Privacy policy
and how we handle information.

01Who we are and what this covers

StandardsIQ Pty Ltd (ACN 696 990 771, ABN 16 696 990 771) is an Australian company based in Melbourne. In this policy, we, us and StandardsIQ mean StandardsIQ Pty Ltd.

This policy applies to:

• this website at standardsiq.com.au and the pages within it,
• the StandardsIQ mobile applications for cleaners, supervisors and administrators,
• the StandardsIQ platform, including the administrator console, the supervisor and cleaner applications and the client portal.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where a contractor asks us to meet a higher standard in a written agreement, that agreement applies in addition to this policy.

02The two roles we play

StandardsIQ handles two very different kinds of information, and the difference decides who you should approach about it.

Information we hold for ourselves

This is information about visitors to our website, people who request a demonstration, and the people we deal with at contractors and suppliers. We decide what is collected and why, and we are responsible for it. Contact us directly about this information.

Information we hold for a contractor

When a cleaning contractor subscribes to StandardsIQ, they decide what is recorded in their account, who is added to it, and what it is used for. That includes records about their cleaners, supervisors, sites and clients. We hold and process that information on their instructions, as their service provider.

If you are a cleaner, supervisor or client user and you want to see, correct or remove information in a contractor's account, contact that contractor first. If you contact us, we will pass the request to them promptly and help them respond, but we will not change or release records in their account without their instruction unless the law requires us to.

03Information we collect

From website visitors

• Demonstration requests. Your name, company, work email, and optionally your phone number and how many sites you service.
• Correspondence. Anything you send us by email or tell us on a call.
• Technical information. Standard request information such as your IP address, browser type and the pages requested, handled by our hosting provider for delivery and security.

The demonstration form contains a hidden field that people never see and never fill in. If it is completed, the submission is discarded as automated. Nothing else is done with it.

From people using the StandardsIQ platform

• Account information. Name, work email, role, language preference and the sites a person is assigned to.
• Attendance records. Clock in and clock out times, and the location recorded at those moments. See section 04.
• Work records. Zones and tasks completed, tasks skipped and the reason given, audit scores and comments, issues, hazards and incidents raised, work orders, stock counts and messages.
• Photographs. Images captured as evidence of work. See section 05.
• Compliance and training records. Documents a contractor requires their workforce to hold, together with expiry dates and completion records.
• Device and log information. Application version, device type, error reports, sign in events and diagnostic logs used to keep the service working.

Sensitive information

Compliance documents may include information that the Privacy Act treats as sensitive, for example police check results or a Working With Children Check. We collect and store these only because a contractor requires them for the work, and only where the individual has provided them for that purpose. We do not use them for anything else.

04Location information

Location is the most sensitive thing the platform records about a person, so we treat it separately.

• What it is for. Verifying that a shift was worked at the site it was booked for. That is the only purpose.
• When it is recorded. At clock in and at clock out. If a contractor enables the optional background attendance feature and the worker turns it on and grants the permission on their own device, location may also be sampled while a shift is open.
• When it is not recorded. Outside an open shift. The platform is not designed to follow a person's movements between jobs or after work, and we do not use location for that.
• Honest records. If someone clocks in outside the expected area, the record is still created and is flagged as not verified rather than being altered or hidden.
• Turning it off. A worker can turn the background feature off in the application, or withdraw the permission in their device settings, at any time. Clock in and clock out will still work.
• How long it is kept. Individual location points captured during a shift are deleted automatically on a rolling schedule. The clock in and clock out record itself is kept as part of the contractor's operating record.

05Photographs and site evidence

Photographs taken in the platform are evidence of a work area, normally before and after cleaning. They are not intended to capture people, and workers are asked not to photograph individuals.

Photographs are stored privately rather than on a public address. They are reached through links that expire, and only people with a role that entitles them to a site can open them. A contractor decides whether their own client can see any of it.

06Workplace surveillance and worker notice

Recording attendance by location, and capturing images at a workplace, may amount to workplace surveillance under Australian state and territory law. Examples include the Workplace Surveillance Act 2005 (NSW) and the surveillance devices legislation in other states, which impose their own notice and consent requirements.

07How we use information

We use information to:

• provide, configure and support the platform,
• verify attendance and record the work performed,
• produce audits, reports, insights and client reporting from records already captured,
• send operational notifications, for example an expiring certificate or a raised issue,
• arrange and run demonstrations, and respond to enquiries,
• bill for the service and keep our own business records,
• protect the service against misuse, fraud and security incidents,
• meet our legal obligations,
• diagnose faults and improve the product.

We do not sell personal information. We do not use a contractor's operational records to advertise to anyone, and we do not disclose one contractor's information to another.

08Artificial intelligence processing

Some features use a third party large language model to summarise records, draft a suggested response to an issue, check a photograph against the task it belongs to, and prepare reporting. To do that, the relevant records are sent to that provider for processing and the result is written back into the contractor's account.

• Our AI provider is engaged under terms that do not permit customer content to be used to train their models.
• AI output is a draft and an aid to attention. It does not replace the underlying record, and it never overwrites what a person recorded.
• A person remains responsible for any decision taken about an individual. We do not use AI to make automated decisions about someone's employment.

09Who we share information with

We share information only where it is necessary:

• With the contractor whose account holds the record. Their authorised users see it according to the role and site permissions they set.
• With the contractor's own client, and only where the contractor has switched client access on for that site.
• With service providers who help us run the platform. These fall into a small number of categories: cloud infrastructure and database hosting, file storage, transactional email, artificial intelligence processing, mobile application distribution and error reporting, and accounting and payment services.
• With professional advisers, such as our lawyers and accountants, under confidentiality.
• Where the law requires it, or to protect the safety of a person, or to establish or defend a legal claim.
• In a business transfer. If the business is sold or restructured, information may transfer with it, subject to the buyer continuing to handle it under a policy at least as protective as this one.

A current list of the providers we use is available on request to contractors and to procurement teams evaluating us, under confidentiality.

10Storage outside Australia

Some of the providers we rely on may store or process information outside Australia. Where that happens we take reasonable steps to ensure the information is handled in a way consistent with the Australian Privacy Principles, including through the terms we agree with them.

If the hosting location of your data matters to your own obligations, ask us before you subscribe and we will tell you where it sits at that time in writing.

11How we protect information

• Information is encrypted in transit and at rest.
• Files are held in private storage and served through links that expire, rather than on public addresses.
• Each organisation's data is isolated from every other organisation, and that isolation is enforced by the access model rather than by relying on how a user behaves.
• Access is scoped by role and by site, so a person sees only what their role entitles them to see.
• Access can be removed immediately when someone leaves, and an archived user cannot sign in.
• Administrative access to production systems is limited to those who need it.

No system is perfectly secure, and we do not claim otherwise. A security brief with more detail is available on request for procurement and due diligence.

12Data breaches

If we become aware of unauthorised access to or disclosure of personal information, we will investigate promptly and contain it. Where a breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

If the information belongs to a contractor's account, we will notify that contractor without undue delay and give them what they need to meet their own obligations.

13How long we keep information

• While an account is active, records are kept so the operating history stays intact and reporting remains accurate.
• Individual location points captured during a shift are deleted automatically on a rolling schedule.
• When a subscription ends, the contractor may export their records. After that, data is deleted or de identified in line with the subscription agreement, except where we must keep something to meet a legal obligation.
• Backups are retained for a limited period and cycle out on their own schedule.
• Enquiry and demonstration records are kept while there is a reasonable prospect of doing business, and then deleted.

14Access, correction and your choices

You may ask us for access to the personal information we hold about you, and ask us to correct it if it is wrong. We will respond within a reasonable time. There is no charge for making a request, and we will tell you in advance if a request involves a cost.

We may need to verify who you are before we act, and in limited cases the law allows us to refuse. If we refuse, we will tell you why in writing.

If the information sits inside a contractor's account, see section 02. We will refer the request to them and assist.

You can ask to stop receiving marketing email from us at any time, by replying or by using the unsubscribe link. Operational notifications from the platform are part of the service and are controlled by the contractor who runs the account.

15Cookies and website analytics

This website does not set cookies, does not run advertising or social media tracking, and does not use a third party analytics product.

Two things are worth naming so the picture is complete:

• The site stores a single value in your browser's session storage so the opening animation plays once rather than on every page. It is not an identifier, it is not sent to us, and it disappears when you close the tab.
• The site loads its typefaces from Google Fonts. That means your browser makes a request to Google and Google receives your IP address as part of it. We do not receive anything from that request.

The platform applications store your signed in session on your own device so you stay signed in. That is necessary for the service to work.

16Children

StandardsIQ is a workplace product and is not directed at children. We do not knowingly collect personal information from anyone under 16. If a contractor employs a worker under 18, that person is added to the platform by their employer, and the employer is responsible for any consent required.

17Complaints

If you think we have mishandled your personal information, tell us. Write to admin@standardsiq.com.au with the detail and we will acknowledge it and investigate. We will respond in writing, normally within 30 days.

If you are not satisfied with our response, you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

18Changes to this policy

We will update this policy as the product and our obligations change. The version number and the effective date at the top of this page tell you which version you are reading. Where a change materially affects contractors, we will tell them directly rather than relying on this page alone.

19How to contact us

Terms of use · Security and your data