Privacy Policy

1. Purpose and Scope

This Privacy Policy sets out how Aylwin Chan (ABN 93 517 592 214) (“cink”, “we”, “us”, or “our”) manages personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

This privacy policy explains how and why we collect, use, hold, disclose or otherwise manage your personal information.

We provide a cloud-hosted workforce management platform that helps Australian businesses manage employee onboarding, rostering and timesheets, and prepare approved pay data for their payroll software (such as Xero) (“Platform”). This Privacy Policy covers both the personal information we collect for our own business purposes and the personal information stored in the Platform by our customers and their staff, which we hold on the relevant customer’s behalf.

Who "you" means

In this Privacy Policy, “you” means any individual whose personal information we handle. That includes:

• our customers who are individuals, and the owners, administrators and other personnel of our customers who use the Platform;
• employees, workers and job candidates of our customers whose information is entered into the Platform (whether by the customer or by the individual) — we hold this information on the customer’s behalf, as explained below;
• visitors to our website and people who contact us; and
• people who apply to work with us.

Some sections of this Privacy Policy apply only to some of these groups.

2. What Is Personal Information?

Personal information is any information or an opinion about an identified individual or an individual who can be reasonably identified from the information or opinion. Information or an opinion may be personal information regardless of whether it is true.

This privacy policy applies to all personal information collected, used, held, disclosed or otherwise managed by us in the course of our business activities and supplies as a provider of cloud-hosted software and related services.

3. Personal Information We Handle for Our Customers Using the Platform

Our customers use the Platform to manage their workforce. In doing so, our customers enter and store personal information about their employees, workers and job candidates in the Platform, and may invite their employees and workers to enter or update their own information directly (for example, when completing onboarding or submitting timesheets). This can include:

• name and contact details;
• date of birth;
• emergency contact details;
• bank account, tax file number and superannuation details collected for payroll onboarding;
• award or agreement classification, pay rates and employment terms;
• rosters, shifts, timesheets and leave records; and
• signed employment contracts and policy acknowledgements.

We hold and process this information on behalf of the relevant customer in order to provide the Platform, including integrating pay data to payroll services such as Xero where the customer has enabled that integration. This applies whether the information is entered by the customer or by the worker at the employer’s invitation or direction — in each case we hold it on the customer’s behalf. The customer controls this information, including its accuracy, who may access it and how long it is retained. If you are an employee or worker of one of our customers and have questions about your information in the Platform, please contact your employer in the first instance. If we receive a request from you about information we hold on a customer’s behalf, we will refer it to the relevant customer and assist them to respond.

We handle tax file numbers only for payroll-related purposes and in accordance with the Privacy (Tax File Number) Rule 2015.

4. Types of Personal Information We Collect or Hold

We collect and hold personal information about you and your interactions with us. For example, when you visit or use our website, call or text us, email us, create an account, sign in with a one-time passcode, subscribe to one of our plans, request support, use the chatbot, fill in forms or participate in our promotions.

The types of personal information we collect depend on your interactions with us and may include information about:

• your identity and contact details (such as your name, address, email address or phone number);
• your account and sign-in details, including the email address (and any mobile number) we use to send one-time sign-in passcodes;
• records of your dealings with our support team, including support requests and correspondence;
• payment details (such as your payment card or direct debit details, which are collected and held by our payment processor);
• your subscription, billing and payment history; and
• information and data about how you access, use or interact with our website, which may be collected via a range of tools, such as cookies and can include: the location from which you have come to the website and the pages you have visited; and technical data, which may include IP address or domain name, the types of devices you are using to access the website, device attributes, browser type, language and operating system.

Cookies and similar technologies

Our website uses cookies and similar technologies to improve user experience, monitor performance, and analyse website traffic.

A cookie is a small text file that the website may place on your device to store information. We may use persistent cookies (which remain on your computer even after you close your browser) to store information that may speed up your use of our website for any of your future visits to the website. We may also use session cookies (which no longer remain after you end your browsing session) to help manage the display and presentation of information on the website.

You may disable and refuse the use of cookies by selecting the appropriate settings in your browser. However, please note that if you do so, you may not be able to use the full features and functionality of our website.

Our website may contain links to third-party websites. We are not responsible for the privacy controls or practices or any content of any linked site. Linked websites may have their own privacy policies and are not subject to this privacy policy.

5. Sensitive Information and Children

We generally do not collect sensitive information about you (such as health information). Our customers may store certain sensitive information about their workers in the Platform (for example, information supporting leave requests); we hold that information on behalf of the relevant customer as described in this policy.

Young workers

Some of our customers employ people under 18, who may enter their own information into the Platform at their employer’s direction — for example, when completing onboarding or submitting timesheets. We design these screens to be clear and easy to understand. If you are under 18, you are welcome to ask a parent, guardian or your employer to help you complete them. Where the law requires consent for the handling of a young person’s information and the young person does not have the capacity to give it, we rely on our customer, as the employer, to obtain that consent from a parent or guardian.

6. How Do We Collect Your Personal Information From You?

We generally collect your personal information directly from you when you interact with us.

If your employer uses the Platform, we also collect personal information directly from you when you enter or update it in the Platform yourself — for example, when you complete onboarding, submit timesheets or update your details at your employer’s direction. We hold that information on your employer’s behalf, as described above.

We may also collect your personal information from third parties, including your employer (where it uses the Platform to manage its workforce), third-party services you or your employer connect to the Platform (such as Xero), and our service partners.

Where you or your employer connects the Platform to a third-party service such as Xero, we may also collect personal information from, and disclose it to, that service in order to operate the integration.

You can choose not to share your personal information with us. However, if you do not provide us with your personal information, we may not be able to provide you with our products or services, communicate with you or respond to your enquiries. Your use and access to our website may also be impacted.

7. Dealing With Us Anonymously

Where it is lawful and practicable, you may deal with us anonymously or using a pseudonym — for example, when making a general enquiry about our products or services. However, it is generally not practicable for us to deal with you anonymously on an ongoing basis. If we cannot collect your personal information, we may not be able to provide you with our products or services.

8. Use of Personal Information

We may collect, hold and use personal information so that we can:

• provide, operate, secure and support the Platform and our services, and manage our relationship with you;
• establish, manage, and maintain accounts and authenticate users, including by sending one-time sign-in passcodes;
• contact and communicate with you regarding your queries, account management, billing, service notices, complaints or if we need to tell you something important;
• provide support;
• provide you with information about other products, services or events we offer, such as via marketing communications, newsletters and promotions;
• seek your feedback about our products, services or events, including through reviews and direct feedback requests;
• analyse website and Platform usage, including on a de-identified or aggregated basis, to operate, improve and develop our website, products and features;
• provide optional Platform features, including features that use artificial intelligence, and use artificial intelligence technologies in operating, securing and supporting the Platform (for example, in support triage and anomaly detection) — we do not use personal information that identifies you to train generalised artificial intelligence models without express consent;
• comply with any applicable legal obligations, including record-keeping requirements; and
• where required, assist government and law enforcement agencies or regulators.

We will not use your personal information for an unrelated purpose without your consent, unless permitted or required by law.

9. Disclosure of Your Personal Information

We may transfer or disclose your personal information to third parties and external service providers so they may perform services for us or on our behalf, as part of our business operations or in relation to our product, service or event supply. For example, this includes to:

• our service providers that help us operate the Platform and our business, including customer support and analytics providers;
• our IT service providers, cloud hosting providers, and system administrators — including Amazon Web Services (which stores Platform data at rest in Australia) and Render (which hosts the application layer of the Platform in Singapore);
• our payment processors;
• our professional advisers, including auditors, lawyers, and accountants (on a need-to-know basis);
• third-party services that you or your employer choose to connect to the Platform, such as Xero — we disclose information to those services at your or your employer’s direction, and their handling of your information is governed by their own privacy policies and terms; and
• providers of artificial intelligence services that we use to deliver Platform features or to operate and support the Platform (where used) — we require these providers not to use personal information to train their models.

We may also disclose your personal information to others where:

• we are required or authorised by law to do so;
• you have expressly consented to the disclosure or the consent may be reasonably inferred from the circumstances;
• we are otherwise permitted to disclose the information under the Privacy Act; or
• ownership or control of all or part of our business changes, in which case we may transfer your personal information to the new owner or controller.

Third parties to whom we disclose your per sonal information may contact you directly to tell you they have collected your information and to give you information about their privacy policies.

10. Storage and Holding Your Personal Information

We take reasonable steps to implement and maintain technical and organisational measures for the secure storage and protection of your personal information from misuse, loss, unauthorised access, modification, or disclosure, including the following:

• requiring our employees to comply with this privacy policy and complete privacy and information security training;
• use of technology to monitor and control access to systems on which your information is processed or stored;
• encrypting personal information in transit and at rest;
• using one-time passcode sign-in instead of stored passwords; and
• ensuring our third-party service providers who store or process your personal information (including cloud storage providers) have appropriate contractual and security measures in place to protect that information.

We will also take reasonable steps to destroy or de-identify personal information once we no longer require it for the purposes for which it was collected or for any secondary purpose permitted under the APPs.

Most of your personal information will be stored by us in electronic format in computer systems and within secure databases operated by us or our external service providers. We may also securely store some of your personal information on paper or in hard copy format.

While we take reasonable steps to protect your personal information, no transmission of information over the internet is completely secure. Please take care when sending personal information to us over the internet, including by email.

11. Overseas Disclosure

In some circumstances, we may disclose your personal information to recipients and businesses located outside Australia, including vendors and service providers in:

• Singapore — where our application hosting provider processes Platform data in delivering the Platform;
• Japan — transactional email and SMS / one-time passcode delivery;
• United States — payment processing and email delivery; and
• Oceania and New Zealand — document storage.

When we do this, we take reasonable steps in the circumstances to ensure that overseas recipients comply with the APPs.

12. Access and Correction

You may request access to, or correction of, the personal information held about you by contacting us.

If your request relates to information your employer (or another of our customers) holds in the Platform, we may refer your request to that customer and will assist them to respond, as described above.

Please make your requests in writing and send these to our Privacy Officer using the contact details provided in this privacy policy below. We may require you to verify your identity before granting access.

There is no charge for requesting access to your personal information, but we may require you to meet our reasonable costs in providing you with access (such as photocopying costs or costs for time spent on collating large amounts of material).

We will respond to your personal access and/or correction requests within a reasonable time and in accordance with the Privacy Act. There are some circumstances in which we are not required to give you access to your personal information.

If we refuse your request to access or correct your personal information, we will give you written reasons for our decision and information about how you can complain about the refusal. If we refuse a request to correct your information, you may also ask us to attach a statement to that information noting that you consider it inaccurate, out-of-date, incomplete, irrelevant or misleading.

We will take all reasonable steps to ensure that the personal information we hold about you remains accurate, up-to-date, complete, relevant, and not misleading.

13. Complaints

If you have a complaint about the way we have handled your personal information or a privacy issue, including a request for access or correction of your personal information, you should contact us on the contact details in this privacy policy (below) and lodge your complaint with our Privacy Officer.

We will consider and investigate your complaint. We will respond to you with the outcome of this consideration and investigation within a reasonable timeframe.

We will acknowledge your complaint within 7 days and aim to respond to you with the outcome of our investigation within 30 days. If your complaint is more complex or our investigation takes longer, we will let you know.

If you are not satisfied with the way we have handled your complaint or your privacy issue, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au for guidance on alternative courses of action that may be available.

14. Updates to This Privacy Policy

We may change or update this Privacy Policy from time to time. Any changes to our policy will be published on our website.

Our current policy can be obtained from our website or by contacting us at the contact details below.

15. Our Privacy Contact Details

Please send any questions, comments, requests or complaints relating to this privacy policy or privacy issues to:

Entity	Aylwin Chan (ABN 93 517 592 214), trading as cink
Privacy Officer	hello@cink.com.au

If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.