Privacy policy.

This policy explains how Exclaim IT Pty Ltd ACN 109 189 059 (Exclaim IT, we, us or our) collects, stores, uses and shares personal information, and how you can access it, correct it or make a complaint.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) in Schedule 1 of that Act.

When we work as a contracted service provider to Commonwealth, state or territory government agencies, we may also be bound by that agency’s privacy obligations. Contact us if you want to know whether this applies to you.

We may update this policy from time to time. The current version is always on our website, and we can send you a copy on request. This policy is not a contract and does not create contractual rights or obligations. Exclaim IT may amend or replace it at any time.

This policy covers personal information about:

• Candidates: people looking for permanent or contract work through us, including people we approach about a role, and contractors we place with clients.
• Clients: people at organisations that use, or might use, our recruitment services.
• Referees: people who give us facts or opinions about a candidate.
• Website and social media users: people who visit our website or interact with our social media pages.

It does not cover the employee records of our own internal staff, which are handled under our internal HR policies.

Personal information is information or an opinion about an identified person, or a person who can reasonably be identified. It does not matter whether the information is true or whether it is recorded.

Sensitive information is a subset that receives extra protection. It includes racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, membership of a professional or trade association, trade union membership or associations, sexual orientation or practices, criminal record, health or genetic information, biometric information used for automated biometric verification or identification, and biometric templates.

We only collect personal information that is reasonably necessary for our recruitment and contracting work. We do not collect information because it might be useful one day, and we do not collect or use it for unlawful discrimination.

Candidates

• Name, contact details and address and, when you are being considered for or placed in a role, your date of birth and place of birth.
• Your CV, skills, qualifications, certifications, work history and career preferences.
• Salary or rate expectations, availability and preferred work locations.
• Notes from interviews, calls and messages with our consultants.
• Results of skills tests, assessments and competency checks.
• Your answers to online screening questions, including AI-assisted screenings, and any summary or score produced from them.
• References and other people’s opinions about your work.
• Identity documents, such as your passport, visa or driver’s licence, and a selfie or live photo used to verify your identity against them (see Identity and work rights checks in section 5).
• Work rights and citizenship information, including visa conditions.
• Licences, tickets and training records required for a role.

Contractors
In addition to the information above, we may collect:

• Tax file number, bank and superannuation details, timesheets, pay records and signed contracts.
• Performance feedback and leave of absence records.
• Incident reports and, if you are injured at work, health information needed to manage a workers compensation claim and your return to work, such as the nature of your injury and medical certificates.

Clients
We may collect:

• Name, job title, work contact details and your organisation’s details (such as ABN and site addresses).
• Hiring needs, team structures and role requirements.
• Records of our dealings with you, including feedback on candidates.
• Credit and financial information needed to set up your account and invoice you.

Referees
We may collect:

• Name, job title, contact details and your working relationship with the candidate.
• Your opinions about the candidate and the facts behind them.

Sensitive information

We only collect sensitive information with your consent (or where the law requires or authorises it), and only where it is needed for a role. Examples include a criminal history check, a security clearance for government work, health information needed to manage a workplace injury or workers compensation claim, and biometric information (a facial template created from a selfie or live photo) used by our identity verification provider to confirm your identity. Equal opportunity and anti-discrimination laws also limit what we can ask for and how we use it.

Dealing with us anonymously

You can make general enquiries without giving your name, or by using a pseudonym. To be considered for a role or placed in work, you will need to identify yourself, because clients and the law require it.

Most information comes directly from you: when you apply for a role, register with us, speak with a consultant, sign a contract, complete a check or submit a timesheet.

We may also collect information from other sources:

• Job boards and professional networks, such as Seek and LinkedIn, when you apply through them or when your profile is publicly visible there.
• Business contact databases, which give us work contact details for people at client and prospective client organisations.
• Referees, including through our online reference checking service.
• Screening providers, for work rights, identity, criminal history, qualification and licence checks. We only run these with your consent or where the law requires them.
• Clients, who give us feedback on your interviews and performance on assignment, and report workplace incidents.
• Public sources, such as professional registers, company websites and news articles, where relevant to a role.
• Insurers, lawyers and investigators, in connection with a workplace incident, insurance claim, complaint or legal proceeding that involves you.

If we receive personal information we did not ask for, we check whether we could have lawfully collected it. If not, we destroy or de-identify it as soon as practicable.

Identity and work rights checks

We currently use a third-party provider, WorkPro, to verify your identity and work rights. You will be asked to create a WorkPro account, upload an identity document and take or upload a selfie. WorkPro currently uses facial recognition technology to check that the selfie is of a live person and matches the photo on your identity document. It also checks your documents with government systems, including the Document Verification Service and the Department of Home Affairs’ VEVO system.

WorkPro confirms it does not keep your selfie after the check. It stores an encrypted numerical facial template and the outcome of the check in your WorkPro profile, and you can delete your facial data from your profile when you are logged in. We receive the outcome of the check and the documents needed to confirm your work rights. WorkPro’s own privacy policy and terms also apply.

Facial verification is used as a step in our identity check. If you do not want to complete facial verification, tell us and we will offer another way to verify your identity, such as sighting your original identity documents in person or by video call. If you do not complete an identity check by either method, we may not be able to place you in a role.

Calls and video

We use a cloud phone system and mobile phones for calls and text messages. We may record calls for training, quality and record-keeping purposes, and we will tell you at the start of the call. You can ask us not to record. If we use a transcription or AI note-taking tool during a phone or video interview, we will tell you at the start and you can ask us not to use it. Recordings, transcripts and AI-generated notes form part of your record and are handled under this policy.

AI-assisted screening

When you apply for some roles, we may invite you to complete an online screening that uses AI. The screening asks you questions about your right to work, security clearance, skills, experience, availability and other requirements of the role. It may summarise your answers and show how closely they match the role’s requirements, for a consultant to review. We will tell you before you start that the screening uses AI.

Your answers, and any summary or score produced from them, form part of your record and are handled under this policy. The screening does not automatically reject you: a consultant reviews the results before deciding whether to progress your application. If you would prefer not to complete an AI-assisted screening, or you need an adjustment to complete it, contact the consultant for the role and we will discuss another way to assess you.

We use personal information for the purposes it was collected for, and for related purposes you would reasonably expect.

For candidates, we use it to:

• assess your suitability and match you with roles.
• present your profile to clients, with your agreement for each role.
• run reference, work rights and other pre-employment checks.
• arrange contracts, inductions, training and required licences.
• pay contractors, process timesheets and meet tax, superannuation and workplace safety obligations.
• manage your assignment, including performance feedback and incidents.
• keep you informed about roles that match your preferences.

For clients, we use it to manage our relationship, understand your hiring needs, deliver our services, invoice you, check your credit, and give candidates feedback on their applications and interviews.

For referees, we use it to confirm your identity and your authority to give a reference, and to assess the candidate.

We also use personal information to meet our legal obligations, to deal with complaints, investigations, insurance claims and legal proceedings, to protect against fraud and scams, to prepare de-identified reports about our business, and to improve our services.

We may send you job alerts, market updates, newsletters and event invitations by email, SMS, phone or LinkedIn. Clients and prospective clients may also receive information about our services.

Every marketing email and SMS includes a way to unsubscribe. You can also opt out at any time by contacting us. Opting out of marketing does not stop us contacting you about a role you have applied for or an assignment you are working on.

If we obtained your contact details from another source, such as a business contact database, you can ask us where we got them and we will tell you unless it is impracticable or unreasonable to do so. We only send marketing emails and SMS where we have your consent, or where the Spam Act 2003 (Cth) allows consent to be inferred. When we market by phone, we comply with the Do Not Call Register Act 2006 (Cth).

We do not sell personal information, and we do not share it with other organisations for their own marketing.

When you visit our website, we and our analytics providers collect technical information such as your IP address, device, browser, pages viewed and how you arrived. We use cookies and similar technologies to make the site work, remember your preferences and understand how it is used.

You can block or delete cookies in your browser settings, though some parts of the site may not work properly. When you interact with our social media pages, the platform’s own privacy policy also applies. The same applies to third-party websites we link to, such as job boards and our identity verification provider. We are not responsible for their privacy practices.

We store personal information electronically in cloud-based systems. Access is limited to staff who need it, through individual log-ins. We take reasonable technical and organisational steps to protect it, including encryption, access logging and staff privacy training.

We keep personal information only while we need it for our work or the law requires us to keep it.

We keep your candidate profile in our recruitment database until 7 years after the last activity on it, and then permanently delete it. Activity includes applying for a role, updating your details or being in contact with one of our consultants.

If we have placed you in a role, we also keep records about the placement, pay, tax and superannuation for at least 7 years, because the law requires it.

You can ask us to remove you from our database at any time. We will then delete the information we do not need to keep, and mark the rest inactive so you are not contacted again.

If a data breach is likely to cause serious harm to anyone, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme. We keep a data breach response plan and review it regularly.

You can ask for access to the personal information we hold about you. We will need to confirm your identity first. We aim to respond within 10 working days, and within 30 days at the latest.

Making a request is free. We may charge a reasonable fee to cover the cost of providing a large amount of information, and we will tell you before we do.

We may refuse access in some cases the law allows. One common example is a confidential reference, where giving access would reveal another person’s personal information. If we refuse, we will explain why in writing and tell you how to complain.

If you think information we hold is wrong, out of date, incomplete or misleading, ask us to correct it. Corrections are free. If we disagree, we will tell you why in writing, and you can ask us to attach a statement to your record.

We take reasonable steps to make sure the personal information we collect, use and disclose is accurate, up to date, complete and relevant. If we correct information we have disclosed to someone else, you can ask us to tell them about the correction.

The OAIC publishes information about privacy law, the Australian Privacy Principles and your privacy rights at https://www.oaic.gov.au.

Our Information Collection Notice summarises what personal information we collect from candidates, why we collect it and who we share it with. You can read it on our website or ask us for a copy.

Version: 2.0
Date: 01/11/2026
Changes: Full review: AI and automated decisions, marketing, website, overseas disclosure, data breaches
Checked: OB
Authorised: GC