Privacy Policy

Last updated Apr 12, 2023

SiteApprove Privacy Policy

This is the privacy policy of SiteApprove TA Citus Co Pty Ltd ACN 638 733 687 (SiteApprove, we, us). It applies to all personal information we collect and use in connection with our business, including via our website (www.citussystems.com.au), and the Citus on-boarding and compliance management platform (Platform).

We comply with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles, which regulate how we may collect, use, disclose and store personal information. This privacy policy is intended to keep you informed of the ways we collect, use, disclose, store and protect your personal information and help you to understand your rights (and our obligations) under the Privacy Act.

Changes to this privacy policy

We keep our privacy policy under regular review to make sure it is up to date and accurate. If we update it, we will update the “effective date” at the top of this page. If we make a material update, we will provide you with notice prior to the update taking effect, such as by posting a notice on our website or Platform.

We encourage you to periodically review this privacy policy to stay informed about how we collect, handle, store and share your personal information.

What personal information do we collect and handle?

Personal information generally means any information about an identified individual, or an individual who is reasonably identifiable from the information. It does not include data where the identity has been removed and it is not possible to connect the data to the individual. We may collect and use different kinds of personal information related to our business functions and activities and when it is necessary and relevant to our relationship with you.

Our business functions and activities primarily involve providing the Platform and its functionality to you and other users. The Platform is intended to be used as an on-boarding and compliance management tool to support safety and compliance in various industries by:

facilitating the sharing of certificates, tickets, medical assessments and other compliance information and documentation relating to individuals (Certification Documentation); and
enabling hiring entities and managers to access and manage the Certification Documentation of their workforce, both during the on-boarding process and on an ongoing basis, to support compliance and effective resource management.

The nature of our Platform means that we may collect a broad range of personal information about you, depending on our engagement with you and the types of Certification Documentation (if any) you upload to our Platform.

The types of information we collect may include (but is not limited to):

your name and contact information, including your postal address, email address and phone number;
all Certification Documentation you upload to the Platform;
the name and contact details of any recipients that you nominate to be provided access to your Certification Documentation through your account settings;
other information and material you provide to us through our website, or that we reasonably need to collect to administer our business, such as contact and billing information; and
data we collect automatically about how you use and interact with our website and Platform.

We may collect and hold sensitive information about you, such as health information contained in a medical assessment, but only if you provide this information to us directly by uploading Certification Documentation containing that information to our Platform.

We will not generally view or access your Certification Documentation. However, we may do so if necessary to carry out one of the purposes stated in this privacy policy (such as to comply with your directions, or our legal and regulatory obligations).

Why do we collect, use and disclose your personal information?

We collect personal information about you that we reasonably need for our business functions and activities, which include:

providing the Platform and associated services to you, including allowing registered users to upload Certification Documentation and nominate preferences;
providing you with ongoing access to your Certification Documentation; and
providing access to your Certification Documentation to others you nominate through your account settings.

As part of conducting our business, we may also collect, hold, use and disclose personal information to:

communicate with you, including by sending you emails, tax invoices, receipts and push notifications via the Platform;
provide you with promotional information about our products and services, such as by sending you email newsletters;
comply with our legal and regulatory obligations; and
provide you with our services, respond to your requests for support, or deal with your complaints or enquiries.

We will not use or disclose your Certification Documentation for any purpose, other than as directed by you through your Platform account preferences, or as otherwise expressly stated in this privacy policy.

How we collect information about you

Where it is reasonably practical to do so, we will collect your personal information directly from you. We may collect the personal information you directly give us through some of the following means:

when you enter personal information directly into our website or Platform, including when you upload Certification Documentation to our Platform; and
when you communicate with us, such as when you contact us by telephone or email, or send an enquiry through our website.

In certain cases we may collect personal information from publicly available sources and third parties, such as when a user of our Platform nominates you as a recipient to access their Certification Documentation.

If we collect personal information about you from a third party we will, where appropriate, request that the third party inform you that we are holding such information, how we will use and disclose it, and that you may contact us to gain access to and correct and update the information. If we receive personal information about you that we have not requested, and if we determine that we could not have lawfully collected that information under the Privacy Act, we will destroy or de-identify the information if it is lawful and reasonable to do so.

You must only provide us with the personal information of someone else if you have that person’s consent to disclose that information to us and for us to use that information in accordance with this privacy policy.

Do I have to provide you with my personal information?

You can deal with us anonymously (without giving us your name and contact details) or by using a pseudonym in some limited circumstances. If you contact us by phone or other means and ask to remain anonymous, you may do so and we will try to answer your request without seeking identifying details.

However, if you choose to deal with us anonymously, there are some things we cannot do. For example, you will not be able to register as a user of our Platform because we will not be able to enter into a legally binding agreement with you if we don’t know your identify.

Disclosure of personal information to third parties

We may disclose your personal information to the third parties set out below for any of the purposes set out above. The types of third parties with whom we disclose personal information include:

third parties nominated by you;
our employees, contractors and related bodies corporate;
our professional advisors; and
other persons, including government agencies, regulatory bodies, and law enforcement agencies, if authorised or required by law.

Protection of your personal information

Our Platform, and all of the personal information you provide to us, is hosted in Australia.

We generally hold all personal information in cloud storage. However, we may also hold personal information as secure physical records, electronically on our intranet system, and on third party servers. We maintain appropriate physical, procedural and technical security for our information storage facilities so as to prevent any loss, misuse, unauthorised access, disclosure, or modification of personal information. This also applies to disposal of personal information.

We further protect personal information by restricting access to personal information to only those who need access to the personal information do their job, and we will destroy or de-identify your personal information once it is no longer needed for a valid purpose or required to be kept by law.

Marketing

If you opt in to receive marketing communications from us, we may use your personal information (such as your contact details) to provide you with information about our services. You may opt out at any time if you no longer wish to receive marketing information from us. You can do this by using the 'unsubscribe' function included in our marketing emails or by contacting our Privacy Officer on the details below.

We will not disclose your personal information to third parties for marketing purposes without your consent and we will never access, use or disclose your Certification Documentation for marketing purposes.

Cookies

When you visit our site, we record general information about your visit for statistical purposes. These statistics do not contain any personally identifiable information.

We use “cookies” to store your preferences, record session information and collect information on how you visit and access our web pages. This helps us deliver and continue to improve our services. Cookies are small pieces of information that a web page transfers to your computer’s hard disk for record-keeping purposes. Cookies make the Website more useful by storing information about your preferences on a particular site. Cookies in and of themselves do not personally identify you, only your computer. You can delete cookies from your computer at any time. For information on cookie settings of your internet browser, please refer to your browser’s manual.

Overseas disclosures

As at the date of this privacy policy, we are not likely to disclose your personal information to overseas recipients. If in future we do propose to disclose personal information overseas, we will do so in compliance with the requirements of the Privacy Act. We will, where practicable, advise you of the countries in which any overseas recipients are likely to be located. If you do not want us to disclose your information to overseas recipients, please let us know.

Accessing and correcting your personal information

If you hold an account on our Platform, you may access and edit some of the personal information we hold about you by logging in to your account on the Platform.

You may also contact our Privacy Officer using the contact details below to request access to, or a correction of, the personal information that we hold about you. We will deal with your request within a reasonable time. On the rare occasion that we refuse access, we will provide you with a written notice setting out the reasons for the refusal and the relevant provisions of the Privacy Act that we rely on to refuse access. We will also provide you with avenues to complain about our refusal to provide you with access to the information.

We are not obliged to correct any of your personal information if we do not agree that it requires correction. If we refuse a correction request, we will provide you with a written notice with our reasons for refusing. We may recover reasonable costs in relation to a request for access to personal information.

Resolving personal information concerns

If you have any questions, concerns or complaints about this privacy policy, or how we handle your personal information, please contact our Privacy Officer by emailing hello@SiteApprove.com.au

We take all complaints seriously, and will respond to your complaint within a reasonable period. You may also lodge a complaint with the Office of the Australian Information Commissioner by telephone: 1300 363 992 or email: enquiries@oaic.gov.au.