# Privacy Policy **RateRight Pty Ltd** ABN: [Insert ABN] **Effective Date:** [Insert Date] **Last Updated:** [Insert Date] --- ## 1. Introduction RateRight Pty Ltd ("RateRight", "we", "us", or "our") operates a digital marketplace platform connecting contractors with construction workers across Australia. We are committed to protecting your privacy and handling your personal information in accordance with the *Privacy Act 1988* (Cth) and the 13 Australian Privacy Principles (APPs). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website, mobile application, and related services (collectively, the "Platform"). **Important Note:** RateRight is a marketplace platform only. We do not employ workers—all employment or engagement arrangements are made directly between contractors and workers. --- ## 2. What Personal Information We Collect We collect personal information that is reasonably necessary for our functions and activities as a marketplace platform (APP 3). ### 2.1 Information We Collect **Identity Information:** - Full name - Email address - Phone number - Profile photo (optional) - Date of birth (for verification purposes) **Business Information:** - Australian Business Number (ABN) - Business name and structure - Trade qualifications and licences - Insurance details (public liability, workers compensation) **Location Information:** - Suburb and postcode - Service area preferences - Real-time location (with your consent, for job matching) **Work History and Skills:** - Trade categories and specialisations - Work experience and employment history - Certifications (White Card, asbestos removal, working at heights, etc.) - Portfolio of completed work (optional) **Platform Activity:** - Ratings and reviews from other users - Job history on the Platform - Communication records within the Platform - Availability preferences **Financial Information:** - We do NOT store credit card numbers or full bank details - Stripe (our payment processor) handles payment information directly - Transaction records (amounts, dates, job references) **Device and Technical Information:** - IP address - Device type and operating system - Browser type - App usage data and analytics --- ## 3. How We Collect Personal Information In accordance with APP 3, we collect personal information by lawful and fair means. ### 3.1 Directly From You We collect information directly when you: - Create an account or profile on the Platform - Update your profile or settings - Apply for or post jobs - Communicate with other users through the Platform - Contact our customer support team - Respond to surveys or promotions - Subscribe to our newsletter ### 3.2 From Third Parties We may collect information from: - **Other Platform users:** Ratings, reviews, and feedback about your work or conduct - **Government databases:** ABN verification through the Australian Business Register - **Identity verification services:** To confirm your identity and qualifications - **Payment processors:** Stripe provides us with transaction confirmations (not card details) - **Social media platforms:** If you choose to sign up or log in via social media ### 3.3 Through Cookies and Tracking Technologies We use cookies and similar technologies to: - Keep you logged in to your account - Remember your preferences - Analyse how you use the Platform - Improve our services - Deliver relevant content See Section 11 for more details on cookies. --- ## 4. Why We Collect and How We Use Personal Information In accordance with APP 6, we only use your personal information for the purposes for which it was collected, or for directly related purposes you would reasonably expect. ### 4.1 Primary Purposes **Providing the Platform:** - Creating and managing your account - Matching workers with contractors based on skills, location, and availability - Facilitating communication between users - Processing job bookings and completions **Verification and Trust:** - Verifying your identity, ABN, and qualifications - Maintaining the integrity of ratings and reviews - Preventing fraud and ensuring Platform safety **Communication:** - Sending job notifications and matches - Service updates and important announcements - Customer support responses - Marketing communications (with your consent) ### 4.2 Secondary Purposes **Analytics and Improvement:** - Understanding how users interact with the Platform - Improving features and user experience - Developing new services **Legal Compliance:** - Complying with Australian laws and regulations - Responding to legal requests and court orders - Protecting our legal rights and interests --- ## 5. Disclosure of Personal Information We disclose your personal information only as described in this policy (APP 6). ### 5.1 To Other Platform Users - **Workers:** Contractors can view your profile, qualifications, ratings, and work history - **Contractors:** Workers can view your business details, job history, and ratings - **Shared information:** When you accept a job, relevant contact details are shared between parties to facilitate the engagement ### 5.2 To Service Providers We use trusted third-party service providers who process data on our behalf: | Provider | Purpose | Data Shared | |----------|---------|-------------| | Supabase | Database hosting | All Platform data | | Stripe | Payment processing | Transaction details, business info | | AWS | Cloud infrastructure | All Platform data | | SendGrid/Postmark | Email delivery | Email addresses, names | | Analytics providers | Platform analytics | Anonymised usage data | All service providers are contractually bound to protect your information and use it only for the specified purposes. ### 5.3 To Government and Regulatory Bodies We may disclose information: - To comply with legal obligations - In response to valid court orders or subpoenas - To the Australian Taxation Office for tax compliance purposes - To regulatory bodies investigating complaints ### 5.4 Business Transfers If RateRight is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change. --- ## 6. Overseas Disclosure In accordance with APP 8, we inform you that your personal information may be disclosed to overseas recipients. ### 6.1 Where Your Data May Be Stored Our primary infrastructure is hosted in **Australia (Sydney region)** through: - **Supabase:** Uses AWS Sydney (ap-southeast-2) as the primary data centre - **AWS:** Sydney region servers for Australian data However, some of our service providers may process data in other countries, including: - **United States:** Stripe (payment processing), some analytics and communication services - **European Union:** Some backup and disaster recovery systems ### 6.2 Your Protections Before disclosing personal information overseas, we take reasonable steps to ensure the recipient: - Is subject to a law or binding scheme substantially similar to the APPs, or - Has entered into a contractual arrangement with us requiring APP-equivalent protections By using the Platform, you consent to the overseas disclosure of your personal information as described in this section. --- ## 7. Data Security We take the security of your personal information seriously (APP 11). ### 7.1 Security Measures **Technical Safeguards:** - Encryption of data in transit (TLS/SSL) and at rest - Secure authentication and access controls - Regular security audits and vulnerability testing - Firewall and intrusion detection systems **Organisational Safeguards:** - Staff training on privacy and security - Access limited to authorised personnel only - Confidentiality agreements with employees and contractors - Incident response procedures **Payment Security:** - We are PCI-DSS compliant through our use of Stripe - We never store full credit card numbers on our systems - Payment processing is handled directly by Stripe's secure infrastructure ### 7.2 Your Responsibilities You are responsible for: - Keeping your login credentials secure - Not sharing your account with others - Logging out from shared devices - Reporting any suspected security breaches to us immediately ### 7.3 Data Breaches In the event of an eligible data breach under the Notifiable Data Breaches scheme, we will: - Notify affected individuals as soon as practicable - Notify the Office of the Australian Information Commissioner (OAIC) - Take steps to contain and remediate the breach --- ## 8. Access and Correction Rights You have rights to access and correct your personal information (APP 12 and APP 13). ### 8.1 Accessing Your Information You can access most of your personal information through your account settings on the Platform. For information not available through your account, you can request access by contacting us (see Section 13). We will respond to access requests within **30 days**. We may charge a reasonable fee for providing access to cover our costs. We may refuse access if: - The request is frivolous or vexatious - Access would impact the privacy of others - Access would prejudice legal proceedings - Access is otherwise lawfully refused If we refuse access, we will provide written reasons. ### 8.2 Correcting Your Information You can update most of your information directly through your account settings. If you believe any information we hold about you is inaccurate, incomplete, or out of date, please contact us and we will take reasonable steps to correct it within **30 days**. If we refuse to correct information, we will: - Provide written reasons for the refusal - Advise you of your right to complain to the OAIC - At your request, associate a statement with the information noting your claim that it is inaccurate --- ## 9. Data Retention and Destruction In accordance with APP 11, we only retain personal information for as long as necessary. ### 9.1 Retention Periods | Data Type | Retention Period | Reason | |-----------|-----------------|--------| | Active account data | Duration of account + 7 years | Legal and tax requirements | | Transaction records | 7 years after transaction | Tax and audit requirements | | Ratings and reviews | Indefinitely or until account deleted | Platform integrity | | Communication logs | 2 years | Dispute resolution | | Inactive accounts | 3 years of inactivity, then deleted | Data minimisation | ### 9.2 Account Deletion You can request deletion of your account by contacting us. Upon deletion: - Your profile will be removed from the Platform - Active job relationships will be concluded or transferred - We will retain certain information as required by law (e.g., tax records) - Some anonymised data may be retained for analytics ### 9.3 Destruction Methods When personal information is no longer needed, we: - Securely delete digital records using industry-standard methods - Ensure deletion propagates to backups within a reasonable timeframe - Require service providers to delete data upon our instruction --- ## 10. Direct Marketing ### 10.1 Your Choices We will only send you marketing communications with your consent. You can: - Opt out at any time using the "unsubscribe" link in emails - Update your marketing preferences in account settings - Contact us to stop receiving marketing ### 10.2 Transactional Communications We will always send you important transactional messages about your account and jobs, regardless of marketing preferences. These are not considered marketing. --- ## 11. Cookies and Tracking Technologies ### 11.1 What We Use **Essential Cookies:** Required for the Platform to function (e.g., authentication, security). **Analytics Cookies:** Help us understand how you use the Platform (e.g., Google Analytics, Mixpanel). **Functional Cookies:** Remember your preferences and settings. ### 11.2 Managing Cookies You can control cookies through your browser settings: - Block all cookies (may affect Platform functionality) - Delete cookies after each session - Accept only first-party cookies Most browsers allow you to see what cookies you have and delete them individually or block cookies from particular sites. ### 11.3 Do Not Track We currently do not respond to "Do Not Track" browser signals, as there is no consistent industry standard for compliance. --- ## 12. Changes to This Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. ### 12.1 Notification of Changes - **Material changes:** We will notify you by email and/or prominent notice on the Platform at least 14 days before the changes take effect - **Minor changes:** Posted on this page with an updated "Last Updated" date ### 12.2 Your Continued Use Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy. If you do not agree with changes, you should stop using the Platform and delete your account. --- ## 13. Contact Us If you have questions about this Privacy Policy or our privacy practices, please contact us: **RateRight Pty Ltd** Email: privacy@rateright.com.au Address: [Insert Business Address] Phone: [Insert Phone Number] We aim to respond to all privacy enquiries within **14 days**. --- ## 14. Complaints Process If you believe we have breached your privacy or the Australian Privacy Principles, you can lodge a complaint with us. ### 14.1 How to Complain to RateRight **Step 1:** Contact our Privacy Officer Email: privacy@rateright.com.au Subject line: "Privacy Complaint" Please include: - Your name and contact details - A description of your complaint - How you would like the matter resolved - Any supporting documents **Step 2:** Investigation We will acknowledge your complaint within **7 days** and investigate the matter. We aim to resolve complaints within **30 days**. **Step 3:** Response We will provide a written response explaining our findings and any actions we will take. ### 14.2 Escalation to the OAIC If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC): **Office of the Australian Information Commissioner** Website: [www.oaic.gov.au](https://www.oaic.gov.au) Phone: 1300 363 992 Email: enquiries@oaic.gov.au Address: GPO Box 5218, Sydney NSW 2001 The OAIC can investigate privacy complaints and has powers to make determinations and award compensation. --- ## 15. Australian Consumer Law In addition to the Privacy Act, your rights are protected under the *Australian Consumer Law* (ACL). Nothing in this Privacy Policy limits your rights under the ACL or any other applicable Australian laws. --- ## 16. Definitions **Personal Information:** Information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not. **Sensitive Information:** A subset of personal information that includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, and criminal records. We do not intentionally collect sensitive information except where required for specific purposes (e.g., health and safety certifications). **APP:** Australian Privacy Principle, as set out in Schedule 1 of the Privacy Act 1988 (Cth). --- ## Summary of Australian Privacy Principles Covered | APP | Principle | Section(s) | |-----|-----------|------------| | APP 1 | Open and transparent management | 1, 13, 14 | | APP 2 | Anonymity and pseudonymity | Not applicable (identity required for marketplace) | | APP 3 | Collection of solicited personal information | 2, 3 | | APP 4 | Dealing with unsolicited personal information | N/A | | APP 5 | Notification of collection | 2, 3 | | APP 6 | Use or disclosure of personal information | 4, 5 | | APP 7 | Direct marketing | 10 | | APP 8 | Cross-border disclosure | 6 | | APP 9 | Adoption, use or disclosure of government identifiers | ABN used for verification only | | APP 10 | Quality of personal information | 8.2 | | APP 11 | Security of personal information | 7, 9 | | APP 12 | Access to personal information | 8.1 | | APP 13 | Correction of personal information | 8.2 | --- **© RateRight Pty Ltd. All rights reserved.** *This Privacy Policy was last reviewed and updated on [Insert Date].*