ever start sending a newsletter, it will be something you opt into separately.
5. Information sent overseas
Australian Privacy Principle 8 requires us to name the countries your information may go to. For this website, they are:
| What | Who holds it | Where |
|---|---|---|
| Founding-cohort form submissions | Formspree, Inc. | United States |
| Walkthrough bookings | Calendly LLC | United States |
| Web server logs | Vercel Inc. | Australia (Sydney) |
| Font requests (IP, user-agent) | Google LLC | United States and elsewhere |
| Email you send us | Santos Technology Pty Ltd | Australia |
We have chosen these providers for the marketing site deliberately and separately from the product. The NDPRO software holds its data in Australia; a form on a website that asks for a business email address is a different question from a clinical record, and we have not pretended the two are the same by putting them in the same sentence.
6. How long we keep it
- Applications we take forward become part of our customer records and are kept for as long as the relationship lasts, and for seven years afterwards, which is the period Australian tax and corporations law requires for business records.
- Applications we do not take forward are deleted within twelve months, from both our inbox and the form provider's system.
- Server logs are retained by our host for their standard period and are not copied into any other system by us.
- Ask us sooner and we will delete sooner. A request to remove your details is honoured; see section 8.
7. How it is protected
Every page on this domain is served over HTTPS only, with HTTP Strict Transport Security, and the site runs under a restrictive Content Security Policy that forbids it from loading or sending anything to a destination not named in this policy. The site itself stores nothing: it has no database, no login and no cookies, so an application exists only in our inbox and in the form provider's system.
No system is perfectly secure, and we will not claim otherwise. If information we hold is involved in a data breach likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
8. Seeing, correcting or deleting what we hold
Write to contact@santostech.com.au and tell us what you want. You can ask us to:
- tell you what personal information we hold about you;
- send you a copy of it;
- correct anything that is wrong; or
- delete it.
We will respond within 30 days. We do not charge for this. If we refuse a request — which would only be for a reason the Privacy Act allows — we will tell you why in writing.
9. Complaints
If you think we have mishandled your personal information, tell us first at contact@santostech.com.au and we will investigate and reply within 30 days.
If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner — oaic.gov.au/privacy/privacy-complaints, or 1300 363 992. You do not need our permission to do that.
10. Changes to this policy
If we change how this site collects information — a new form, a different provider, a new country in the table above — we change this page and move the date at the top. We do not make a change retrospective: information already collected stays under the terms it was collected under.
This policy covers the website only. It is not affiliated with, endorsed by, or an interpretation of guidance from the NDIA or the NDIS Quality and Safeguards Commission.