Privacy policy

About this policy

This policy explains how Workfloor (“we”, “us”) collects, uses, stores and discloses personal information. It covers the Workfloor website (workfloor.com.au) and the Workfloor app.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we follow them whether or not an exemption would otherwise apply to us.

Two ways we handle information

For our business customers. Organisations use Workfloor for their own HR and people and culture work. Their staff may enter questions or upload documents, which can include personal information about their employees. We handle that information only to provide the service to that customer, under our agreement with them. If you are an employee of one of our customers, please contact your employer first; we will help them respond to you.

On our own account. We also handle personal information to run our business: account details for customer users, billing contacts, enquiries, support correspondence and security logs.

What we collect

• Account details: name, work email, organisation, role and sign-in identifiers, from you or your organisation’s administrator.
• Customer content: the questions you ask, documents you upload, answers, saved items and exports.
• Billing details: billing contact, organisation name and ABN, invoices and payment status. Card details are held by our payments processor, not by us.
• Usage and security records: sign-in times, IP address, device and browser, and audit records of actions taken in the service.
• Correspondence: emails and messages you send us.

We don’t use advertising or third-party tracking scripts. We use only the cookies the service needs to work, such as keeping you signed in. You can browse our public website without telling us who you are; to use the app you need an account.

Workfloor works without employee personal details. Ask about situations (“a casual retail employee aged 17”) rather than named people wherever you can.

How we use it

We use personal information to:

• provide, secure and support the service
• authenticate users and keep audit records
• bill customers
• answer enquiries and send service and security notices
• meet our legal obligations.

We don’t sell personal information, use customer content for marketing, or use customer content to train AI models. We don’t use customer content for any purpose other than providing the service to that customer, unless the customer agrees or the law requires or permits it. Any marketing email we send has a working unsubscribe link.

AI and automated processing

Workfloor uses AI models hosted in Australia to search our sources and draft answers that show those sources. The rules for that processing are:

• No training: your content is not used to train AI models.
• No retention by the AI service: the AI service is set not to keep your questions or answers. Answers are stored only in your account.
• People decide: Workfloor provides general information, not legal advice, and doesn’t make decisions about individuals. Your organisation’s staff decide what to do with an answer.

Workfloor does not use computer programs to make decisions that could significantly affect an individual’s rights or interests. If that changes, we will update this policy to describe the kinds of personal information used and the kinds of decisions involved.

Where it is stored

Customer content and account data are stored and processed in Australia. Workfloor is hosted in Sydney, and AI processing happens in Sydney and Melbourne only. Our account settings block every other region.

There are limited exceptions, for business administration rather than customer content:

• Email. Our staff email may store messages outside Australia. Please don’t email us employee records.
• Payments. Our payments processor may handle billing details outside Australia.

Where information is disclosed overseas, we take reasonable steps, including contractual terms, to make sure the recipient handles it consistently with the APPs.

Who we share it with

We disclose personal information only to:

• our service providers (listed below), to run the service
• the customer organisation your account belongs to (its administrators can see usage and audit records)
• professional advisers, insurers and authorities, where the law requires or permits it, or to respond to a security incident.

Our service providers

We give business customers at least 30 days’ notice before adding a service provider that will handle their content.

How we protect it

• encryption in transit (TLS 1.2 or higher) and at rest (managed encryption keys, rotated automatically)
• multi-factor sign-in on every account
• least-privilege access for our own administrators, with no long-lived access keys
• audit logging, threat detection and daily backups.

Our controls are designed to align with ISO/IEC 27001:2022 and the APPs. We are not certified to ISO 27001 or SOC 2. More detail is on our Security and data page.

Data breaches. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. We will also tell affected business customers within 72 hours of becoming aware of it.

Keeping and deleting it

• We keep customer content for as long as the customer’s agreement requires.
• When a user account is deleted, we delete its content.
• When a customer’s agreement ends, we return or delete that customer’s data within 30 days. Backups expire within a further 35 days.
• We keep security logs for 12 months, and billing records for as long as tax law requires.

Access and correction

You can ask for access to the personal information we hold about you, or ask us to correct it. We will respond within 30 days and don’t charge for making a request. If the information is part of your employer’s records in Workfloor, we may handle the request with them. If we refuse, we will explain why in writing and tell you how to complain.

Contact and complaints

Email hello@workfloor.com.au with any privacy question or complaint. We will acknowledge a complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

We will post any update here with a new date, and tell business customers about any material change.