How We Handle Your Personal Information

1. Scope and our commitment

ContractRight is committed to handling personal information responsibly. This policy applies to personal information we handle through our website and in the course of providing contractor and contingent workforce services.

Where the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Privacy (Tax File Number) Rule 2015 or other privacy requirements apply to us, we handle personal information in accordance with those requirements.

This policy replaces the shorter website-only privacy policy previously published by ContractRight. It is intended to describe our actual information-handling practices more clearly. It is not a contract and does not rely on your continued use of the website as consent to unrelated uses of personal information.

2. What personal information we collect and hold

The information we collect depends on how you deal with us. It may include:

• Contact and identity details such as your name, email address, phone number, residential or business address and date of birth where relevant.
• Business and enquiry information such as your organisation, role, industry, workforce structure, correspondence and information you provide when requesting an assessment or contacting us.
• Contractor engagement information such as work history, skills, qualifications, licences, availability, assignment details, timesheets, performance or service records and related communications.
• Payment, taxation and statutory information where needed to administer an engagement, including bank/payment details, tax declarations, Tax File Number (TFN) information where we are lawfully authorised to collect it, superannuation information and records required for payment or reporting.
• Insurance and claims information where relevant to workers’ compensation, public liability or other insurance arrangements.
• Technical information generated when you use our website, such as IP address, browser and device information, referring pages, timestamps and security/server log information.

We may also collect sensitive information where it is reasonably necessary for our functions and where you consent or the law otherwise permits it. Depending on the engagement, this could include health information relevant to an insurance or workers’ compensation matter, professional memberships, or criminal history information where a role lawfully requires screening.

You can generally browse our website without identifying yourself. For some enquiries you may use a pseudonym, but we may need your real identity where it is impracticable to provide the requested service without it or where identification is required by law.

3. How we collect and hold personal information

We usually collect personal information directly from you, including when you contact us, complete a website form, speak with us by phone or email, provide documents, participate in an assessment, or enter into or administer an engagement with ContractRight.

We may also collect information from other sources where appropriate, such as a client organisation, a referrer, your authorised representative or professional adviser, insurers, service providers, publicly available sources, or government and regulatory bodies.

We may hold information electronically and, where required, in physical records. Electronic information may be held in business systems, email, document storage, payment/administration systems and secure service-provider environments.

4. Why we collect, hold and use personal information

We use personal information for purposes connected with our business, including to:

• respond to enquiries and provide assessments, proposals, advice and requested information;
• establish, manage and administer client and contractor relationships and assignments;
• onboard contractors and verify information relevant to an engagement;
• manage payment administration, taxation, superannuation, insurance, workers’ compensation and other statutory obligations where applicable;
• communicate with clients, contractors, advisers and service providers;
• manage records, complaints, disputes, audits, compliance and legal obligations;
• protect our systems, detect fraud or misuse, and maintain website and information security;
• improve our services and website using aggregated, de-identified or operational information where appropriate; and
• send direct marketing where permitted by law and subject to your right to opt out.

If we want to use personal information for a materially different purpose, we will only do so where permitted by law, including where you have given appropriate consent.

5. Who we may disclose personal information to

We do not sell or rent personal information. We may disclose personal information where reasonably necessary for the purposes above, including to:

• clients and contractors involved in an assignment, but only to the extent reasonably necessary for the engagement;
• accountants, lawyers, auditors and other professional advisers;
• insurers, workers’ compensation bodies and claims service providers;
• payment, payroll, tax, superannuation and administration providers where relevant;
• website form-processing providers used to transmit enquiries to us;
• IT, hosting, cloud storage, email, security and other technology service providers;
• government agencies, regulators, courts, tribunals or law-enforcement bodies where required or authorised by law; and
• another party in connection with a genuine or proposed sale, restructure or transfer of the business, subject to appropriate confidentiality and privacy safeguards.

We may use or disclose aggregated or de-identified information that does not reasonably identify an individual for business planning, analytics or service improvement.

6. Tax File Number information

ContractRight’s contractor model may require us to handle TFN information for taxation, payment or superannuation administration where we are lawfully authorised to do so.

TFN information is subject to specific legal protections. We only collect, record, use, disclose, store and dispose of TFN information where permitted by taxation, superannuation or other applicable law and the Privacy (Tax File Number) Rule 2015. We do not use a TFN as a general-purpose identifier.

Where we request a TFN, the relevant collection process should explain why it is being requested, the legal basis for the request, that providing it is not itself compulsory, and any consequences that may follow if it is not provided.

7. Website information, cookies and third-party services

When you visit our website, our hosting environment and third-party services used to deliver website content may receive standard technical information such as your IP address, browser type, device type, requested pages and timestamps. This information is commonly used for security, troubleshooting and website operation.

Our website enquiry form is processed using FormSubmit.co. Information you enter in the form is transmitted to that service so it can forward the enquiry to us by email. FormSubmit states that form submissions are retained in its submission archive for 30 days. We use this service for form delivery and do not use it to send marketing on our behalf.

Our website may use cookies or similar technologies that are necessary for functionality, security or user experience. You can usually configure your browser to reject or notify you about cookies, although some website functions may then work differently.

The current site does not rely on this policy as consent for advertising tracking. If we introduce analytics, advertising or other tracking that materially changes how personal information is handled, we will update our notices, consent controls where required, and this policy as appropriate.

Our website may contain links to third-party websites. Those sites have their own privacy practices and we are not responsible for how they handle information after you leave our website.

8. Direct marketing

Where permitted by law, we may use contact details to send information about ContractRight services, resources or updates that may be relevant to you. We will provide a simple way to opt out of direct marketing and will respect an opt-out request within a reasonable period.

You can opt out at any time by using the unsubscribe method in a marketing message or by contacting us at contact@contractright.com.au. Service or administrative communications that are necessary for an existing relationship are not treated as marketing merely because they relate to our services.

9. Overseas disclosure and processing

Some technology, cloud, email or website service providers may store or process information outside Australia. Depending on the providers in use, this may include the United States and other countries in which those providers operate infrastructure or support services.

Where the Privacy Act applies to a disclosure of personal information to an overseas recipient, we take reasonable steps required by APP 8 to ensure the information is handled consistently with the APPs, unless an exception applies. Because provider infrastructure can change, it may not always be practicable to list every country in advance.

10. Security, data breaches and retention

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include access controls, appropriate technology safeguards, staff procedures, restricted access to higher-risk information and secure disposal practices.

No internet transmission or storage system can be guaranteed to be completely secure. If a data breach occurs, we will assess and respond to it in accordance with applicable law, including the Notifiable Data Breaches scheme where it applies.

We retain personal information for as long as reasonably needed for the purpose for which it was collected, to maintain business and engagement records, or to meet legal, taxation, insurance, dispute-resolution or record-keeping obligations. When information is no longer required and we are not required by law to retain it, we take reasonable steps to destroy it or de-identify it.

11. Accessing or correcting your personal information

You may ask us to provide access to personal information we hold about you or to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Send your request to contact@contractright.com.au or call 1300 358 431. We may need to verify your identity before acting on the request. We will respond within the timeframe required by applicable law and will explain any lawful reason for refusing access or correction.

We do not ordinarily charge for making a request. If the law permits a reasonable charge for providing access in a particular form, we will tell you before incurring the cost.

12. Privacy complaints

If you believe we have mishandled your personal information, please contact us first so we can investigate the issue. Include enough detail for us to understand the concern and how you would like it resolved.

We will acknowledge and investigate privacy complaints in a fair and reasonable manner and aim to provide a substantive response within 30 days where practicable.

If you are not satisfied with our response and the Privacy Act applies, you may be able to complain to the Office of the Australian Information Commissioner (OAIC). Information about making a complaint is available at oaic.gov.au/privacy/privacy-complaints.

13. Changes to this policy

We may update this policy when our services, technology, information-handling practices or legal obligations change. The current version will be published on this page with the date of the latest update. Where a change is significant, we may also take additional reasonable steps to notify affected individuals.