WorkZerk
Start free trial

Privacy Policy

Legal Entity

WorkZerk Pty Ltd (ABN 72 163 622 508), of Queensland, Australia, is the entity responsible for the personal information described in this policy. It operates more than one product, including WorkZerk (at workzerk.com) and 1pm (at 1pm.app). This policy covers Your use of WorkZerk.

1. Definitions

"Agreement" means this privacy policy.

"the Provider", "WorkZerk", "We", "Us" or "Our" means WorkZerk Pty Ltd (ABN 72 163 622 508), of Queensland, Australia, and its associated websites.

"Data" means any data inputted, typed, pasted, entered, imported or uploaded by You or with Your authority into the Websites or related domains and sub domains, including files or images.

"End User" means any person who accesses the Service via a link, QR code, invitation or other access mechanism provided by a Subscriber, for the purpose of interacting with that Subscriber's instance of the Service, and who is not themselves a registered User or Subscriber. In plain terms: the people You onboard, such as contractors, staff, volunteers, members or tenants.

"Portal" means the private, link-accessed page through which an End User completes forms, uploads documents and signs, without creating an account.

"Service" means the software application You have registered to use, made available (as may be changed or updated from time to time by the Provider) via the Website at app.workzerk.com, or any other such locations acting as application servers or sub domains or other associated domains for the Service (which may change from time to time, without notice).

"Stripe Billing Portal" means the Stripe billing portal system that provides billing and subscription services to you as the Subscriber, and is accessed directly from that third party external platform.

"Subscriber" means the person who registers to use the Service, and, where the context permits, includes any entity on whose behalf that person registers or assigns to use the Service.

"User" means any person or entity, including the Subscriber, that uses the Service with the authorisation of the Subscriber from time to time.

"Websites" means the Internet sites at the domain workzerk.com, its subdomains, and any other site operated by the Provider.

"You" means the Subscriber, and where the context permits, a User. "Your" has a corresponding meaning.

2. How We Protect Your Privacy and Manage Your Data

This policy may be updated from time to time. The Provider reserves the right to change the provisions of this Policy at any time. We will alert You of changes that have been made by indicating on the Policy the date it was last updated (at the bottom of this document). We encourage You to review this policy from time to time to make sure that You understand how any personal information you provide will be used.

This policy references the Terms of Use required to be accepted to use the Service, also available as a footer link on the Websites.

The Provider processes personal data in two general contexts:

  1. As a business engaging with clients, suppliers, prospects, and other stakeholders through a number of channels including its website, email, online chat, phone, video training sessions, webinars, advertising, and social media ("the Provider as a Business"), and
  2. As a provider of online onboarding and compliance management services ("the Provider as a Service Provider").

For clarity, the privacy considerations are presented in each of these contexts.

3. Australian Privacy Act Compliance

3.1 Privacy Act 1988 (Cth)

The Provider is committed to protecting Your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Policy describes how We collect, hold, use, and disclose personal information, and how You can access and correct Your personal information or make a complaint.

3.2 Types of Personal Information Collected

We may collect the following types of personal information:

  • Name and contact details (email, phone, address)
  • Business information (company name, role, trading entity)
  • Files, documents, photos or images uploaded by You or by Your End Users, including licences, tickets, certificates, insurance certificates and identity documents
  • Answers submitted through a Portal, including free-text responses and selections
  • Signatures and sign-off records, including what was agreed to and when
  • Expiry dates and renewal status attached to documents You choose to track
  • Payment information (processed securely by Stripe)
  • Usage data and preferences

3.3 Sensitive Information

Collecting compliance documentation is the core purpose of the Service, so the Provider will routinely hold information that is sensitive information as defined under the Privacy Act. This may include criminal history and police checks, Working With Children Checks, health and medical clearances, immunisation records, licences and qualifications, and identity documents, in each case where a Subscriber chooses to request them.

We collect this information only as a processor acting on a Subscriber's instructions (see clause 4.1). We do not decide what is asked for. The Subscriber is responsible for ensuring it has consent or another lawful basis to collect each item it requests, and for requesting only what its compliance obligations genuinely require.

Because this category of information carries a higher risk of harm if it is exposed, We apply the safeguards described at clause 3.5 to all Data without distinction, and We do not use uploaded documents for any purpose other than operating the Service for the Subscriber that collected them.

3.4 Purpose of Collection (APP 3 & 6)

We collect personal information for the primary purpose of providing the Service, including:

  • Delivering a Portal to each End User and recording what they submit
  • Storing documents and running verification, approval and rejection workflows
  • Tracking document expiry and issuing reminders and re-requests
  • Capturing signatures and agreement records
  • Maintaining the Subscriber's contact records and onboarding history
  • Processing payments
  • Providing customer support

We will not use or disclose personal information for a secondary purpose unless You have consented or it is required by law. We do not sell personal information, and We do not use Data uploaded into the Service to train machine-learning models.

3.5 Data Storage and Security (APP 11)

All Data is stored on Microsoft Azure's global network of servers and geo-redundant replicas, which includes locations within the Australia East and East US regions. The exact physical location of Your data is at our discretion. To ensure high availability and disaster recovery, Your Data may be stored or replicated across various Azure data centres worldwide. Consequently, Data may reside outside of Australian jurisdiction. We continue to protect Your information using industry-standard security measures, including TLS encryption in transit and at rest, secure authentication, and strict access controls.

Uploaded files are held in private storage and are never publicly addressable. They are served only through an access-checked proxy, so a file can be retrieved only by a signed-in User authorised for that account, or by the End User who supplied it through their own Portal link. A summary of Our technical and organisational measures is published with our subprocessor list.

Where an uploaded document carries an expiry date, We use an artificial intelligence service operated by Microsoft (Azure OpenAI) to read the date shown on the document and compare it with the date that was entered, so the person reviewing the document can see when the two differ. The document is sent to that service for this purpose only and is not used to train artificial intelligence models. The result is information for the reviewer: a person at the Subscriber decides whether to approve or reject the document. A Subscriber can switch this check off for any document it asks for. Processing by this service may take place outside Australia.

3.6 Cross-Border Disclosure (APP 8)

Because Our infrastructure provider (Microsoft Azure) operates a global network and We use both Australian and US Azure regions, Your personal information may be transferred to, stored in, and accessed from countries outside Australia, including the United States.

We also use a small number of overseas service providers to operate the Service. The current list, including each provider's purpose, location, and DPA, is maintained at our subprocessor list.

For transfers from the European Economic Area, the United Kingdom or Switzerland, We rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms approved under applicable law. For Australian customers, all overseas providers are bound by contract to standards substantially similar to the Australian Privacy Principles. If You enable third-party integrations that transfer Data overseas outside the providers We engage, You are responsible for ensuring those services meet Your privacy requirements.

3.7 Access and Correction (APP 12 & 13)

You have the right to:

  • Request access to the personal information We hold about You
  • Request correction of any inaccurate, incomplete, or out-of-date information
  • Request deletion of Your personal information (subject to legal retention requirements)
  • Withdraw consent for marketing communications
  • Request that We restrict or object to Our processing of Your information in certain circumstances
  • Request a portable copy of Your information in a structured, machine-readable format

Subscribers can self-serve most of these actions: account export and account deletion are available from inside Your account settings. For other requests, or if You are an End User (see clause 5), contact us at [email protected]. We will respond within 30 days.

If You are an individual in the European Economic Area, the United Kingdom, or Switzerland, additional rights under the GDPR apply, described at clause 11 below.

3.8 Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. When Data is no longer required, We will take reasonable steps to destroy or de-identify it. Specific retention windows currently in effect include:

  • Active accounts: retained while the account is active and for the duration of any paid Subscription Period.
  • Trial accounts that don't convert: automatically deleted 60 days after the trial begins (30-day trial plus a 30-day grace period).
  • Cancelled paid accounts: automatically deleted 270 days after cancellation. We send a warning email at least 60 days before deletion so You can export Your Data, sign in to keep the account active, or resubscribe.
  • Backup copies: may persist in Azure-managed backups for up to 35 days after deletion as part of disaster-recovery snapshots, after which they are overwritten.
  • Audit logs for support impersonation sessions (see clause 9): retained separately from the account so the record survives account deletion.
  • Suppression lists (unsubscribes and hard bounces): retained for the operational lifetime of the Service. We must keep honouring an unsubscribe or a dead address after the account that first emailed it has gone.
  • Email delivery history (what was sent, to whom, and whether it arrived): held with the account and deleted with it.
  • Raw delivery-provider webhook payloads: kept for 90 days as a diagnostic record, then automatically deleted.

Documents supplied by an End User are held for as long as the Subscriber that collected them keeps them, and are deleted when the Subscriber deletes them or when the account itself is deleted under the windows above. Subscribers may export their Data at any time via the account export function before deletion.

4. The Provider as a Service Provider

4.1 Data Controller and Processor Relationship

When You use WorkZerk, You (the Subscriber) act as the data controller for the personal information collected from Your End Users. The Provider acts as a data processor, processing that information on Your behalf and in accordance with Your instructions. For European Economic Area, UK and Swiss data, the processor obligations set out in Article 28 of the GDPR (and equivalent UK GDPR provisions) apply and are incorporated by reference into the Terms of Use, clause 4.3.

We engage a small number of subprocessors (hosting, email delivery, billing, telemetry) to operate the Service. Each is bound by contract to confidentiality and security obligations no less protective than those We owe You. The current subprocessor list is published at our subprocessor list and updated when subprocessors change. Subscribers who ask to be notified receive at least 30 days' notice of any addition or replacement, as set out in Terms of Use clause 4.4.

4.2 You Own Your Data

The Data entered, or imported on instruction, by You remains Your property. The Provider will not use nor make available for use any of this information without Your permission.

4.3 You Control Who Has Access to Your Data

The Data entered, or imported on instruction, by You is stored securely in a database, or electronic file system, and is only accessible to any person You have authorised to use the Service. It is Your responsibility to remove login credentials or other administrator access when they are no longer needed.

4.4 We Monitor System Usage

It is Your responsibility to keep Your password safe. The Provider, the Provider's staff and the Provider's partners do not have access to Your password. The Provider and its staff may need to access some of Your Data to resolve system errors or to recreate scenarios to resolve support requests. Where that access takes the form of signing in to Your account, the safeguards at clause 9 apply.

4.5 Your Data is Sent Securely Across the Internet

The Provider's servers have SSL Certificates so all Data transferred between Users and the Service is encrypted, including uploaded files. However, the Internet is not in itself a secure environment. Users should only enter, or instruct the importation of, Data to the database within a secure environment. This means that Your browser must support the encryption security used in connection with the Service.

4.6 We Do Not Store Any Credit Card Details

Any credit card details are encrypted and securely stored by Stripe to enable the Provider to bill the cards. Credit card details are not stored by the Service and cannot be accessed by the Provider's staff.

4.7 Third Party Applications

You may optionally connect the Service to other applications. If You do so then You are solely responsible for checking the Privacy Policy of any third-party applications the Service links to and satisfying Yourself that they meet Your needs.

4.8 Portals, Self-Registration Links and QR Codes

A Portal link is a private URL. Anyone holding the link can open that Portal, so links should be sent to the intended person only, and can be revoked by the Subscriber at any time. Portals are excluded from search-engine indexing.

Where You publish a self-registration link or QR code, personal information submitted by people who register through it (such as name, contact details, and whatever else You ask for) is collected and stored by Us as a processor acting on Your behalf and on Your instructions. You are the controller of that information, and You are responsible for the lawful basis for collecting it and for any notice You display at the point of collection. To protect public forms against automated abuse We process the submitter's IP address and a verification token via our security provider (see the Cloudflare entry at our subprocessor list); this data is used only for spam prevention and rate limiting.

5. Information for End Users

If You have been sent a WorkZerk link by an organisation that is onboarding You:

  • That organisation (the Subscriber) is the primary controller of Your personal information. It decides what to ask You for and how long to keep it
  • The Provider processes Your information on behalf of that organisation, and does not use it for its own purposes
  • Questions about why something was asked of You, or how it is used, should be directed to that organisation in the first instance
  • You may contact the Provider at [email protected] for questions about how We protect and store Your information
  • You have the right to request access to or correction of Your personal information. Where We cannot action a request without breaching Our obligations to the Subscriber, We will refer it to them and assist them in responding
  • You are not required to create an account, and We do not ask You to set a password

6. Data Breaches and Complaints

6.1 Notifiable Data Breaches Scheme

The Provider complies with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. If We become aware of an eligible data breach that is likely to result in serious harm to any individual, We will:

  • Promptly assess the breach
  • Notify affected individuals as soon as practicable
  • Notify the Office of the Australian Information Commissioner (OAIC)
  • Take steps to contain the breach and prevent future occurrences

6.2 Breach Notification to Subscribers

If We become aware that Your Data has been accessed by, or disclosed to, an unauthorised party, We will notify You within 72 hours of becoming aware of the breach, providing details of the nature of the breach, the types of information involved, and recommended steps You should take.

6.3 Complaints

If You believe We have breached the Australian Privacy Principles, You may lodge a complaint by emailing [email protected]. We will investigate Your complaint and respond within 30 days. If You are not satisfied with Our response, You may escalate Your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

The Provider will cooperate with investigations conducted by the Privacy Commissioner or other authorised government privacy bodies.

7. The Provider as a Business

When You visit our websites and infrastructure at workzerk.com, app.workzerk.com or other sub domains or associated websites, or engage in marketing activities such as events, meetings, discussions and webinars, or submit help requests or contact us, we may collect personal information from You such as:

7.1 Active Collection

We may collect certain information You voluntarily provide to us which may contain Personal Information. For example, when You fill out a form, submit a comment, or contact us by email or other means.

7.2 Automatic Collection

When you visit our website and use the Service, some information is also automatically collected, such as your internet protocol (IP) address, your operating system, the browser type, the address of a referring web site, and your activity on the sites.

We treat this information as personal information if we combine it with or link it to any of the identifying information mentioned above. Otherwise, it is used in the aggregate only (non-identifying).

7.3 Your Rights

You can unsubscribe from any marketing communication by following the unsubscribe instructions contained in the communication (usually in the footer section). You also have rights which include:

  • Knowing what personal data we hold about You
  • Asking us to correct any personal data we hold about You
  • Asking us to delete or restrict any personal data we hold about You, including uploaded files such as identity documents, certificates and PDF or image based credentials stored on our file storage server (Azure Blob Storage).

You can exercise these rights by sending an email to [email protected].

8. Cookies and Similar Technologies

A cookie is a small file containing an identifier sent by a web server to Your browser and stored by the browser. Persistent cookies survive until their expiry date or until You delete them; session cookies are cleared when You close the browser. Cookies do not by themselves identify You, but information We hold about You can be linked to the cookie's identifier.

We use only cookies that are strictly necessary to operate the Service. We do not use advertising cookies, behavioural-tracking cookies, social-media cookies, or third-party analytics cookies such as Google Analytics, Hotjar, or the Facebook pixel. Because all cookies We set fall within the "strictly necessary" exemption under the EU ePrivacy Directive, no cookie consent banner is required.

The cookies We set are:

  • Authentication cookie (.AspNetCore.Identity.Application): identifies You while You are signed in. Expires when You sign out or after the session lifetime.
  • Antiforgery cookie (.AspNetCore.Antiforgery.*): protects form submissions from cross-site request forgery. Session cookie.
  • Portal viewer cookie: set when an End User opens their Portal link, so the live-update stream can verify access. Session cookie.
  • Cloudflare cookies (__cf_bm, cf_clearance): set by our content-delivery and security provider Cloudflare to distinguish humans from automated traffic. Required to use the Service.
  • Stripe cookies: set only on billing-related pages where Stripe Elements are loaded, for fraud prevention. Required to complete a payment.

8.1 Telemetry

We use Microsoft Azure Application Insights to monitor Service health, errors, and performance. Application Insights is configured to not store client IP addresses or other directly identifying data. Telemetry is aggregated to the request level (URL, status code, response time) and used solely for operational debugging and capacity planning. It is not used for marketing, profiling, or any cross-site tracking.

9. Support Access to Your Account

9.1 Impersonation Sessions

To help You debug an issue or recover from a problem, members of the Provider's support team may access Your account by signing in as You from inside the Service. This is called a support impersonation session. We do this only when needed and apply the following safeguards every time:

  • Only support staff on a configured allow-list can start a session. The allow-list is short and reviewed periodically.
  • Support staff must have two-factor authentication enabled on their own account before they can start a session.
  • A reason must be entered before each session begins, and that reason is recorded in our audit log together with who started the session, when, and from which IP address.
  • Sessions are read-only by default. To take any action on Your behalf the support staff member must explicitly request write mode and record a second reason. Write mode is never the default.
  • Some actions are blocked even in write mode, including changing Your password, changing Your email address, changing or disabling Your two-factor authentication, and any billing action.
  • You may receive an email at the email address on Your account when a session starts, telling You that we accessed the account, when, and the reason recorded by the support staff member. The email is skipped when the support staff member confirms You have already contacted us for support; in that case the session is still logged in the audit trail. The audit row records whether or not the email was sent. If You did not ask for support, You may contact us at any time at [email protected] and we will investigate.
  • The audit log of impersonation sessions is retained separately from Your account data, so it survives even if You later delete Your account.

9.2 Help Tickets

When You open a help ticket from the in-app help (or by emailing [email protected]), We store Your name, email address, the message You submitted, any image You attach, the IP address You submitted from, and Your browser's user-agent string. We use this information solely to respond to You and to improve Our help articles and product.

If You are signed into the Service in the same browser when You open the ticket, We automatically associate the ticket with Your account. This lets Our support staff confirm at a glance that You are a real administrator for the account You are asking about, so We can answer faster without first having to verify Your identity by email. We record Your user id and account email on the ticket alongside the form fields You typed. This linking happens silently: there is no separate consent step beyond submitting the form while signed in. If You prefer to open a ticket that is not associated with Your account, sign out first or use a private browsing window.

Help tickets are retained for as long as We may reasonably need them for support history, product analysis, and abuse investigation. If You delete Your account, the verified-account link on Your past tickets is severed but the ticket content itself (and the email address You submitted) is retained as part of Our support records. You may request deletion of specific tickets by emailing [email protected].

10. Please Read Our Terms of Use

Use of the Service is subject to the Provider's Terms of Use, and this Privacy Policy should be read in conjunction with those Terms of Use. In the event of a conflict or disagreement between this Privacy Policy and the Terms of Use, the Terms of Use will prevail.

11. Notice to Individuals in the European Economic Area, United Kingdom and Switzerland (GDPR)

If You are an individual whose personal data is subject to the EU General Data Protection Regulation (GDPR), the UK GDPR, or the Swiss Federal Act on Data Protection, the additional terms in this clause apply to You and supplement (rather than replace) the rights described elsewhere in this policy.

11.1 Lawful Bases for Processing

We process personal data on the following lawful bases under Article 6 of the GDPR:

  • Performance of a contract (Article 6(1)(b)): processing Subscriber account data, billing data, and Data uploaded into the Service to deliver the Service the Subscriber has signed up for.
  • Legitimate interests (Article 6(1)(f)): operational telemetry, security monitoring, fraud prevention, anti-abuse rate limiting, and direct service-related communications with Subscribers. We have assessed that these interests are not overridden by Your rights.
  • Legal obligation (Article 6(1)(c)): retaining records We are required by tax, accounting, or anti-money-laundering law to retain.
  • Consent (Article 6(1)(a)): marketing emails You explicitly opt in to. You may withdraw consent at any time via the unsubscribe link in every marketing email or by contacting [email protected].

Where We act as a data processor on behalf of a Subscriber (the data controller), the Subscriber determines the lawful basis for processing End User personal data and is responsible for ensuring an appropriate basis exists. This includes obtaining explicit consent where the Subscriber requests special-category data under Article 9, such as health information or criminal-record checks. We do not process End User personal data for Our own purposes.

11.2 Your Rights Under the GDPR

In addition to the rights at clause 3.7, You have the right to:

  • Access the personal data We hold about You (Article 15)
  • Rectification of inaccurate data (Article 16)
  • Erasure ("right to be forgotten", Article 17), subject to retention obligations
  • Restriction of processing in certain circumstances (Article 18)
  • Data portability in a structured, machine-readable format (Article 20)
  • Object to processing based on legitimate interests (Article 21)
  • Not be subject to solely automated decision-making producing legal or similarly significant effects (Article 22). We do not perform such automated decision-making. Approving or rejecting a submitted document is always a decision made by a person at the Subscriber, not by the Service.

If You are an End User (that is, Your data was collected through a Portal issued by a Subscriber), We will action access and erasure requests where We can do so without breaching Our processor obligations to the Subscriber. In most cases We will refer the request to the Subscriber, who is the controller of Your data, and assist them in responding within the statutory time limits.

11.3 International Transfers

As noted in clause 3.6, personal data may be transferred to and processed in countries outside the EEA, UK or Switzerland, primarily Australia (Our place of business) and the United States (some Azure regions and our email-delivery provider). Where such a transfer occurs:

  • For transfers to the United States and other non-adequate third countries, We rely on the Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented where required by the transfer-impact-assessment factors set out in EDPB guidance.
  • For transfers to Australia, the European Commission has not granted an adequacy decision. Transfers to Our hosting infrastructure in Australia are made under SCCs.
  • You may request a copy of the SCCs in place by emailing [email protected].

11.4 Right to Lodge a Complaint with a Supervisory Authority

If You believe Our processing of Your personal data infringes the GDPR or UK GDPR, You have the right to lodge a complaint with Your local data protection authority. In the EU, the list of national supervisory authorities is published by the European Data Protection Board at edpb.europa.eu. In the UK, the relevant authority is the Information Commissioner's Office (ico.org.uk). We would appreciate the opportunity to address Your concern first by contacting [email protected], but Your right to escalate is not contingent on contacting Us.

11.5 Data Protection Contact

For all data-protection enquiries, including exercise of rights, complaints, and requests for SCCs or other documentation, contact [email protected]. We are not currently required to appoint a Data Protection Officer or an EU representative under Article 27 of the GDPR. If We become required to do so, this clause will be updated with their contact details.

Last updated: 9 October 2026