Privacy Policy

Worksauce Pty Ltd (Worksauce, we, us or our) provides business-to-business wage-compliance and operational-optimisation software. This Policy explains how we collect, hold, use and disclose personal information through our websites, software, integrations, support and related services (the Service).

• Legal entity: Worksauce Pty Ltd
• ABN: 70 691 252 034
• Address: Suite 403, Tower 2, 55 Plaza Parade, Maroochydore, Queensland
• Privacy contact: tech@worksauce.com.au

To the extent the Privacy Act 1988 (Cth), the Australian Privacy Principles or another privacy law applies to Worksauce or particular information, we will handle that information in accordance with that law. Some Privacy Act obligations depend on matters such as an organisation’s annual turnover and activities, so the Act may not apply to every act or practice described in this Policy.

Account and contact information

Names, business email addresses, telephone numbers, roles, employer details, account usernames, authentication information, communications and support requests.

Staff and workforce information

Customer systems may provide staff names, email addresses, dates of birth, employment and role details, rosters, attendance and time records, wage, remuneration or payment information, workplace details and identifiers used by connected systems.

Sensitive information

We do not seek sensitive information unless it is reasonably necessary for the Service or another lawful function and its collection is permitted by law, including with consent where required. Customers must not provide health, biometric, racial or ethnic, political, religious, sexual-orientation, union-membership, criminal-record or other sensitive information unless the relevant Service feature requires it and they have lawful authority to do so.

Billing and payment information

Billing contacts, billing addresses, transaction records, subscription status, invoices, payment-method details made available by a payment provider and related correspondence.

We currently invoice Customers directly and do not use a third-party payment provider.

Integration data

Data and identifiers from Customer-authorised time and attendance systems, accounting software, booking systems, point-of-sale systems and other integrations.

Technical and usage information

When you visit our public marketing website, we and our service providers may automatically collect technical and usage information. This may include IP address and approximate location derived from it; browser, device and operating-system information; pages viewed; links selected; referring pages; visit dates, times and duration; website performance, interaction and diagnostic information; and online identifiers, including identifiers stored in analytics cookies.

We use this information to understand how visitors use the website, measure traffic and performance, identify technical issues, and improve the website and our communications.

The authenticated Service uses cookies to keep you signed in and secure your session. These cookies are necessary for the Service to work.

We may collect personal information directly from users; from Customers and employers; through Customer-authorised integrations; automatically when the website or Service is used, including through cookies, Google Tag Manager, Google Analytics and similar technologies; during demonstrations, onboarding and support; from payment, hosting, authentication, analytics, communications, security and other service providers acting for us; from lawful public sources; and where authorised or required by law.

A Customer that provides information about staff or other people is responsible for having lawful authority to do so and for giving any required notices. If an employer supplied your information, it will often be the appropriate first contact about why the underlying workforce record is processed.

We may handle personal information to create and administer accounts; provide, configure, secure and support the Service; operate integrations; process subscriptions and payments; produce requested wage-compliance and operational insights; communicate with Customers and users; monitor and improve performance; diagnose errors; detect misuse, security threats and fraud; keep business and compliance records; investigate complaints; enforce agreements; comply with law; and establish, exercise or defend legal claims.

We use information for these purposes where permitted by applicable law, including to perform our agreements, comply with legal obligations, pursue legitimate business functions or interests, act with consent, or rely on another lawful authority. We will obtain consent where the law requires it for a new or materially different purpose.

We may send Customers and business contacts information about Worksauce products, events or services that may be relevant to their business relationship with us. Recipients can unsubscribe using the link in a marketing message or by contacting us. We will honour opt-out requests and continue to send service, security, billing and other non-marketing communications where necessary.

For workforce information provided or controlled by a Customer, such as an employer, the Customer determines why the information is handled and which systems are connected. Worksauce generally handles that information on the Customer’s instructions to provide the Service. Depending on the applicable law and context, the Customer may be the controller or principal organisation and Worksauce may be its processor, service provider or contracted provider.

Customers are responsible for their collection and use of workforce information, required notices and permissions, user access, configuration choices, and employment or workforce decisions. Worksauce remains responsible for its own handling of personal information and obligations that apply directly to it.

Our customer agreement and, where required, a data processing agreement set out processing instructions, confidentiality, security, assistance, deletion and other data-protection responsibilities. Customers may contact us to request the applicable data processing terms.

We may disclose personal information to the relevant Customer and its authorised users; Customer-enabled integration providers; providers supporting hosting, cloud infrastructure, authentication, payments, analytics, monitoring, security, error reporting, communications and customer support; professional advisers, insurers, auditors and financiers; regulators, courts and law-enforcement bodies where authorised or required; a prospective or completed buyer, investor or successor in a genuine corporate transaction subject to appropriate confidentiality protections; and other parties at the direction or with the consent of the Customer or individual.

We use Google Tag Manager and Google Analytics, provided by Google, for website tag management and analytics. Google may collect and process the technical and usage information described in the “Cookies and website analytics” section.

Relevant providers and their functions: OVHcloud — application and database hosting (Sydney, Australia); Amazon Web Services — AI processing via AWS Bedrock (Sydney, Australia); Google — website tag management and analytics.

If a Customer enables an integration, we exchange the information needed to operate it under the Customer’s permissions. The integration provider handles information under its own terms and privacy practices.

Worksauce does not sell personal information and does not disclose it for unrelated third-party advertising. If our practices change, we will update this Policy and provide any notice, consent or opt-out required by law.

We currently invoice Customers directly. We do not collect or store card details. We keep billing contacts, invoices and payment records needed for accounting, support and disputes. If we introduce a payment provider, we will update this Policy.

Our website uses cookies and related technologies. A cookie is a small data file stored on or accessed through your device when you visit a website.

We use Google Tag Manager to deploy and manage website tags, including Google Analytics. Google Analytics helps us measure website traffic and understand how visitors interact with our website.

Google Analytics may collect or generate information such as IP address and approximate location derived from it; browser, device and operating-system information; pages viewed, referral source, interactions and visit timing; analytics identifiers; and information stored in or associated with Google Analytics cookies.

The Google Analytics cookies observed on our website include _ga, used to distinguish website visitors, and a _ga_ cookie specific to our website, used to maintain information about a visitor’s interaction with the website. Google Tag Manager is a tag-management tool used to load and manage technologies such as Google Analytics, and tags deployed through it may collect information or set cookies as described above.

Information collected through Google Analytics is transmitted to and processed by Google under Google’s terms and privacy practices. More information is available in Google’s Privacy Policy and its explanation of how Google uses information from sites or apps that use its services.

You can use your browser settings to block or delete cookies, although doing so may affect how some websites or features operate. Google also provides a Google Analytics opt-out browser add-on. The cookies and technologies used on our website may change as the website and its configuration are updated.

The authenticated Service uses cookies to keep you signed in and secure your session. These cookies are necessary for the Service to work.

We store Service data in Australia.

We take reasonable technical and organisational steps appropriate to the nature of the information and relevant risks to protect it from misuse, interference, loss and unauthorised access, modification or disclosure. These steps include managing access, maintaining and monitoring systems, and requiring personnel and providers to protect information as appropriate to their roles. No transmission or storage system is completely secure. Users must safeguard their credentials and promptly report suspected unauthorised activity.

Worksauce, its service providers or Customer-enabled integrations may store, access or process personal information outside the state, territory or country where it was collected.

Website analytics data collected by Google may be processed in the United States.

Where an overseas disclosure occurs, we take reasonable steps or other measures required by applicable law. Depending on the circumstances, these may include assessing the recipient, imposing contractual privacy and security obligations, limiting access and disclosure, obtaining consent where appropriate, or using another recognised transfer mechanism. Customer-enabled integration providers may determine their own processing locations, and Customers should review those providers before enabling an integration.

We retain personal information only for as long as reasonably needed for the purpose for which it was collected or a lawful related purpose. The period depends on the information’s nature and sensitivity, the Customer’s instructions and subscription status, the duration of the account and integration, operational and security needs, applicable limitation periods, legal and accounting requirements, unresolved complaints or disputes, and the time needed to cycle information out of backups.

After an account ends, we may allow a limited period for an authorised export where agreed with the Customer. When information is no longer required, we take reasonable steps to delete or de-identify it, except where it must be retained by law or remains temporarily in protected backups until overwritten in the ordinary cycle.

Subject to applicable law, you may ask to access personal information we hold about you, correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, withdraw a consent where processing depends on it, opt out of direct marketing, or exercise other privacy rights available where you live. Contact tech@worksauce.com.au. We may take reasonable steps to verify your identity and authority before acting.

If Worksauce handles the information for a Customer such as your employer, we may refer the request to or coordinate it with that Customer. We may refuse or limit a request where permitted or required by law, including to protect another person’s privacy, and will give reasons and available complaint options where required. We will respond within the period required by applicable law or, if no period applies, within a reasonable time. We do not charge for making a request, although a lawful reasonable access charge may apply after notice.

1. Email tech@worksauce.com.au with your contact details, the conduct or information concerned and the outcome you seek.
2. We will acknowledge the complaint, investigate it fairly and aim to respond within a reasonable period.
3. We may ask for further information or reasonable identity verification and, if the complaint concerns Customer-controlled information, coordinate with that Customer.
4. We will explain our response and any further complaint options available under applicable law.

If you are not satisfied and the Privacy Act applies to the matter, you may complain to the Office of the Australian Information Commissioner. Another privacy or data-protection regulator may be available where you live.

If we become aware of suspected unauthorised access to, disclosure of or loss of personal information, we will assess the incident, take reasonable steps to contain it, preserve relevant evidence, reduce potential harm and remediate identified issues. We will also cooperate with affected Customers and service providers as appropriate.

Where the Privacy Act’s Notifiable Data Breaches scheme or another breach-notification law applies, we will assess whether notification thresholds are met and notify affected individuals, Customers and regulators as required. Contractual notifications will be made in accordance with the applicable customer agreement or data processing agreement.

The Service is intended for business use and is not directed to children. A person under 18 must not independently create a Worksauce account or accept contractual terms for a Customer.

A Customer may lawfully employ younger workers and provide their workforce records where those records are needed to manage employment, time, attendance, pay or compliance. The Customer must have lawful authority, give required notices, obtain any required parent or guardian consent, limit the information provided and apply safeguards appropriate to the worker’s age. Worksauce handles those records on the Customer’s instructions and does not use them to market to children. If we learn that a child’s information was provided unlawfully, we will investigate and take reasonable steps with the Customer to delete or otherwise handle it lawfully.

We may update this Policy when the Service, integrations, providers, practices or law changes. We will publish the revised Policy, update its effective or last-updated date and, where a change materially affects existing personal information, provide additional notice or seek consent if required by law. The version in effect when information is handled applies to that handling, subject to applicable law.

Links to third-party websites and Customer-enabled integrations are governed by those third parties’ privacy notices and practices, not this Policy.

Worksauce Pty Ltd
ABN: 70 691 252 034
Address: Suite 403, Tower 2, 55 Plaza Parade, Maroochydore, Queensland
Email: tech@worksauce.com.au