Privacy Policy

1INTRODUCTION

This document sets out the privacy policy of OPTIMISE-HR PTY LTD ABN 70 683 097 850 (referred to in this privacy policy as ‘we’, ‘us’, or ‘our’).

We handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). This privacy policy explains how we collect, store, use, and disclose personal information in connection with our Platform, website, and related products and services (together, the Services).

By using our Services or otherwise providing personal information to us, you acknowledge that your personal information (or the personal information you provide) will be handled in accordance with this privacy policy and any applicable agreement between us and the organisation you represent (such as our Terms and Conditions or a Data Processing Agreement).

We may update this privacy policy from time to time by publishing the updated version on our website. We encourage you to check our website periodically so that you are aware of our current privacy practices.

2TYPES OF PERSONAL INFORMATION WE COLLECT

The personal information we collect may include the following:

(a)name and title;

(b)mailing or street address;

(c)email address;

(d)telephone number and other contact details;

(e)job title, role, team, business unit and organisation details;

(f)information about your business or personal circumstances relevant to the Services;

(g)account registration information, login details, and authentication credentials;

(h)billing, payment and transaction information (e.g., limited payment card details processed via our payments provider);

(i)employment-related information about you or others that you or your organisation enter into the Platform, such as employment history, performance information, grievances and complaints, disciplinary matters, return-to-work information, workplace investigations, and associated documents;

(j)workplace approvals, feedback and sentiment information, including satisfaction scores and responses to surveys or questionnaires;

(k)device and technical information, such as your device identity and type, operating system, IP address, browser type, time zone setting, geo-location information (where enabled), page view statistics, referral source, and standard web log information generated when you use the Services;

(l)information about your use of the Services, including actions taken, content created or modified, decisions recorded, and audit-trail entries (such as timestamps, user identifiers, and activity logs);

(m)health information and other sensitive information to the extent it is entered into the Platform, for example information about illness, injury, disability, or medical restrictions in the context of employment or return-to-work planning;

(n)information collected in connection with promotions, surveys, marketing activities, or events; and

(o)any other information you choose to provide to us or that is required for us to provide the Services.

3HOW PERSONAL INFORMATION IS COLLECTED

3.1how we collect information from you

We will collect your personal information in a lawful and fair way and only where it is reasonably necessary for our functions or activities, where you have consented, or where otherwise permitted by law.

We may collect personal information where you:

(a)register for or use an account on our Platform;

(b)enter, upload, create, review, or otherwise process information in the Platform;

(c)contact us through our website or request support;

(d)subscribe to our communications, complete a form, survey, or questionnaire, or participate in a promotion; or

(e)invest in our business or enquire about a potential purchase of our business.

3.2how we collect information from third parties

We may also collect personal information about you from third parties where it is unreasonable or impracticable to collect it directly from you, or where you have authorised the collection. For example:

(a)from your employer or the organisation that has entered your personal information into the Platform;

(b)from another user of the Platform who uploads or enters information about you (such as your manager, a HR professional, or a business owner);

(c)from our service providers and partners who help us deliver the Services; or

(d)from publicly available sources, referral partners, or professional networks, where permitted by law.

3.3how you provide information for someone else

If you provide personal information (including sensitive information) about another individual (such as an employee, applicant, contractor, manager, or colleague) you must ensure that you have given all required notices and have all necessary consents, authorisations, or other lawful basis to disclose that information to us and for us to handle it in accordance with this privacy policy and any applicable agreement with your organisation.

If you provide personal information about someone under the age of 18, you must be authorised to provide that information and consent to its collection, use and disclosure as described in this privacy policy.

We may, at any time, request evidence that you have the authority, consent, or other legal basis required to provide personal information about someone else.

3.4how we collect information from cookies or other technology

We may also collect personal information from you when you use or access our website, social media pages or Platform. This may be done through use of web analytics tools, ‘cookies’ or other similar tracking technologies that allow us to track and analyse your website usage. Cookies are small files that store information on your computer, mobile phone or other device and enable and allow the creator of the cookie to identify when you visit different websites. If you do not wish information to be stored as a cookie, you can disable cookies in your web browser.

We may use Google Analytics to collect and process data, including when you use third party websites or apps. To find out more see How Google uses data when you use our partners’ sites or apps.

4USE OF YOUR PERSONAL INFORMATION

4.1use generally

We collect and use personal information for purposes reasonably necessary for, or directly related to, our functions and activities, including to:

(a)operate, maintain and provide the Platform and other Services to you and the organisation you represent;

(b)configure and manage your account, authenticate your identity, and facilitate user management and permissions;

(c)generate, display, and store content, recommendations, insights, and other outputs within the Platform, including AI-assisted outputs where enabled by your organisation;

(d)maintain an audit trail of actions, decisions, documents, and events within the Platform for governance, accountability, and record-keeping purposes;

(e)personalise your experience and improve our Services, including by monitoring usage patterns, diagnosing technical issues, and developing new features or offerings;

(f)process payments, manage billing, and administer subscriptions and related transactions;

(g)communicate with you about the Services, including sending administrative messages, notices, updates, security alerts, and support communications;

(h)provide support and respond to enquiries, feedback, or complaints;

(i)conduct research, analytics, and reporting in relation to the use and performance of our Services (including by using de-identified or aggregated information, where appropriate);

(j)comply with our legal and regulatory obligations, resolve disputes, enforce our agreements, and protect our rights, property, and the safety of our users and the public; and

(k)consider applications for employment or engagement with us.

We may also use your personal information for secondary purposes that are related to the primary purposes above and that you would reasonably expect, or for any other purpose for which you have given your consent or which is otherwise permitted or required by law.

4.2no use of data for ai model training

We do not use personal information that you or your organisation submit to the Platform to train our own or third-party AI models, except where expressly agreed in writing with you or your organisation.

5HOW WE DISCLOSE YOUR PERSONAL INFORMATION

We respect your privacy and take reasonable steps to keep your personal information confidential and secure. We may disclose your personal information for purposes described above to:

(a)the organisation that has invited you to use the Platform (e.g., your employer or client), including to authorised managers and administrators within that organisation;

(b)our related bodies corporate;

(c)our third party contractors or consultants;

(d)our professional advisers, such as lawyers, accountants, auditors, and insurers;

(e)our third-party service providers who assist us in delivering the Services, including:

(i)hosting and infrastructure providers that host data in Australia (e.g., cloud data centres located in Sydney);

(ii)software development and support partners (e.g., Castle Digital);

(iii)payment processors (e.g., Stripe);

(iv)email and marketing automation tools (e.g., Klaviyo, SendGrid or similar);

(v)analytics, logging, and monitoring tools;

(vi)AI technology providers used to generate Platform outputs (e.g., large language model providers such as Anthropic, engaged under appropriate data-protection arrangements);

(vii)productivity, communication and collaboration tools (e.g., providers of email, document, and video-conferencing services such as Microsoft 365, Google Workspace and Zoom); and

(viii)other vendors that support our IT, security, and operational functions;

(f)any third party to whom you or your organisation have authorised us to disclose personal information;

(g)prospective purchasers of all or part of our business or assets and their advisers, on a confidential basis; and

(h)any other person where disclosure is required or authorised by law, where we reasonably believe it is necessary to lessen or prevent a serious threat to life, health or safety, or where it is reasonably necessary in connection with the establishment, exercise, or defence of a legal claim.

We require our service providers to handle personal information in a manner consistent with this privacy policy and applicable privacy laws and to use it only for the purposes for which it is disclosed.

Some of our service providers are located overseas, or store or process personal information overseas. The countries in which our overseas recipients are located are the United States (our AI technology provider) and Pakistan (our software development and support partner).

We may update the service providers we use from time to time. Where required by law or our agreements, we will ensure that any new providers are subject to appropriate privacy and security obligations and will update our customer-facing materials to reflect material changes.

6STORAGE OF YOUR PERSONAL INFORMATION

We store personal information on servers located in Sydney, Australia.

Some processing occurs overseas. When you use an AI-assisted feature, the relevant inputs are processed by our AI provider, Anthropic, on infrastructure located in the United States. This occurs whenever an AI feature is used. Anthropic does not use this information to train its models and retains it only for a short period before deletion.

In addition, our development team located in Pakistan may access production systems where necessary for technical support and incident response. This access is limited to those purposes.

Where we disclose personal information overseas, we take reasonable steps to ensure that the recipient will handle the information in a manner consistent with this privacy policy and the Privacy Act, including by putting in place appropriate contractual safeguards where required.

7SENSITIVE INFORMATION

7.1collection of sensitive information

We may collect sensitive information about you where it is reasonably necessary for or directly related to our functions and activities and you have given your consent, or where otherwise permitted or required by law. In the context of our Platform, this may occur where you or your organisation upload or enter sensitive information about you or others, or where such information is provided to us in connection with our Services.

7.2types of sensitive information we collect

The sensitive information we collect may include:

(a)health information about you in an employment context, such as information relating to illness, injury, disability, medical restrictions, or return-to-work arrangements;

(b)information about workplace performance, grievances, complaints, misconduct, disciplinary matters, and workplace investigations;

(c)information about racial or ethnic origin, trade union membership, or other protected attributes to the extent it is entered into the Platform or otherwise provided to us in connection with the Services; and

(d)any other sensitive information that you or your organisation choose to provide to us or that is otherwise reasonably necessary for us to provide the Services.

7.3how we use and disclose sensitive information

We will only use and disclose sensitive information for the purpose for which it was provided or for directly related purposes that you would reasonably expect, including:

(a)providing, operating, and supporting the Services for you and the organisation you represent;

(b)assisting with HR, governance, compliance, and employment-related processes carried out through the Platform;

(c)complying with our legal and regulatory obligations, resolving disputes, and enforcing our agreements; and

(d)any other purpose to which you have expressly consented or which is otherwise permitted or required by law.

8DE-IDENTIFICATION TOOLS

Our Platform may include tools or guidance designed to assist subscribers to de-identify personal information before it is entered into the Platform.

Any decision about whether information has been adequately de-identified for legal or compliance purposes remains the responsibility of you and your organisation. We do not verify, certify, or guarantee that information has been effectively de-identified, and we are not responsible for any consequences arising from a failure to appropriately de-identify information or to use available de-identification tools.

Where you enter information that remains personal information or sensitive information, this privacy policy and our other applicable terms will continue to apply.

Where we de-identify personal information for our own purposes, we take reasonable steps to do so in a way that is consistent with applicable OAIC guidance, including ensuring that the risk of individuals being reasonably re-identified is very low in the relevant context.

Where we have de-identified information so that it can no longer reasonably be linked to an identifiable individual, we may use and disclose that de-identified information for our legitimate business purposes, including analytics, research, and improving our Services. We will not attempt to re-identify de-identified information, except where permitted or required by law (e.g., for security or fraud-prevention purposes).

9MARKETING

We may at times send you marketing communications which will be done in accordance with the Spam Act 2003 (Cth) (Spam Act).

If we do, we may use email, SMS, social media, phone or mail to send you direct marketing communications.

Where consent is needed, we will ask you for your consent before sending you marketing communications, except where you:

(a)have explicitly opted in to receiving email marketing from us in the past; or

(b)were given the option to opt-out of email marketing when you initially signed up for one of our platforms and you did not do so.

You can, at any time, opt out of receiving marketing materials from us by using the opt-out facility provided (e.g., an unsubscribe link on emails we send you) or by contacting us via the details provided at the end of this privacy policy. We will implement such a request as soon as possible, however, cannot guarantee that such a response will be immediate.

10SECURITY

We take reasonable steps to protect personal information that we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include a combination of technical, organisational, and administrative safeguards, such as access controls, encryption in transit and at rest (where appropriate), network and infrastructure security measures, logging and monitoring, and staff training.

We are working toward alignment with recognised security frameworks (such as SOC 2 Type II and ISO 42001) and will update this privacy policy as our security posture evolves. However, we do not represent that we currently hold any particular certification unless expressly stated.

While we take reasonable steps to secure personal information within our systems, we cannot guarantee the security of information transmitted to us over the internet or stored on systems that we do not control. You are responsible for implementing appropriate safeguards on the devices, networks, and accounts you use to access the Services, including keeping your credentials secure and up to date.

11DATA RETENTION AND DELETION

We retain personal information for as long as it is reasonably necessary for the purposes described in this privacy policy or as required by law or under our agreements with the organisation you represent.

Where our agreement with a subscriber ends (e.g., on cancellation or expiry of a subscription), we may retain subscriber data for a limited period to allow the subscriber to export or retrieve information from the Platform. After that period, we may retain records for a period of up to seven years. We reserve the right to delete or de-identify personal information held in the Platform environment, unless we are required or permitted to retain it for longer (e.g., to comply with legal obligations, resolve disputes, or enforce agreements).

Different retention periods may apply to different types of records and systems (such as backup or archival systems). Where we de-identify personal information, we may use and retain the de-identified information for our legitimate business purposes.

12DATA PROCESSING ARRANGEMENTS

In many cases, we act as a service provider to organisations that use our Platform and process personal information on their behalf. In those circumstances, our collection, use, disclosure and retention of personal information may also be governed by a Data Processing Agreement, Terms and Conditions, or other contract between us and that organisation.

If there is any inconsistency between this privacy policy and an applicable agreement between us and your organisation, that agreement prevails to the extent of the inconsistency. Nothing in any such agreement limits our obligations to you under the Privacy Act and the Australian Privacy Principles.

13OVERSIGHT FUNCTIONALITY

Our Platform may allow authorised users to access an oversight view of the work, decisions, actions, documents, satisfaction scores, and other activity of users within their team or reporting structure. This oversight functionality is a core feature of the Platform and is designed to support governance, transparency, and fair process.

If you are invited to use the Platform by an organisation, your work within the Platform may be visible to authorised oversight users within that organisation. We will make this clear at the point of sign-up or onboarding, for example by displaying a notice that your work, decisions, and documents may be visible to your manager or other authorised leaders on the Platform.

Oversight access is limited to information and activity within the Platform and must only be used for legitimate purposes related to HR governance, people management, and business operations. Oversight users are responsible for using the information they can access in accordance with applicable laws and regulations.

Where a user’s account is disconnected from an organisation or team (e.g., due to a change in role or termination of employment), oversight access to that user’s current records will be removed in accordance with the organisation’s configuration and our technical capabilities, subject to any legal or regulatory record-keeping obligations.

14LINKS

Our website may contain links to other websites. Those links are provided for convenience and may not remain current or be maintained. We are not responsible for the privacy practices of those linked websites and we suggest you review the privacy policies of those websites before using them.

15REQUESTING ACCESS OR CORRECTING YOUR PERSONAL INFORMATION

If you wish to request access to the personal information we hold about you, please contact us using the contact details set out below including your name and contact details. We may need to verify your identity before providing you with your personal information. In some cases, we may be unable to provide you with access to all your personal information and where this occurs, we will explain why. We will deal with all requests for access to personal information within a reasonable timeframe.

If you think that any personal information we hold about you is inaccurate, please contact us using the contact details set out below and we will take reasonable steps to ensure that it is corrected.

16COMPLAINTS

If you wish to complain about how we handle your personal information held by us, please contact us using the details set out below including your name and contact details. We will investigate your complaint promptly and respond to you within a reasonable timeframe.

17CONTACT US

For further information about our privacy policy or practices, or to access or correct your personal information, or make a complaint, please contact us using the details set out below:

Name: Jessie Ivancic

Email: trust@o-hr.com.au

Our privacy policy was last updated on July 2026.