Data subject rights

If personal data of yours is held in WorkZerk, you have rights over it under the Australian Privacy Act, the EU and UK GDPR, and equivalent laws elsewhere. This article covers what those rights are, which ones you can exercise yourself without asking anyone, and when to write to us.

It matters more here than in most tools, because WorkZerk collects the sensitive kind: identity documents, licenses, insurance certificates, signed agreements.

Two roles, and which one you are

The answer to "who do I ask" depends on which side of a portal you are on, so start here.

If you run a WorkZerk account, you are the controller of your contractors' and staff members' data. We process it on your behalf. You decide what to collect, how long to keep it, and when to delete it. Your own account data (login, billing) is a separate matter, and there we are the controller.

If you were invited to a portal, the company that invited you is the controller. They chose to ask you for those documents. Requests about your data go to them first, not to us, because they are the ones who can act on it.

What you can ask for

Access. A copy of the personal data held about you. For an account holder that is your portals, contacts, uploaded documents, terms acceptances and billing history. For somebody who was onboarded, it is the details and files you submitted.

Correction. Anything wrong can be fixed. Most of it is editable in the app.

Deletion. For an account holder, that means deleting the account. For somebody onboarded, it means asking the company that invited you.

Portability. A copy in a structured, machine-readable format you can take elsewhere.

Restriction and objection. In limited circumstances you can ask us to pause processing, or object where we rely on legitimate interests. Both are rare and are handled by a person.

Withdrawing marketing consent. Every marketing email carries an unsubscribe link. It affects nothing else about your account.

We make no automated decisions about anybody with legal or similarly significant effects. No profiling, no scoring, no automated denial of service.

What you can do yourself

Most of the above needs no email at all.

• Export your data. Exporting your data downloads a copy of what your account holds, apart from the documents people uploaded to your requests (we send those on request).
• Delete your account. Delete your account removes it, after a 48-hour window in which you can sign back in and restore it.
• Correct your own details. Your name, login email and password are on your profile.
• Correct somebody else's. Open their contact record and edit it. You are the controller of that data, so this is where corrections belong.
• Delete a document somebody sent you. If a contractor asks you to remove a certificate, you can do it without involving us. See deleting documents after you approve them.
• Unsubscribe from marketing. The link in the footer of any marketing email.

What needs an email

• Access to anything the export does not cover, such as records of support access to your account, or our internal audit trail.
• A request from somebody onboarded whose company will not respond. Ask them first. If they are unreachable or you cannot work out who they were, write to us with your name, the company, and roughly when you were invited, and we will act or chase them ourselves.
• Restriction or objection, which need human judgment and have no self-serve path.
• Processor terms. The GDPR processor obligations are part of our Terms of Use. Write to us if you need anything beyond that.
• Complaints. Tell us first if you can. We would rather fix it. Your right to go to a regulator does not depend on contacting us first.

All of these go to [email protected].

How long it takes, and how we check it is you

We respond to privacy requests within 30 days, which meets the GDPR's one-month deadline and the Australian Privacy Act's "reasonable time".

We will ask you to prove who you are before we hand over or delete anything, in proportion to what is being asked. Writing from the email address on the account is usually enough. A request about somebody else's data, or one that would destroy records, gets a harder check, because the worst outcome here is handing a contractor's documents to the wrong person.

Getting help

Anything in this article, and anything it does not cover, goes to [email protected]. Our privacy policy sets out what we collect and why.