How ROTOR handles your personal data

ROTOR (Records of Tests, Observations & Requirements) is a field-quality records system operated by the Siemens Energy field-service organisation for gas-turbine outage and inspection work. It is used by Siemens Energy staff and by named representatives of the customers whose equipment is being inspected.

The entity responsible for your personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles is Siemens Energy Pty Ltd (ABN 69 636 537 409), referred to as "we" in this notice. Supabase, Vercel, Cloudflare and SendGrid process data only on our instructions. Our privacy contact is Mitchell Schram, ROTOR Product Owner, Siemens Energy field service. Privacy questions, access or correction requests and complaints go to him through the contact link on the sign-in page.

This notice applies to everyone who uses ROTOR. If you are a Siemens Energy employee, the Siemens Energy employee privacy notice also applies to you and, where the two differ, it prevails in relation to your employment record. If you are a customer representative, this notice supplements any privacy notice your own employer has given you.

• Account details: name, work email address, company or organisation, job role, optional contact number, the platform access group you have been assigned, and for Siemens Energy staff the regions and technical disciplines you work in. Accounts are created by invitation only. If you are a customer representative, these details are given to us by your organisation or its Siemens Energy project lead when your account is set up; you then complete or correct them yourself.
• You cannot use ROTOR anonymously or under a pseudonym: every record must be attributable to a named, accountable person, which is the purpose of the system.
• Sign-in records: the time of your last sign-in, when you were last active (recorded to the nearest quarter-hour), and the device and browser details your browser sends with each request. Accounts are protected by a password you set; passwords are stored only as a salted hash by our authentication provider.
• Two-step sign-in: every account must be protected with an authenticator app, and our authentication provider stores the shared secret needed to check your codes. When you choose to remember a device we store a random identifier for it (as a hash), the browser and operating system family, and when it was last used, so that device is not asked for a code again for a limited time (7 days on desktop, 30 days on a phone or tablet, adjustable by an administrator). You can see and remove remembered devices under Account security; an administrator can reset your authenticator if you lose access to it.
• Work you record: inspection results, sign-offs, comments, redlines, findings, shift entries, procurement and issue entries, and the attribution of each of these to you (who did what, when). Sign-offs also store a content hash of what was signed so later edits can be detected. Changes to key records are kept as a row-level history that names who made each change.
• Photographs and files uploaded as inspection evidence. These are of equipment only; no record requires photographs of people. Only Siemens Energy staff can upload files; customer representatives comment, decide and sign but do not upload. Uploaded files are checked for their real type and, for documents, for embedded scripts or macros before they are stored. ROTOR never requests your device location.
• Bug reports you choose to send: your description, an optional screenshot, the page you were on, and basic device and browser details.

• To operate the service: authenticate you, show you the projects you are a member of, and let you create and sign records.
• To keep a complete quality record: sign-offs, comments and audit entries are attributed and time-stamped because the record is only useful if it is traceable. Audit tables are append-only.
• To notify people who need to act: for example, an email to a customer representative when a witness or hold point is scheduled.
• To keep the service secure and working: reviewing sign-in problems, investigating bug reports, and monitoring for misuse.

We collect only what is reasonably necessary for these purposes. We do not use your data for marketing, profiling, or advertising, and we do not sell it. Notification emails contain no open or click tracking.

• Members of a project see that project only. Customer representatives see only the projects their organisation is party to, and only the customer-facing parts of those records (for example, they do not see internal hold points, internal comments, or records marked Siemens Energy internal). This is enforced in the database with row-level security, not only in the user interface, and the browser can never write to the database directly — every change goes through the server, which checks your permission first.
• Siemens Energy field-service staff see the projects they are assigned to, within the regions they are assigned to; a small number of platform administrators can see all projects for support and administration. Some of these staff are employed by other Siemens Energy group companies and work from outside Australia — see the overseas-disclosure paragraph below.
• Customer representatives see only the Siemens Energy staff who are on their projects or who have signed records on them; they cannot browse a directory of other staff or other customers.
• Your name appears against the records you create and sign, to everyone who can see those records. That is inherent to a quality record and cannot be switched off.

Your data is held by the following service providers. Each acts only on our instructions and is bound by contractual confidentiality and data-processing obligations (their published data-processing agreements):

• Supabase — PostgreSQL database, file storage and authentication. Data at rest is in Sydney, Australia (AWS ap-southeast-2).
• Vercel — application hosting. The application runs in Sydney (Vercel syd1) and encrypted nightly backups are kept in a private Vercel store in Sydney. Vercel’s global edge network handles requests in transit over TLS, so a request may pass through a Vercel edge location outside Australia before reaching Sydney; no application data is stored at those locations.
• SendGrid (Twilio) — sends notification emails from infrastructure in the United States. It receives only the recipient address and the message content (for example, the project name and the date of a scheduled inspection).
• Cloudflare R2 — a second, independent copy of each nightly backup (database and evidence files, encrypted) is kept in a private Cloudflare storage bucket so that a failure at Vercel or Supabase cannot take the backup with it. The bucket is configured to be placed in the Oceania region; Cloudflare treats this placement as best-effort rather than a contractual residency guarantee, so we disclose it here as a possible overseas storage location. Cloudflare holds only the encrypted backup objects and has no access to the live application.
• DHL — where a procurement shipment carries a DHL tracking number, ROTOR asks DHL’s shipment-tracking service (hosted in the European Union) for the carrier status when the procurement register is opened. Only the tracking number is sent; no project, record or personal data leaves ROTOR, and DHL’s reply is stored against the shipment.
• Sentry — when something in ROTOR fails unexpectedly, a technical fault report (the error message, the page or action involved, the software version, and the numeric account identifier of the signed-in user) is sent to Sentry’s error-monitoring service so the fault can be fixed. Names, email addresses, IP addresses, record contents and form entries are stripped before sending.
• Better Stack — an independent service that checks every minute whether ROTOR is reachable and whether the nightly backup completed, and that keeps a copy of ROTOR’s server logs for three days so faults can be investigated. Those logs contain the time, address and outcome of each request (including the IP address it came from) and technical messages from the software; they never contain form entries, record contents, names or email addresses.
• Google Maps — the project summary page embeds a map of the site location. When that page loads, your browser requests the map directly from Google, which therefore receives your IP address and the site address being displayed. No account or record data is sent to Google.

Overseas disclosure. Your data is stored only in Australia, but Siemens Energy engineers, technical specialists and administrators assigned to a project may view its records from outside Australia. These people are employed by other companies in the Siemens Energy group and may be located in any of the countries in which the Siemens Energy group operates, most commonly Germany, the United Kingdom, the United States and countries in the Asia-Pacific region. It is not practicable to list the countries for a particular project in advance, because who is assigned depends on where the required specialists are; if you want to know which countries apply to your project, ask our privacy contact. Access is limited to the projects they are assigned to, is subject to the same database-level access controls as everyone else, and is covered by Siemens Energy’s intra-group data-protection agreements, which require the recipient to handle personal information in a way consistent with the Australian Privacy Principles. Other than this, the email delivery, the edge transit and the Cloudflare backup copy described above, we do not disclose your personal information overseas.

We may also disclose personal information, in each case only to the extent necessary: to the customer organisation a project belongs to, as part of the inspection records for that project; to our professional advisers, insurers and auditors; to a successor if the ROTOR service is transferred within Siemens Energy; and where the law requires or permits it. We do not sell or rent personal information.

Toolwise. ROTOR exchanges a small amount of data with Toolwise, another Siemens Energy field-service application that tracks the tooling issued to a project. Toolwise reads from ROTOR through a dedicated read-only database role that can see project names, references and dates, fleet units, and the names and job titles of people on a project team — four tables and six columns of a fifth — and nothing else: no findings, test records, files or account details. In the other direction, when a Siemens Energy user opens a project’s Toolwise tab, ROTOR sends Toolwise only that project’s reference number and reads back the tool boxes, tool-audit results and photos Toolwise holds for it; no personal information about you is sent. Toolwise is operated by Siemens Energy on the same class of providers as ROTOR (Supabase and Vercel) and is subject to the same intra-group data-protection agreements.

• Quality records, sign-offs, comments and audit entries are kept for as long as the inspection record itself must be kept under the contract for that work and Siemens Energy’s records-retention requirements — they are part of the evidence that the work was done and checked. When the retention period ends the record, including the personal information in it, is deleted or de-identified.
• Deleted files are held in a recoverable trash area for 90 days (the default; an administrator may set between 1 and 365 days), then permanently removed. Files are never hard-deleted directly from the application.
• Backups are kept for 30 days (daily) and 12 months (weekly), then rotated out. The backup includes an encrypted copy of account sign-in records (password hashes and authenticator secrets) so that accounts can be restored without everyone re-enrolling; that copy is encrypted with a separate key that is not stored with the backup.
• A project member may export a copy of their project (reports, registers, photos and attachments) as a single file. The export is generated as that person and contains only what they can already see; it is held in private storage in Australia for 7 days (the default; adjustable by an administrator up to 90 days) and then deleted automatically. Once downloaded, the copy is outside ROTOR and is the recipient’s responsibility.
• When your account is no longer needed it is deactivated rather than deleted, so the records attributed to you stay traceable. Deactivation immediately blocks sign-in and ends open sessions. If you ask us to, we will remove personal details that are not part of a quality record.

ROTOR uses only strictly necessary cookies: the session cookies set by our authentication provider to keep you signed in, the remembered-device cookie for two-step sign-in described above, and small preference cookies for the regions you have chosen to view and the display mode. The browser’s local storage holds draft work you have not yet saved and interface preferences such as sidebar state. There are no advertising or third-party analytics cookies, so no consent banner is shown.

You can ask to see the personal information we hold about you, to have inaccurate or out-of-date details corrected, or to have details removed where they are not part of a quality record. Contact our privacy contact (Mitchell Schram, ROTOR Product Owner, Siemens Energy field service) through the sign-in page; if you are a customer user, your organisation’s Siemens Energy project lead can also raise it for you. We will respond within 30 days. If we refuse a request we will tell you why in writing and how to complain about the refusal.

If you believe we have handled your personal information in a way that breaches the Australian Privacy Principles, complain to our privacy contact first. We will acknowledge your complaint, investigate it and reply in writing, normally within 30 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. If you are outside Australia you may also contact the privacy regulator in your own country.

Access is limited to invited accounts protected by two-step sign-in, every request is checked against project membership in the database, audit records are append-only, signed and closed records are locked against later edits by the database itself, data is encrypted in transit and at rest, browser security headers including an enforced content-security policy are in place, and backups are taken nightly to two separate encrypted stores. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the OAIC as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

We will update this notice when the service or our providers change. The version and date appear at the top of the page; material changes are also announced in the release notes on the sign-in page.