Privacy Policy

BM Live Pty Ltd ABN 41 659 954 800 operates BM Live. This policy explains how we handle personal information, and we handle it in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Much of the personal information in BM Live is entered by our customers about their own staff, contractors, tenants and site contacts. For that information the customer is the entity that decides how it is used, and we handle it on their instructions under our agreement with them. If your details are in BM Live because you deal with one of our customers, contact that organisation first — but you can always contact us using clause 12.

Account and identity. Name, work email, phone number, job title, profile photo, the organisation you belong to and your role and permissions.

Authentication. A cryptographic hash of your password (never the password itself), session tokens, sign-in times, password reset requests, and terms acceptance records including the document version, timestamp and IP address.

Operational records you create or that name you. Work orders and their history, requestor name, email and contact number, planned maintenance, site and property records, asset and space registers, supplier and provider details, schedules of rates, delegation of authority approvers and approval decisions, meeting minutes and activity history.

Files and images. Attachments and photographs uploaded against work orders, portfolios, properties, project orders and profiles, including media captured through the mobile app. Photographs of a site may incidentally include people.

Technical. IP address, browser and device information, pages and features used, performance and error telemetry, and audit logs of significant actions.

Location (BM Live Field mobile app). When a technician photographs work on site, the app records the device’s location at the moment the photo is taken and stores it against that photo, so the record shows where the work was documented. It is captured only at the moment of capture — the app does not track location in the background and never requests background location. Granting it is optional: if location is declined or unavailable, the photo is still saved and uploaded without one.

Correspondence. Emails and messages you send us, including support requests.

We do not seek sensitive information. Maintenance and incident records can nonetheless end up containing health information — an injury described in a work order, for example. We ask customers not to enter sensitive information unless it is necessary and they have consent. Where we do hold it, we treat it as sensitive information under the Privacy Act and restrict access accordingly.

Directly from you when you use the platform or contact us; from the organisation that gave you your account; and automatically through the platform’s logging and analytics. Where it is reasonable and practicable, we collect personal information about you only from you.

• to provide and operate the platform and authenticate you;
• to route, schedule and report on maintenance work;
• to send operational notifications, such as work order updates and scheduled job results;
• to provide support and investigate faults;
• to keep the platform secure, detect misuse and maintain audit trails;
• to meet legal obligations; and
• with consent, to send product updates. Every marketing message carries an unsubscribe, as the Spam Act 2003 (Cth) requires. Operational messages about your account are not marketing and continue regardless.

BM Live includes an in-app assistant and a feature that suggests work order details from a photograph. Both send the content you provide to a third-party AI provider for processing (see clause 8). We do not use these features to make decisions about you without a person involved: output is a suggestion that a user reviews.

The platform also applies configured business rules automatically — for example, calculating a target completion date from the applicable service level agreement, and routing an approval according to the client’s delegation of authority thresholds. A person can review and change these outcomes.

We disclose personal information only as needed to run the service:

• Microsoft Azure — hosting, database, file storage and application monitoring. Primary data residency Australia East (Sydney).
• Microsoft 365 / Graph — sending outbound email from the platform.
• Anthropic PBC — AI assistant and photo-suggestion features. See clause 8.
• Other organisations in your workflow — a work order shared with a supplier necessarily discloses the requestor’s contact details to that supplier.
• Professional advisers, and law enforcement or regulators where required or authorised by law.

We do not sell personal information and we do not disclose it for another organisation’s marketing.

Where you use the AI features, the content submitted — including the text of your messages and any photograph you upload for suggestions — is sent to Anthropic PBC and processed in the United States. This is a cross-border disclosure under Australian Privacy Principle 8. Before disclosing, we take reasonable steps to ensure the recipient handles the information consistently with the Australian Privacy Principles, including through contractual commitments.

Our hosting is configured for Australian data residency. Some support and monitoring functions provided by Microsoft may be accessible from outside Australia. A current list of overseas recipients and their countries is available on request at no-reply@bmlive.com.au.

Encryption in transit (TLS) and at rest; passwords stored using a salted and peppered one-way hash; role-based access control so users see only their organisation’s data; network restrictions on the database and file storage; audit logging; and regular patching. Access by our staff is limited to those who need it to support the service.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

While the customer’s subscription is active and for 90 days after it ends, after which data is deleted or de-identified unless we must keep it by law — for example financial records under the Corporations Act, or records a customer must retain under work health and safety or building compliance obligations. Backups are retained for 35 days and purged on their normal cycle.

You may ask for access to the personal information we hold about you and ask us to correct it. We will respond within 30 days. We do not charge for a request, though we may charge a reasonable cost for giving access in an unusually resource-intensive form. If we refuse, we will tell you why in writing and how to complain. Where your information belongs to a customer’s workspace, we may need to refer you to that organisation.

You may also ask us to delete the personal information we hold about you. Where that information belongs to a customer’s workspace we may need to refer the request to that organisation, and we may need to keep records the law requires us to retain. Send deletion requests to the contact address below.

Contact our Privacy Officer at no-reply@bmlive.com.au, or by post to BM Live Pty Ltd, Unit 8/1B Kleins Rd, Northmead NSW 2152. We will acknowledge within 5 business days and respond within 30 days.

If you are not satisfied, you may complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, GPO Box 5218, Sydney NSW 2001.

We use strictly necessary cookies and browser storage to keep you signed in and hold your session securely, and we collect performance and error telemetry to keep the platform working. We do not use advertising or cross-site tracking cookies.

BM Live is a workplace tool and is not intended for anyone under 18. We do not knowingly collect personal information from children.

We may update this policy. Material changes are notified by email and in the platform at least 30 days before they take effect, and users are asked to accept the new version at sign-in. The version and effective date appear at the top of this page.