Privacy Policy

Last updated: 25 June 2026

Draft for legal review. Items marked [REVIEW: …] require sign-off from an Australian tech/privacy lawyer before being relied on commercially.

1. About this policy

Apex Workforce Development Pty Ltd (ABN [REVIEW: ABN]) ("Apex", "we", "us") is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains how we handle personal information when you use our platform, websites, and related services.

2. The information we collect

Account data: name, email, phone, organisation, role.
Employee records (provided by employers): name, contact details, employment status, job role, department, start date.
Compliance evidence: licence numbers, ticket types, VOC records, qualification documents, hours logbook entries, induction acknowledgements, photos of cards and certificates.
Sensitive information (limited): medical/fitness-for-work documents only where uploaded by the employer or employee for compliance purposes. We treat all such records as sensitive under APP 3.
Billing data: tax invoice details. Card numbers are handled by Stripe; we never store full PANs.
Technical data: IP address, browser/device, session tokens, audit logs, error reports.
Communications: support emails, demo bookings, training enquiries.

3. Why we collect it (purpose)

To provide, operate and improve the platform.
To produce competency, expiry and compliance reports for employers.
To route training enquiries to relevant RTOs (only with the employer's instruction).
To send essential service emails (receipts, security alerts, expiry alerts, password resets).
To meet legal, tax and audit obligations.
To investigate suspected misuse, fraud or breaches.

We do not sell personal information, share it with advertisers, or use it to train third-party AI models.

4. Sensitive information — APP 3

We only collect sensitive information (such as health/fitness-for-work records) where it is reasonably necessary for compliance recordkeeping and either (a) the individual has consented, or (b) collection is required or authorised by law.

5. How we share information

Within your organisation: records visible to authorised users in your company only. Strict row-level security prevents cross-company access.
RTO partners: when you submit a training enquiry, we share the minimum necessary information (typically: company name, contact person, employee count, ticket type and region) with matched RTOs.
Service providers (subprocessors): see our subprocessor list.
Legal: where required by law, court order, or to protect rights and safety.
Business transfer: in the event of a merger or acquisition, subject to equivalent protections.

6. Cross-border disclosure — APP 8

Data is stored in Australia (Sydney region, AWS ap-southeast-2) via our managed infrastructure provider. Some subprocessors (e.g. Stripe, email delivery) may process limited data outside Australia. See the subprocessor list for jurisdictions. We take reasonable steps under APP 8 to ensure overseas recipients handle personal information consistently with the APPs.

7. Security

Encryption in transit (TLS 1.2+) and at rest.
Row-level security enforced at the database layer for tenant isolation.
Files served via short-lived signed URLs.
Passwords hashed with bcrypt; new passwords screened against the Have I Been Pwned breach corpus.
Role-based access control. Administrative access is logged.
Backups retained for 30 days with point-in-time recovery.

8. Retention and deletion

Active account data is retained for the life of the account.
On account deletion, personal data is removed within 30 days, except records we are required to retain by law (e.g. tax invoices: 5 years; workplace safety audit records: typically 7 years [REVIEW: confirm retention period for VIC]).
De-identified, aggregated analytics may be retained indefinitely.

9. Your rights (APP 12 & 13)

You may request to:

Access the personal information we hold about you.
Correct inaccurate or out-of-date information.
Have your account deleted, subject to legal retention.
Withdraw consent to non-essential processing.

Email privacy@apexworkforce.com.au. We respond within 30 days. Where an employer uploaded the data about you, we may direct your request to that employer first.

10. Notifiable data breaches

We comply with the Notifiable Data Breaches scheme. If a breach likely to result in serious harm occurs, we will notify affected individuals and the OAIC as soon as practicable.

11. Cookies and tracking

See our Cookie Notice for details. We use only essential cookies and privacy-respecting analytics; no third-party advertising trackers.

12. Complaints

Email privacy@apexworkforce.com.au. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

13. Recruitment services and candidate consent (APP 6)

Apex offers permanent recruitment (introduction) services. Apex does not employ candidates or supply labour — a successful candidate is employed directly by the employer.

Opt-in only. A wallet holder is only considered for opportunities if they personally switch on "Open to opportunities" in their own passport. Records loaded by an employer are never included unless that individual opts in themselves.
Stage 1 consent allows Apex to search the qualifications in that person's passport against a role brief and to contact them privately. It does not authorise any disclosure to an employer.
Stage 2 consent is specific to one role and one named employer. Only after it is given do we disclose the candidate's name, contact details, licences and qualifications, general location, availability and employment type.
Records. We store the exact consent wording, its version and the time it was given, for both stages.
Withdrawal. Consent can be withdrawn at any time in the passport or by emailing us. We notify the employer and ask them to stop processing the information.
Capability-only matching. We match on licences, tickets, qualifications, availability and location — never on protected attributes.
No candidate fees. Employers pay the placement fee; candidates are never charged.

Employer obligations are set out in our Recruitment Terms of Business.

14. Changes

We will notify you of material changes by email and update the "Last updated" date above.