How WorkZerk Meets the Australian Privacy Principles
How WorkZerk is built around the Privacy Act 1988 and Australia's 13 Privacy Principles.
At WorkZerk, protecting your data isn't just a legal obligation, it's fundamental to how we've built our platform. As an Australian software company handling sensitive compliance documentation for contractors, staff, and the other people you onboard, we take the Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) seriously.
Here's how WorkZerk addresses each principle.
APP 1: Open and transparent management of personal information
What it requires: Organisations must manage personal information openly and keep a clear, up-to-date privacy policy.
How WorkZerk complies: Our Privacy Policy and Terms of Use are publicly accessible from the website footer and inside the application. We explain what data we collect, how we store it, and what we do with it. We also publish a Subprocessors list naming the third parties that help us run the service, so you can see where your data is handled.
APP 2: Anonymity and pseudonymity
What it requires: Where practicable, individuals should be able to remain anonymous or use a pseudonym.
How WorkZerk complies: WorkZerk exists to verify compliance: SWMS documents, licences, certifications, and Working With Children Checks. Australian workplace health and safety laws require verified identification for these purposes, which is a lawful exception under APP 2. Even so, our template system lets administrators collect only the minimum information their specific compliance requirements call for.
APP 3: Collection of solicited personal information
What it requires: Only collect personal information that is reasonably necessary, with a higher bar for sensitive information.
How WorkZerk complies: Our template-based onboarding gives administrators precise control over what is collected for each portal. Every step includes clear instructions explaining why the information is being requested. We collect directly from the individual (first-party collection), and sensitive information such as identification documents is only requested when it is genuinely needed for a compliance purpose.
APP 4: Dealing with unsolicited personal information
What it requires: Organisations must assess unsolicited information and destroy it if it could not have been collected legitimately.
How WorkZerk complies: The platform is designed to minimise unsolicited information, because people upload only the documents they are specifically asked for. Administrators can reject anything inappropriate, and documents can be set to delete automatically once they have served their purpose, so unnecessary data doesn't accumulate.
APP 5: Notification of collection
What it requires: Individuals must be told what is being collected and why, at or before the time of collection.
How WorkZerk complies: Each onboarding step template includes rich-text instructions explaining what is being collected and why. Our Privacy Policy and Terms of Use are available throughout the process. When onboarding is finished, the individual receives an email receipt summarising what they submitted.
APP 6: Use or disclosure of personal information
What it requires: Personal information should only be used for the purpose it was collected, with limited exceptions.
How WorkZerk complies: Data collected through WorkZerk is used solely for compliance verification and onboarding management. Disclosure is limited to authorised administrators within the subscriber's workspace. We don't sell or share data with unrelated third parties, and our Terms make clear that subscribers retain ownership of their data.
APP 7: Direct marketing
What it requires: Strict conditions apply before personal information can be used for direct marketing.
How WorkZerk complies: We do not use collected compliance data for direct marketing. Our emails are transactional: onboarding receipts, rejection notices, and expiry reminders. Our Terms also prohibit subscribers from using WorkZerk to send spam or unsolicited marketing.
APP 8: Cross-border disclosure
What it requires: Before disclosing personal information overseas, organisations must take reasonable steps to ensure it is handled consistently with the APPs.
How WorkZerk complies: WorkZerk is hosted primarily in Microsoft Azure's Australian regions. Some of the subprocessors that support the service, such as payment processing and email delivery, may handle limited personal information overseas. Where personal information is disclosed outside Australia, we take reasonable steps to ensure it is protected to a comparable standard, and where required we rely on recognised safeguards such as the Standard Contractual Clauses. Our current subprocessors, including their purpose and location, are published in our Subprocessors list.
APP 9: Government related identifiers
What it requires: Organisations generally cannot adopt government identifiers as their own identifiers for individuals.
How WorkZerk complies: WorkZerk uses its own internal identifiers (Contact IDs, Guest IDs, and Compliance IDs). Government identifiers such as ABNs, White Card numbers, or WWCC numbers are collected only for verification, never adopted as our identifier for a person. Our passwordless access uses secure 64-character random tokens.
APP 10: Quality of personal information
What it requires: Organisations must take reasonable steps to keep personal information accurate, up to date, and complete.
How WorkZerk complies: Our expiry tracking keeps credentials current and prompts for renewal as documents approach their expiry date. The rejection workflow lets administrators request corrections when something is inaccurate or incomplete, and human-in-the-loop review means critical documents are checked by a person before approval.
APP 11: Security of personal information
What it requires: Organisations must protect personal information from misuse, interference, loss, and unauthorised access.
How WorkZerk complies: Security is built into every layer of WorkZerk:
- Mandatory multi-factor authentication for administrative users
- Microsoft Azure infrastructure with enterprise-grade security
- Encrypted storage using Azure Blob Storage
- Temporary, signed access tokens for viewing documents, which expire automatically
- Passwordless onboarding, so there are no onboardee credentials to store or leak
- The option to delete sensitive documents automatically once they have been verified
- Cloudflare protection for our web infrastructure
- Comprehensive audit trails covering compliance actions
- Data retention aligned with Australian record-keeping standards
APP 12: Access to personal information
What it requires: Individuals have the right to access the personal information held about them.
How WorkZerk complies: Onboardees keep access to their portal link to view what they submitted. Administrators can export data and provide access to stored compliance records on request. The onboarding receipt emailed to each individual also summarises what they submitted.
APP 13: Correction of personal information
What it requires: Organisations must correct personal information that is inaccurate, out of date, incomplete, or misleading.
How WorkZerk complies: Our rejection workflow is built for exactly this. When an administrator rejects a submission, the individual is notified automatically with clear reasoning and can re-submit corrected documents through their portal link. Administrators can also update contact records directly when a correction is needed.
Our commitment to privacy
WorkZerk was built from the ground up with Australian privacy requirements in mind. Our Australian-hosted infrastructure, layered security, and transparent data practices reflect how seriously we take the personal information entrusted to us.
We believe compliance onboarding shouldn't come at the cost of privacy. That's why WorkZerk collects only what's necessary, protects it rigorously, and gives both administrators and individuals visibility over how their data is handled.
For more detail, see the Privacy Policy and Terms of Use linked in the footer of this site.