Privacy Policy

1. Who this Policy applies to

This Policy is issued by HUMANBIZ PTY LTD (ABN 39 621 981 137) on behalf of the HumanBiz Group entities (Quickcrew Pty Ltd, and the WX and HX supplying entities). It explains how we collect, use, store, disclose and protect personal information as defined by the Privacy Act 1988 (Cth).

It applies to information we collect from:

• Candidates and applicants for placement (whether or not engaged).
• Current and former workers (casuals, fixed-term employees, contractors, trainees).
• Emergency contacts of workers.
• Host-site personnel we deal with in the course of placement.
• Visitors to our offices and users of our digital systems (workforce-compass portal, website, email).

2. What personal information we collect

The categories of personal information HumanBiz collects depend on the relationship. The table below sets out what we collect and why.

3. How we collect personal information (APP 3)

Wherever practical, we collect personal information directly from you through:

• The HumanBiz workforce-compass online application portal.
• Forms you complete during onboarding, induction and ongoing employment.
• Documents you upload (passport, visa grant notice, bank details, medical certificates).
• Electronic signatures captured for the Employment Pack and induction acknowledgements.
• Direct conversation, phone, SMS, email or messaging app.

In limited circumstances we collect personal information from third parties with your knowledge:

• VEVO (Department of Home Affairs) — to verify visa conditions and right to work.
• Pre-employment medical clinic — results of fitness-for-work assessment.
• Workers' compensation insurer — claims correspondence for injured workers.
• Host site (WAMMCO) — performance, incident, attendance and payroll data.
• References — only with your prior consent for new applicants.

4. Why we collect and use personal information (APP 6)

We use your personal information only for purposes connected with your engagement, our legal obligations, and the legitimate operation of our business:

• Assess your application and place you at a host site.
• Process your pay, superannuation and tax remittance.
• Verify your right to work in Australia under the Migration Act.
• Comply with WHS, food-safety and export-meat statutory record-keeping requirements.
• Manage workers' compensation, return-to-work and rehabilitation processes.
• Investigate workplace incidents, disciplinary matters and whistleblower disclosures.
• Maintain emergency contact information for use in an emergency.
• Operate and secure the workforce-compass portal and our IT systems.
• Respond to enquiries, complaints, requests and legal process.

We will not use your personal information for any other purpose without your consent, unless we are required or authorised to do so by law.

5. Sensitive information (APP 3.3)

Some categories of information (medical, religion-related dietary, union membership) are sensitive information under the Privacy Act and require a higher standard of protection. We collect sensitive information only:

• With your express consent (e.g. medical questionnaire, dietary disclosure for canteen meal planning); or
• Where collection is required or authorised by an Australian law (e.g. Q-fever screening for animal-contact work; medical records relating to a workers' compensation claim); or
• Where collection is necessary to lessen or prevent a serious threat to life, health or safety.

6. Disclosure of personal information (APP 6, APP 8)

We disclose personal information only to the extent necessary for the purposes set out in Section 4. Common recipients include:

We do not sell personal information. We do not disclose personal information for direct marketing by third parties.

7. Cross-border disclosure (APP 8)

Our primary data hosting is in Australia (Supabase Sydney region for the workforce-compass portal). Where data is held in services that may store or process data outside Australia (for example, certain Google Workspace components, Microsoft 365, or backup providers), we take reasonable steps to ensure the overseas recipient handles the data in a manner consistent with the Australian Privacy Principles. Where this is not possible, we obtain your consent before disclosure.

8. Data quality (APP 10)

We take reasonable steps to ensure the personal information we hold is accurate, up to date, complete and relevant. You can help us by promptly notifying HumanBiz Admin of any change to your name, address, contact details, bank account, visa status, or emergency contact.

9. Data security (APP 11)

We protect personal information using physical, administrative and technical safeguards proportionate to the sensitivity of the information:

• Encryption in transit (TLS 1.2+) for all web and email traffic.
• Encryption at rest for the workforce-compass database and document storage (Supabase Sydney).
• Role-based access control — only HR admins (defined by email domain and explicit role) can access non-anonymous worker records. Workers see only their own record.
• Row-level security (RLS) enforced at the database tier; all queries verified against authenticated user identity.
• Multi-factor authentication required for admin accounts.
• Audit logging — every record access and change is logged with user, time and IP.
• Locked physical storage for any paper records, including signed Employment Packs.
• Vendor due diligence for cloud providers — only providers with current security attestations (e.g. SOC 2, ISO 27001) for sensitive workloads.
• Staff training — annual privacy and security training for all officers and admins.

10. Retention & destruction (APP 11.2)

When personal information is no longer required for any purpose under this Policy or by law, we destroy it securely (shredding for paper; cryptographic erasure for digital).

11. Your rights (APP 12, APP 13)

11.1 Access to your information

You may request a copy of the personal information we hold about you at any time. Send a request to admin@humanbiz.com.au stating "Privacy access request — [your name]". We will respond within 30 days. There is no charge for a reasonable first request; a reasonable fee may apply for repeat or extensive requests.

11.2 Correction of your information

If any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may ask us to correct it. We will respond within 30 days and either correct the record or, if we disagree, attach your statement of correction to the record.

11.3 Complaints about privacy handling

If you believe we have breached the Australian Privacy Principles or this Policy:

1. Contact HumanBiz Admin at admin@humanbiz.com.au with details. We will acknowledge within 5 business days and respond substantively within 30 days.
2. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au · 1300 363 992.

12. Data breach response (Part IIIC Privacy Act)

HumanBiz operates under the Notifiable Data Breaches (NDB) scheme. A data breach occurs when personal information held by HumanBiz is lost, accessed without authorisation, or improperly disclosed.

12.1 What we do if a breach occurs

1. Contain — stop the breach (revoke access, isolate systems) within hours.
2. Assess — determine the nature, extent and risk of harm within 30 days.
3. Notify the Information Commissioner (OAIC) if the breach is likely to result in serious harm to any affected individual.
4. Notify affected individuals directly (by the most practicable means — typically email and/or SMS) with: a description of the breach, the kinds of information involved, recommended protective steps, and our contact for questions.
5. Remediate — fix root cause, update controls, retrain staff.
6. Report internally to the Managing Director and document the incident in the Data Breach Register (retained 7 years).

12.2 What you should do if you suspect a breach

If you become aware of a possible privacy breach (e.g. you received another worker's payslip, a password was shared, a laptop was lost):

• Notify HumanBiz Admin immediately at admin@humanbiz.com.au with subject "Suspected Privacy Breach".
• Do not disseminate the affected information further.
• Reasonable, good-faith reports of suspected breaches are protected — you cannot be punished for reporting.

13. Cookies, analytics and website

The HumanBiz website (humanbiz.com.au) and the workforce-compass portal use a small number of cookies and similar technologies to support authentication, session management and basic analytics. We do not use third-party advertising cookies. The workforce-compass portal sets a session token bound to your authenticated account and used solely for security; it expires when you log out or after inactivity.

14. Children's privacy

We do not knowingly engage workers under the age of 18 at WAMMCO Katanning. If we collect any information from a person under 18 in error, we will delete it on request.

15. Updates to this Policy

We may update this Policy from time to time. The current version is always available at humanbiz.com.au/privacy and on the workforce-compass portal. Where we make a material change that affects how we handle existing workers' information, we will notify affected workers by email.

16. Contact

17. Policy Approval

This Policy is approved and adopted by HumanBiz Pty Ltd as the binding standard for the handling of personal information across the HumanBiz Group entities.

Approval

Approved By	Edwin Yeo, Managing Director, HumanBiz Pty Ltd
Signature
Date of Approval	12 May 2026
Document Owner	HumanBiz Privacy Officer (admin@humanbiz.com.au)

Related documents: HB-HR-POL-001 (Absence & Attendance), HB-HR-POL-002 (Whistleblower), HB-HR-POL-003 (Code of Conduct), HumanBiz Health & Safety Handbook, HumanBiz Mobile Phone & Social Media Policy. This document is maintained by HumanBiz Pty Ltd under the Privacy Act 1988 (Cth) and made publicly available via humanbiz.com.au/privacy.