Privacy
FrontFoot is a self-assessment tool run by REST Group Asia Pacific Pty Ltd ("REST Group", "we"). This page sets out what the tool collects, why, where it goes, how long it is kept and how to reach us about it.
What we collect
- Your venue details: venue name, state or territory and work email (required), plus organisation, your name, role and staff count if you add them, and your answer to the question about incidents in the last 12 months.
- Your follow-up choice: whether you ticked the box to receive follow-up emails.
- Your assessment: your yes or no answers to the 39 questions and the score and gaps worked out from them.
- Where you came from: a source tag, if you arrived through a link that carries one.
- If you buy a plan: Stripe, our payment provider, collects your email, billing address, card details and, if you enter them, a tax ID and purchase order number. Your card details go to Stripe, never to REST Group.
- If you ask for a quote or invoice: your name, role, organisation, email, phone, number of venues, what you need and your message.
- If you restore a plan: the email you enter.
Why we collect it
- to run the assessment and email you your results;
- to take payment and issue your tax invoice;
- to unlock the plan you bought on any device;
- to send plan reminders and any follow-up emails you agreed to;
- so REST Group can reply to you and follow up on assessments and quote requests.
Where it goes
- Stripe customer record. When you start the assessment, your email, venue name, organisation, state, source tag, follow-up choice and start time are saved to a customer record with Stripe. When you finish, your answers, score, number of higher-risk gaps and finish time are added to it. A quote request marks the record so automated follow-ups stop, and the record also notes which reminder emails were sent and whether you unsubscribed.
- Stripe checkout. When you buy, the checkout session stores your venue name, organisation, state, source tag and answers with the payment, so the plan can be unlocked on any device and rebuilt from your answers.
- REST Group's inbox. Each finished assessment is emailed to REST Group with your venue details, contact details, staff count, incident answer, score, gaps, follow-up choice, source tag and a link to your results. Quote requests are emailed to REST Group too.
- Resend. Our email delivery provider sends your results email, quote acknowledgement, restore link, plan reminders and any follow-up emails you agreed to.
- Your results link. The link in your results email (and the "Copy link for my manager" button) carries your venue name, organisation, state, staff count, incident answer and answers inside the web address. Anyone you share it with can open those results. It never carries your email, name or role.
- Vercel. Vercel hosts the site and runs the parts that talk to Stripe and Resend. Like any web host it receives the technical details your browser sends with each request, such as your IP address and browser type, and it keeps server logs, which can include error messages from these requests.
- Google Fonts. The page loads its typeface from Google Fonts, so your browser contacts Google's servers when the page opens.
- Cloudflare. When you download your plan as a PDF, the page loads its PDF tool from cdnjs, a Cloudflare service, so your browser contacts Cloudflare's servers.
What stays in your browser
The tool saves your progress in your browser's local storage so you can close the page and pick up where you left off. This includes:
- the venue details you enter, your follow-up choice, your answers and the section you were up to;
- a record that your plan is unlocked, after you pay or open an unlock link, with the venue name, state, organisation, answers and plan dates that came with the purchase;
- the source tag, if you arrived through a link that carries one;
- short codes that stop the same results being sent twice.
This data stays on your device until you clear it. "Start again" clears your answers. Clearing your browser's site data for this page removes all of it.
Overseas disclosure
Stripe, Resend, Vercel, Google and Cloudflare are based in the United States, so your details may be stored and processed in the United States and other countries where they operate. We use them only to take payment, deliver email, host the site and serve its typeface and PDF tool.
How long we keep it
A restore link works for 7 days. What stays in your browser is kept until you clear it. Everything else is kept for as long as needed to provide the service and meet legal obligations.
Follow-up emails and unsubscribing
You only get follow-up emails about closing your gaps if you tick the box when you enter your details. That box starts unticked. If you buy a plan, we email you reminders before your year is up so you can re-assess and renew. Every follow-up and reminder email has an unsubscribe link, and you can also reply to any email and ask us to stop.
Access, correction and questions
To ask what we hold about you, to correct it or to have it deleted, email info@restgroup.com.au. REST Group's general privacy policy is at restgroup.com.au/terms (opens in a new tab).
Complaints
If you have a privacy complaint, email info@restgroup.com.au first so we can look into it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au (opens in a new tab).