Privacy Policy

1. About this Privacy Policy

SubStatus is a subcontractor compliance management service operated in Australia. This Privacy Policy explains how SubStatus collects, holds, uses and discloses personal information when you use our website, application and related services.

We aim to handle personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply to us.

2. Personal information we collect

The information we collect depends on how you interact with SubStatus. It may include:

• account information, such as your name, email address and business details;
• subcontractor information entered into SubStatus, including names, business names, email addresses, phone numbers, trade information and ABNs;
• compliance information, including required document types, licences, insurance information and expiry dates;
• documents and files uploaded through SubStatus, including documents uploaded using a secure document request link;
• information relating to document requests, submissions, reviews and reminders;
• communications you send to us, including support or privacy enquiries; and
• technical and usage information that may be generated when you access or use the service, such as information necessary to operate, secure and diagnose the service.

We ask users not to upload personal information that is not reasonably necessary for subcontractor compliance management.

3. How we collect information

We may collect personal information directly from you when you create an account, use SubStatus, contact us or upload information.

We may also receive personal information from businesses using SubStatus. For example, a contractor may enter a subcontractor's business and contact details into SubStatus, or a subcontractor may submit information and documents through a document request link.

Some technical information may be collected automatically when the service is accessed or used.

4. Why we use personal information

We may use personal information to:

• provide and operate SubStatus;
• create and manage user accounts;
• manage subcontractor compliance records;
• store and display compliance documents;
• track missing, valid and expiring documents;
• send requested document upload links;
• send operational notifications and compliance reminders;
• review and improve the reliability of the service;
• provide support and respond to enquiries;
• protect the security and integrity of SubStatus;
• prevent misuse, fraud or unlawful activity; and
• comply with applicable legal obligations.

5. Information about subcontractors

Businesses using SubStatus may provide personal information about their subcontractors. Those businesses are responsible for ensuring they are authorised or otherwise permitted to provide that information to SubStatus and to use it for their compliance management purposes.

Subcontractors may also provide information directly through secure document request links. A SubStatus account is not required to use those links.

6. How we disclose information

We do not sell personal information.

We may disclose or make personal information available where reasonably necessary to operate SubStatus, including to technology, hosting, database, storage, authentication, email delivery and other service providers that support the operation of the service.

We may also disclose information where required or authorised by law, to protect our legal rights, or where necessary to protect the security of SubStatus, our users or others.

7. Overseas processing and disclosure

Some technology and service providers used to operate SubStatus may process or store information using infrastructure located outside Australia.

Where applicable, we take reasonable steps appropriate to the circumstances to ensure personal information disclosed to overseas recipients is handled consistently with applicable Australian privacy requirements.

The countries in which information may be processed can change depending on the infrastructure and service providers we use. Where it is practicable to identify relevant overseas locations, we will update this Privacy Policy accordingly.

8. Security

We take reasonable technical and organisational measures designed to protect personal information against loss, interference, misuse and unauthorised access, modification or disclosure.

However, no internet service, electronic transmission or storage system can be guaranteed to be completely secure. Users are responsible for keeping their account credentials secure and should notify us if they believe their account or information has been compromised.

9. Data retention and deletion

We retain personal information for as long as reasonably necessary to provide SubStatus, maintain legitimate business records, resolve disputes, protect the service and meet applicable legal obligations.

SubStatus provides functionality that allows certain subcontractor records to be archived and permanently deleted. Some information may need to be retained where required by law or where reasonably necessary for security, dispute resolution or legitimate record-keeping purposes.

10. Access and correction

You may contact us to request access to personal information we hold about you or to ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

We may need to verify your identity before responding to a request. In some circumstances permitted by law, we may refuse or limit access and will explain the reason where required.

11. Privacy complaints

If you have a concern about how SubStatus has handled your personal information, please contact us first using the details below. We will review the complaint and aim to respond within a reasonable period.

Where applicable, you may also have the right to contact the Office of the Australian Information Commissioner (OAIC) regarding a privacy complaint.

12. Data breaches

If we become aware of a data breach involving personal information, we will assess and respond to the incident and, where required by applicable law, notify affected individuals and relevant authorities.

13. Changes to this Privacy Policy

SubStatus will continue to evolve. We may update this Privacy Policy when our product, technology providers, information handling practices or legal obligations change.

The latest version will be published on this page and the "Last updated" date will be changed when the policy is updated.

14. Contact us

For privacy questions, access or correction requests, or complaints, contact: