What to put in your own privacy policy
The documents WorkZerk collects are among the most sensitive a business handles about its people: licenses, insurance certificates, police checks, qualifications, signed agreements, sometimes bank details. That data belongs to the people who sent it, and in data-protection language you are the controller of it while WorkZerk is your processor.
Which means your own privacy policy has to say so. This is general guidance with a drop-in clause at the end, not legal advice.
Why this lands on you, not us
A contractor who uploads their public liability certificate has handed it to you. When they ask "who has my documents and where do they go", the answer starts with you. WorkZerk appears in that answer as a named provider you use, the same way your accounting software does.
This matters more here than in most software you run, for a reason worth stating plainly: the people whose data you hold are often not your employees. A contractor has no HR file with you, no induction pack, and no obvious place to go with a question about their own records. Your privacy policy is frequently the only thing that tells them.
What to declare
That you use WorkZerk as a provider. workzerk.com is operated by WorkZerk Pty Ltd, in Queensland, Australia. Link to workzerk.com/subprocessors rather than copying the provider list, so it stays current when those providers change.
What you actually collect. Be specific, and list what your own portals ask for rather than a generic set. For most accounts that is some of:
- Names, contact details, and the company somebody works for
- Certificates and licenses, with their expiry dates
- Insurance documents naming the holder and the sum insured
- Police checks, right-to-work evidence, and qualifications
- Signed agreements, including a typed name or a drawn signature
- Photos of the person, where you ask for one
- Bank or payment details, if your onboarding collects them
- Free-text answers to whatever else you ask
Some of it is sensitive. A police check, a Working With Children Check, a health clearance or an immunization record: the Australian Privacy Act and the EU and UK GDPR give these extra protection and expect a clear basis, usually consent, for collecting them. Say which ones you ask for and why. A line at the point you ask ("we collect your police check because our client requires it for site access") does most of the work, and WorkZerk lets you put that line in the request's own description.
That data is stored and may be accessed outside Australia. WorkZerk runs on Microsoft Azure in Australia East, with geo-replicated backups and CDN edges in the United States, and uses providers in the US and EU for email delivery and related services. Australian businesses need to say so under Australian Privacy Principle 8. For people in the EU or UK, transfers are made under Standard Contractual Clauses.
How people submit it. Everyone you onboard gets a private link that needs no password. If you use self-registration links or QR codes, say so, because that is a collection point where somebody hands over documents having never received an email from you.
How long you keep it. This is the one most policies fudge and the one contractors ask about. An expired certificate you no longer need is data you are still holding. Say roughly how long you keep documents after somebody stops working with you, and then do it. WorkZerk keeps an uploaded document until you delete it, unless you set document retention to delete approved files after a period you choose.
Who to contact. Tell people that access, correction and deletion requests come to you first, because you are the controller. Somebody who writes to WorkZerk directly is usually referred back to you. Data subject rights covers what we can and cannot do on your behalf.
A clause you can adapt
Edit the bracketed parts to match what you actually collect.
Onboarding and compliance records. We use WorkZerk (workzerk.com, operated by WorkZerk Pty Ltd) to collect and hold the documents we need from the people who work with us. Depending on your role this can include your name and contact details, licenses and certificates and their expiry dates, insurance documents, [police checks and right-to-work evidence], [bank details], signed agreements, and any answers you give us through your onboarding link.
Some of these are sensitive information, and we collect them because [our clients require them for site access / we are required to by law]. We keep them for [period] after you stop working with us, and then delete them.
WorkZerk stores this data on Microsoft Azure in Australia, with backup replication and content delivery outside Australia, and uses third-party providers for email delivery and security. Your information may therefore be stored or accessed outside [your country]. The current list of those providers is at workzerk.com/subprocessors. For people in the EU or UK, these transfers are made under Standard Contractual Clauses.
We do not sell your personal information. To ask what we hold about you, to correct it, or to have it deleted, contact us at [your email]. We will respond within [30 days].
Where to read what WorkZerk actually does
Our Privacy Policy sets out the controller and processor split (section 4), what the people you onboard are told directly (section 5), and when support can open your account (section 9). Subprocessors lists every provider, what it does, where it is, and its data-protection terms. Point your own policy at those pages rather than reproducing them, so it does not go stale when ours changes.
Getting help
If a contractor has asked you something about their data that you cannot answer from here, email [email protected]. We would rather help you answer it than have them chase us.