Privacy policy
How Workplace Automate collects, holds, uses and protects personal information, on our website and in the Workplace Automate platform.
Effective date: 15 October 2026
1. Who we are
Workplace Automate is a cloud platform for human resources and work health and safety compliance, supplied by Workplace Automate Pty Ltd (ACN 702 669 832) of Perth, Western Australia (we, us, our). This policy covers our website at workplaceautomate.com.au, our sign-up form, and the Workplace Automate platform at field.workplaceautomate.com.au.
We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), and the Privacy (Tax File Number) Rule 2015 for tax file numbers.
2. Two kinds of information, and our role in each
We hold personal information in two different capacities, and it matters which one applies.
- Information about our customers and website visitors. This is information about the businesses that subscribe to Workplace Automate and the people who deal with us on their behalf: for example, the person who signs up, the administrator, anyone who contacts us, and anyone who subscribes to our newsletter. We decide how this information is used, and this policy applies to it in full.
- Information our customers put into the platform about their people. Our customers are employers. They use the platform to keep their own employment and safety records about their workers, contractors and candidates. That information belongs to the employer. The employer decides what is collected and why, and is responsible for telling their people about it. We hold and process it on the employer’s behalf, under our agreement with them, and only to provide the platform. We do not use it for our own purposes, and we never sell it.
If you are a worker and have a question about why your employer collects something, or who in your business can see it, please ask your employer first. They control your record, and their own privacy policy also applies to it.
3. Information we collect about customers and website visitors
- Business details: business and legal entity name, ABN, address, phone, email, website and logo.
- Contact and account details: the name, email address and job title of the person who signs up, your administrator and anyone who contacts us; sign-in details (passwords are stored only in hashed form, and management logins use an authenticator app code).
- Subscription and billing: the modules you choose, your number of users, your set-up choice, invoices and payment status. Card payments are handled by a specialist payment provider. We do not see or store your full card details.
- Communications: emails, support requests, feedback and records of calls.
- Newsletter: if you subscribe on our website, your email address, your first name if you give it, when you subscribed and the page you subscribed on.
- Website information: your IP address, browser and device type, and the pages you visit, collected through our website hosting and the cookies described in section 13.
4. Information held in the platform on behalf of employers
Workplace Automate is built for employment and safety compliance, so it holds a substantial amount of information about each worker, including information the Privacy Act treats as sensitive. Depending on how an employer uses the platform, it may include:
| Category | What it includes |
|---|---|
| Identity and contact | Name, employee number, email, phone, date of birth, home address, emergency contacts, photo |
| Employment | Role, job title, start date, employment type, reporting line, site and entity, contracts, letters, policies acknowledged, performance reviews and goals, employee relations cases, offboarding records |
| Pay and time | Timesheets, leave, rosters, expense claims and receipts, pay rates and conditions |
| Tax, bank and super | Tax file number, bank account and superannuation details, submitted as a change request for payroll to apply (see section 11) |
| Health information (sensitive) | Workplace injuries and treatment, workers compensation claims, capacity, restrictions and return to work plans, medical certificates and medicals the employer records |
| Work rights | Visa and work rights details, where the employer records them |
| Safety and training | Incident, injury and hazard reports, photos, site sign-ins, inductions, SWMS and toolbox talk sign-offs, corrective actions, licences, tickets and training |
| Records of activity | Electronic signatures, document acknowledgements, timestamps of actions, and an audit trail of who changed or opened records |
Each category exists to help the employer meet an obligation: paying people correctly, keeping employee records, meeting work health and safety duties, managing performance and conduct fairly, and showing what was done and when.
5. How information is collected
We collect information about customers directly: when you sign up, use the platform, pay, or contact us. Information in the platform is entered by workers themselves or by their employer’s administrator, managers and safety staff. Some is created by ordinary use, such as the time a document was signed. Where there is no phone signal, forms and site sign-ins are held securely on the worker’s phone and sent as soon as signal returns. We do not buy personal information.
6. How we use information
We use information about customers to set up and run your subscription, provide support, bill you, keep the platform secure, tell you about changes and new features, and meet our legal obligations.
We use information in the platform only to provide the platform to the employer: to store it, show it to the people the employer allows, send the reminders and notifications the platform sends, back it up, secure it, and fix problems when asked. We do not use it to market to workers, we do not sell it, and we do not use it to train artificial intelligence models.
We do not make automated decisions that significantly affect an individual’s rights or interests.
7. Who can see information in the platform
Access within an employer’s account is controlled by role, and the rules are enforced by the database itself, not only by the screens. In summary:
| Who | What they can see |
|---|---|
| The worker | Their own records |
| Supervisors and managers | Their own team’s work, and the records they are responsible for |
| Safety roles | Safety records, including injuries and return to work |
| Payroll | Pay, timesheets, leave, claims and pay detail changes, but not safety or medical records |
| The employer’s administrator | Their own business’s records |
| An external auditor the employer invites | Safety and quality records, read only |
| Contractors | Safety only: their own site sign-ins, inductions, documents and reports |
| Workplace Automate | Only what is needed to operate, support and secure the platform |
Every employer’s information is kept separate from every other employer’s. Personal details such as home address, personal phone, date of birth and bank details are limited to the employer’s administrator and the person concerned.
8. Service providers
We use a small number of carefully chosen service providers to run Workplace Automate. They handle information only to provide their service to us, under contract, and may not use it for their own purposes. They provide:
- the platform’s database, sign-in and secure file storage, which holds the platform’s records in Australia;
- delivery of the platform’s web pages to your browser;
- sending the platform’s notification and reminder emails;
- the AI features described in section 9;
- card payment processing;
- our own business email and documents; and
- hosting for this website.
We may also disclose information to our professional advisers, and where required or authorised by law, for example to a regulator or under a court order.
9. Artificial intelligence features
Workplace Automate includes optional AI features, available to an employer’s administrator only:
- an assistant that points administrators to the right documents and explains HR processes (it never decides outcomes);
- converting an employer’s own forms into app forms; and
- converting an employer’s own letter or contract into a fillable template.
When these are used, the text the administrator types or the document they upload is sent to our AI service provider to produce the result. These features are built for questions about process and for blank templates. Administrators are asked not to include names or personal details, and the employer can switch the assistant off. Under its commercial terms, our AI provider does not use this information to train its models.
10. Sending information overseas
All of the platform’s records are stored in Australia, and are not stored overseas. Only limited information leaves Australia, briefly, while a service provider does its job:
- Notification and reminder emails are sent through an email delivery service that operates from Japan, so the recipient’s name, email address and the message pass through it as each email is sent.
- The optional AI features (section 9) are processed in the United States, using only the text an administrator chooses to enter or upload.
- Card payments for subscriptions are processed by our payment provider, which may process them in the United States.
Before disclosing information overseas we take reasonable steps to ensure the provider handles it consistently with the Australian Privacy Principles, including contractual protections.
11. How information is protected
- Information is encrypted in transit and stored with an Australian provider that encrypts it at rest.
- Access is controlled by role at the database level, so information a person is not entitled to is never sent to their device.
- Management logins require an authenticator app code as well as a password.
- Tax file numbers, bank and superannuation details are submitted as a change request, used by payroll to update the employer’s payroll system, and deleted from the platform automatically the moment payroll marks the change as applied. They are never included in exports or reports, or kept in the audit trail.
- An audit trail records who changed or opened records, and when.
- Data is backed up daily, and restoring it has been tested.
- The platform has been independently security tested by an external security specialist, and the findings are fixed and retested.
- An independent managed security provider monitors our systems on an ongoing basis, including daily vulnerability scanning of our websites, daily security scanning of our business email and document systems, weekly security reporting, and keeping our security settings to the recommended baseline.
No system is completely secure, but we keep improving these protections and act quickly on anything we find.
12. Data breaches
We have a written incident response plan. If a data breach occurs, we will contain and assess it promptly. Where information in the platform is involved, we will tell the affected employer without delay so they can inform their people. Where a breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as the Notifiable Data Breaches scheme requires.
13. Cookies and similar technologies
Our website uses cookies that are needed for it to work, and our website host may record basic visitor information for security and performance. The platform does not use advertising or tracking cookies. It stores a small amount of information on your device so it opens quickly and works without signal, such as your sign-in session and any forms waiting to be sent. You can clear this at any time through your browser settings. Our website also remembers, in your browser, whether you have closed or used the newsletter sign-up, so it does not keep appearing.
14. How long information is kept
Information in the platform is kept for as long as the employer needs it to meet their obligations. Workplace laws require many employment and safety records to be kept for years, so when a person leaves, their record is archived rather than deleted, held for seven years, and can then be permanently deleted by the employer. Tax file numbers, bank and superannuation details are purged once payroll has applied them.
If an employer ends their subscription, they can export their records first. We keep the employer’s information for 30 days after the subscription ends so it can be exported, and then delete it, unless the law requires us to keep it. Backup copies are overwritten in the normal backup cycle.
We keep information about customers for as long as you are a customer and afterwards for as long as tax and other laws require.
We keep newsletter subscribers’ details while they are subscribed. If you unsubscribe, we keep your email address marked as unsubscribed so we do not email you again. You can ask us to delete it completely.
15. Newsletter and marketing emails
If you subscribe to our newsletter, we send you HR and safety news and information. We may also send customers news about Workplace Automate and new features. Every email has an unsubscribe link, and you can unsubscribe at any time. We will still send you messages about your account and subscription. We never send marketing to workers using information held in the platform.
16. Accessing and correcting your information
You can ask for access to the personal information we hold about you, and ask us to correct it if it is wrong, out of date or incomplete. We will not charge you to make a request, and we may need to confirm your identity first.
If you are a worker, most of your information is already visible to you in the platform, and you can update some of your own details there. Because your record belongs to your employer, please ask your employer first. If you contact us, we will refer your request to your employer and help them respond.
17. Young workers
Our website and sign-up are for adults. Employers may hold records in the platform about workers under 18, such as apprentices, and those records have the same protections as everyone else’s.
18. Questions and complaints
If you have a question or a complaint about how we handle personal information, contact our Privacy Officer. We will look into it and respond in writing. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Privacy Officer
Workplace Automate Pty Ltd (ACN 702 669 832)
Perth, Western Australia
Email: info@workplaceautomate.au
19. Changes to this policy
We review this policy at least once a year and when our practices change. The current version is always on this page. Where a change is significant, we will tell our customers before it takes effect.