Legal
need Help?
Info@bigredsky.com
| Scope of Policy | |
| Who is this Policy issued by? | This Policy is issued by BigRedSky. It applies to us and our subsidiaries, unless another express policy has been issued. |
| What is this Policy? | We recognise and respect your privacy and data protection rights. We seek to manage your Personal Information in a fair, open and transparent way. We are committed to the objectives of the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) (Privacy Act). The Policy has been prepared primarily to meet privacy and data protection standards under Australian law. |
| What is the scope of this Policy? | This Policy describes our practices in connection with Personal Information including how and why we collect, use, store, secure, destroy, de-identify and disclose your Personal Information. Specifically, this Policy explains:
By providing your Personal Information to us, you agree to this Policy (and any updates) and you consent to our management of your Personal Information in accordance with this Policy and any other arrangements that apply between us. |
| What is Personal Information? | Personal Information under the Privacy Act means information or an opinion about an identified individual (e.g. a natural person), or an individual who is reasonably identifiable:
|
| Does this Policy apply to general confidential information? | This Policy only applies to Personal Information. It does not apply to general confidential or commercially sensitive (e.g. contract terms, transactional information, customer information etc.), unless that information is Personal Information. If information is both Personal Information and general confidential or commercially sensitive information, we will deal with that information in accordance with the requirements of this Policy and any other confidentiality obligations to which we are bound. |
| Our Business Activities | |
| What does BigRedSky do? | At the date of this Policy, our business involves providing to organisations cloud-based applicant tracking and employee onboarding and induction modules deployed under a software-as-a-service model comprising the "cvMail" and "BigRedSky" product offerings. |
| Collection of Personal Information | |
| How is Personal Information collected? | We seek to ensure that we only collect Personal Information by lawful and fair means. We collect your Personal Information in several ways, including but not limited to our websites, telephone, email, letter or facsimile, in person, publicly available information sources, cookies, apps and online tracking. |
| Is Personal Information collected from third parties? | We may collect Personal Information from third parties, including government agencies and business associates. We will only collect Personal Information from third parties if:
|
| Personal Information Collected | |
| What types of Personal Information are collected? | The types of Personal Information that we collect will depend on the nature of your dealings with us. Some examples include:
From time to time, we collect Sensitive Information about individuals in order to provide our services. However, we only collect sensitive information if:
|
| Purpose of Collection | |
| Why is Personal Information collected? | We collect and hold Personal Information if it is reasonably necessary to pursue at least one of our functions or activities or its collection and storage is required or authorised by or under an Australian law or a court/tribunal order. |
| When is Sensitive Information collected? | Sensitive Information will only be collected and stored:
|
| For what purpose is Personal Information collected? | We may collect, hold, use, secure, destroy, de-identify and disclose your Personal Information for the following purposes:
Generally, we will only use or disclose Personal Information for the purpose for which it was collected (Primary Purpose), including the purposes set out above. In certain circumstances, we may be required or permitted by law or a court or tribunal to collect and retain certain Personal Information about you. |
| Can Personal Information be collected for a secondary purpose? | We may use or disclose Personal Information for secondary purposes if we receive your consent to do so, or without your consent, if:
|
| Consent | |
| How does this Policy apply to me? | By providing your Personal Information to us, for example, through:
|
| Can I opt out? | You have the right to opt out of our collection and use of your Personal Information. Please contact us directly if you wish to withdraw your consent. |
| Will my consent be required for my Sensitive Information? | We will seek express consent from you before collecting and dealing with your Sensitive Information. |
| Disclosure and Transfer of Personal Information | |
| Can my Personal Information be disclosed? | We may disclose Personal Information for the purposes described in this Policy to:
|
| Will my Personal Information be disclosed to persons overseas? | From time to time, circumstances may arise where there may be a need for us to disclose or transfer Personal Information to an overseas recipient or receive Personal Information from an overseas recipient. This may occur in a range of circumstances. For example:
We seek to carefully consider and where possible limit our overseas transfers of Personal Information and disclosures to jurisdictions with substantially similar privacy protections. However, you should be aware of the inherent risks of international transfers of Personal Information, particularly to jurisdictions which may have markedly different privacy protections to Australia. By using our website and/or through your employment with us, you consent to all overseas disclosures of Personal Information. |
| To which countries may my Personal Information be disclosed? | The countries in which your Personal Information is likely to be held or transferred include, but are not limited to Australia, India and the United Kingdom. |
| Will overseas recipients need to comply with the Australian Privacy Principles? | Before disclosing Personal Information to an overseas recipient, we will take such steps as are reasonable in the circumstances to ensure that the overseas recipient also adopts privacy procedures which materially comply with the APPs in relation to that information, unless the APPs would not require us to do so. We will not be required to take such steps if:
|
| Do any third-party service providers collect my Personal Information? | Your Personal Information may be collected by third parties service providers who perform certain business-related functions for us. We do not control the collection and management of this Personal Information. To the extent permitted by law, we do not take any responsibility or liability for how such third parties which we do not control collect and deal with your Personal Information. |
| Security and Data Breach | |
| Is my Personal Information secured? | The security of your Personal Information is important to us. We take reasonable steps to protect your Personal Information from misuse, interference, hacking and loss, as well as unauthorised access, modification or disclosure. However, security measures are not an absolute protection and there is an inherent risk of unauthorised access. To the extent permitted by law, we exclude legal liability for any harm or damage eventuating from security related incidents. |
| What steps are taken to secure Personal Information? | We use several physical, administrative, personnel and technical measures to protect your Personal Information. Our third-party providers use commercially reasonable physical, administrative, and technical safeguards to preserve the integrity and security of your Personal Information. They also provide various security strategies to effectively ensure data security of user and device. With regards to:
|
| Will I be notified if there is a data breach? | Depending on the circumstances, we may notify you, any affected individuals and, if required by applicable law, the relevant regulator, as soon as practicable after we become aware that there are reasonable grounds to believe that there has been a data breach that is an 'eligible data breach' under the Privacy Act. If it is impracticable to notify all affected individuals, and depending on the circumstances of the breach, we may publish a statement on our website and publicise the content of that statement. We may not provide notice where it would be inconsistent with secrecy provisions or prejudice law enforcement actions. If we have taken sufficient remedial action in response to the data breach, or if the regulator determines that notification is not required (if applicable), then we may not notify you of the breach. |
| Retention and Destruction | |
| How long will my Personal Information be retained? | We will hold your Personal Information for so long as we consider reasonably necessary for the purposes set out in this Policy. |
| Is my Personal Information deleted/destroyed? | If we hold Personal Information about an individual which we no longer require, we will take reasonable steps to destroy the information or ensure that it is de-identified, unless prohibited by law or the APPs otherwise require us to avoid taking such steps. If we are unable to destroy your Personal Information due to technical reasons, we will ensure that appropriate measures are put in place to prevent further use or identification of your Personal Information. |
| Quality and Access to Personal Information | |
| How will my Personal Information be maintained? | We will endeavour to take reasonable steps to ensure that the Personal Information that we collect is accurate, up-to-date and complete. The reasonable steps described above that we may undertake include:
|
| What do I do if my Personal Information is out-of-date? | If you think that the Personal Information that we hold about you might be out of date and needs to be corrected, please contact us using the details located at the end of this Policy. |
| Can I access my Personal Information? | You may request access to any of the Personal Information we hold about you. In most cases, a summary of your personal information will be freely available to you by contacting us. We may need to confirm your identity prior to taking further action, for security purposes. Requests for access to your Personal Information will be handled within a reasonable period and we will endeavor to give you access to the information in the format and manner requested, if it is reasonable and practicable to do so. We will endeavour to take reasonable steps to give access in a way that meets the needs of BigRedSky and yourself, noting that access may be given using a mutually agreed intermediary. |
| Are there any exceptions to my right of access? | The APPs provide a list of situations in which access to an individual's Personal Information may be denied. We may deny an individual access to their Personal Information in these circumstances. Such situations include, but are not limited to where:
If we refuse to give access to Personal Information, we will provide a written notice setting out:
|
| Will I be charged to access my Personal Information? | We will not charge fees for requests by you to access your Personal Information. |
| Correction of Personal Information | |
| Can I correct my Personal Information? | If, with regard to the purpose for which it is held, we are satisfied that Personal Information we hold is inaccurate, out-of-date, incomplete, irrelevant or misleading, or if the individual about whom the Personal Information relates makes a request, we will take reasonable steps to correct the information. However, as a matter of practice, when we receive Personal Information, we will hold the information for a period before we consider whether it is inaccurate, out-of-date, incomplete, irrelevant or misleading (unless we are informed otherwise). If we correct Personal Information at the individual requests, we will take reasonable steps to notify any third party to whom we previously disclosed the Personal Information, if it is not unlawful or impracticable for us to do so. Further, you may request that we associate the information with a statement that the information is inaccurate, out-of-date, incomplete, irrelevant or misleading (Correction Statement). Where such a request is made, we will take reasonable steps to associate the correction statement with the Personal Information, so that it is apparent to the users of the Personal Information. We will aim to respond to a request to correct information or associate a Correction Statement with the Personal Information within a reasonable period of the request being made. |
| Are there exceptions to my right to request a correction? | If we refuse to correct Personal Information in circumstances permitted by the APPs, we will provide a written notice setting out:
|
| Will I be charged for a correction? | We will not charge fees for requests for the correction of Personal Information or for associating a Correction Statement with the Personal Information. |
| How do I request to amend my Personal Information? | Requests for correction of Personal Information should be made in writing and sent to us using the enquiries contact details set out below. |
| Miscellaneous | |
| What happens if you receive unsolicited Personal Information? | If we receive Personal Information that we did not solicit, we will, within a reasonable period of receiving the information, determine whether we would have been permitted to collect the information in circumstances permitted by the APPs. If we determine that we have received Personal Information that we are not permitted to collect under the APPs (and the information is not contained in a Commonwealth record), we will as soon as practicable and where it is lawful and reasonable to do so, destroy the information or ensure that it is de-identified. If we determine that collection of the Personal Information is permitted under the APPs, we will ensure that the information is dealt with in a manner that complies with this Policy. |
| Can the Policy be changed? | We may change, update, revoke or replace the Policy from time to time by publishing changes to it on our website. We may notify you via email. We encourage you to periodically review the privacy policy on the website for the latest information about our privacy practices. |
| How do I make a complaint? | If you wish to make a complaint about the way we have handled your Personal Information, you can contact us using the details set out below. Please include your name, email address and/or telephone number and clearly describe your complaint. We will respond to you regarding your complaint within a reasonable period. |
| Who should I contact for enquiries? | For further information about the Policy or our practices, or to access or correct your Personal Information, or make a complaint, please contact us at helpdesk@bigredsky.com. |
| Interpretation | |
| External definitions | Words and phrases which are defined under the Australian Privacy Act (including interpretive guidance published by the regulatory bodies under the same) have the same meanings when used in this Policy, unless inconsistent with the context. |
| Glossary | The following definitions apply in this Policy, unless the context requires otherwise: |
| Affiliate | in relation to a company or body corporate, means: the holding company of that company or body corporate; a subsidiary of that company or body corporate; a subsidiary of the holding company of that company or body corporate; or a 'related body corporate' of that company or body corporate for the purposes of the Corporations Act 2001 (Cth) of Australia. |
| Australian Privacy Principles or APPs | means the Australian Privacy Principles in Schedule 1 of the Privacy Act. |
| Personal Information | has the meaning given to that term in the Privacy Act, being information or an opinion about an identified individual, or an individual who is reasonably identifiable: whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not; as the context requires. By way of example, this may include an individual's: name; address; phone number; or photograph or video recording. |
| Policy | means this Privacy Policy, as amended, updated or supplemented from time to time. |
| Privacy Act | means the Privacy Act 1988 (Cth) of Australia. |
| Sensitive Information | has the meaning given to that term in the Privacy Act, or as the context requires. By way of example, this may include an individual's: racial or ethnic origin; political opinions or membership of a political association; religious beliefs; philosophical beliefs; membership of a trade union; health; criminal record; and sexual orientation or practices. |
| Services | means a service provided by or on behalf of BigRedSky. |
| BigRedSky, we, us or our | means BigRedSky Limited (ACN 692 733 716) and, where the context requires, includes its Affiliates. |
| you or your | means an individual whose Personal Information we manage. |
Effective Date:
Monday 1st March, 2026
last modified date:
Monday 1st March, 2026
need Help?
Info@bigredsky.com
