Privacy Policy

This Policy explains how Damien Crane trading as ISOweld (ABN 50 803 660 487), New South Wales, Australia handles personal information. ISOweld intends to use the Australian Privacy Principles as its baseline even where the full Privacy Act 1988 may not apply because application depends on turnover, activities and exceptions.

1. Scope and roles

The Policy covers the website, application, kiosk, accounts, support, integrations and verification pages. Customers generally decide why workforce records are collected; ISOweld generally processes them to provide the service. ISOweld separately controls account, security, billing and support information.

2. Information handled

• Names, contact, account and organisation details.
• Employment, role, licence, qualification, certification, induction and competency records.
• Attendance, signatures, location, jobs, vehicles, equipment, tooling and maintenance records.
• Documents, images, scans, reports and evidence.
• IP, device, browser, session, audit and security logs.
• Support messages, feedback, AI prompts and integration metadata.
• Billing and subscription metadata; payment-card details should be handled by the payment provider.

3. Sensitive information

Uploads may contain health, identity, criminal-history or other sensitive information. Customers must minimise collection and obtain required consent or authority. ISOweld does not require unnecessary sensitive information.

4. Collection

Information may come from users, Customers, kiosk participants, forms, uploads, devices, logs, public business sources and authorised integrations. Customers must provide appropriate employee, contractor and visitor notices.

5. Purposes

• Provide accounts, modules, reports, alerts, exports and integrations.
• Authenticate users and enforce company and role access.
• Secure, monitor, back up and support the service.
• Investigate incidents, misuse and faults.
• Meet legal, tax, insurance and dispute obligations.
• Improve reliability and usability using appropriately limited information.

6. Use and disclosure

Information is used for stated and reasonably related purposes, Customer instructions, consent and legal requirements. It may be disclosed to the relevant Customer, authorised users, service providers, advisers, insurers or authorities. ISOweld does not sell personal information.

7. AI and location

AI features may send prompts and selected context to the configured provider. Location features may collect coordinates, accuracy, addresses and timestamps when deliberately used and permitted by the device. Customers must comply with applicable workplace-surveillance and employment obligations.

8. Cookies and direct marketing

Essential cookies support authentication, security and preferences. Marketing requires appropriate consent or authority and an unsubscribe method under the Spam Act 2003 (Cth) where applicable. Service and security notices are not marketing.

9. Overseas processing and storage

Information may be stored in ISOweld hosting, databases, private files, backups, logs, email and Customer-connected services. ISOweld does not claim Australian-only storage. Some providers may process or support data overseas; the Subprocessor Register records known details.

10. Security

Safeguards may include password hashing, role and company scoping, sessions, CSRF controls, prepared statements, validation, private file handling, HTTPS, logs and backups. ISOweld does not claim universal AES-256-at-rest encryption, one enforced TLS version or independent security certification.

11. Access, correction and quality

People may request access or correction through support@isoweld.com.au. Identity may be verified and lawful exceptions may apply. Customer-controlled requests may be referred to the Customer. Customers and users must keep records accurate.

12. Retention and deletion

Retention follows the Retention Policy, Customer instructions, law, audit integrity, disputes and backup cycles. Active deletion may not immediately remove protected backup copies.

13. Incidents

Incidents follow the Incident Plan. Where the NDB scheme applies, ISOweld will assess and notify under the OAIC Notifiable Data Breaches guidance. No universal 72-hour OAIC promise applies.

14. Complaints

1. Email details and the requested outcome.
2. ISOweld acknowledges where practicable and may verify identity.
3. ISOweld investigates with Customers or providers as needed and gives an outcome or progress update within a reasonable period.
4. If unresolved and the Privacy Act applies, a complaint may be made to the OAIC.

15. Children and anonymity

The service is business-focused. Customer records may concern young workers or visitors where lawful. Anonymous interaction is allowed where practicable, but account, audit and compliance functions commonly require identity.

16. Changes and contact

Updates will show a new version and date. Material changes may also be notified.

Authoritative references

• Privacy Act 1988
• OAIC Australian Privacy Principles
• OAIC Notifiable Data Breaches
• Spam Act 2003