BizPort is a workplace health and safety (WHS) compliance platform used by businesses in Australia and New Zealand. This policy explains what personal information we handle, why, and what control you have over it.
01Who we are
BizPort is operated by BIZPORT SERVICES PTY LTD (ABN 13 670 568 082), of 9 Palmer St, Parramatta NSW 2151, Australia. In this policy, "BizPort", "we", "us" and "our" mean BIZPORT SERVICES PTY LTD.
We are bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Where we handle the personal information of individuals in New Zealand, we also comply with the Privacy Act 2020 (NZ) and its Information Privacy Principles.
02Scope of this policy
This policy applies to the BizPort web platform, the BizPort mobile app for iOS and Android, our public site-induction pages, and any related services we provide.
03Your employer's role and ours
BizPort is business-to-business software. There is no public sign-up. Accounts are created for you by your employer, the PCBU responsible for your workplace, or a safety advisor acting for them. We refer to these collectively as the "client organisation".
In most cases, your client organisation decides what information about you is entered into BizPort and why. They control that information. We host and process it on their behalf, under our agreement with them.
If you want your information corrected or removed, contact your employer or safety advisor first. They can usually action it directly. We will always help if you come to us, but we may need to refer your request to them.
04Information we collect
What we hold about you depends on your role and on what your client organisation has enabled. We collect only what the platform needs to do its job.
Identity and contact information
- Name, email address, phone and mobile numbers
- Job title, department, employee number
- Profile picture, where you or your organisation uploads one
- Account credentials (passwords are stored only as salted cryptographic hashes; we never store or see your password)
Employment and organisational information
- The client organisation, branch or site you are attached to
- Your role, access level, and any custom role assigned to you
- Employment status and start date
Compliance and safety records
- Documents assigned to you: policies, procedures, SOPs, Safe Work Method Statements
- Your acknowledgements, form responses, signatures and submissions, with dates and times
- Qualifications, licences, training records and competencies, including expiry dates
- Hazard, incident and non-conformance reports you submit, including any description, location and photographs you attach
- Site induction records, including sign-on and sign-off times
- Tasks assigned to you and their status
Human resources information
Where your client organisation has enabled the HR module, BizPort may hold additional information that they enter about you. This can include sensitive information such as:
- Bank account details and superannuation or KiwiSaver information
- Tax file number or IRD number and tax declarations
- Emergency contact details
- Performance appraisals, warnings, bonuses and remuneration information
Access to HR information is restricted. It is visible only to your employer's authorised personnel and, where they have expressly granted it, to a specific safety advisor or nominated BizPort staff member. Access is enforced by our systems, not merely hidden in the interface, and it is off by default.
Visitors and contractors
If you sign in to a site using a BizPort QR induction without holding a BizPort account, we collect the details that induction asks for, typically your name, contact details, the company you represent, your acknowledgement of site rules, and your sign-on and sign-off times.
Technical information
- Device push-notification tokens, so we can notify you
- Device and browser type, operating system version
- IP address and log data, including access times and pages or screens viewed
- Error and diagnostic data when something goes wrong
We do not collect precise location data, and we do not track you across other companies' apps or websites. We do not sell personal information, and we do not use it for advertising.
05How we collect it
- From your client organisation, when they create your account and maintain your records
- From you directly, when you complete documents, submit forms, report a hazard or incident, update your profile, or complete a site induction
- Automatically, through your use of the platform: log data, device information and push tokens
06How we use it
| Purpose | What this means |
|---|---|
| Providing the platform | Authenticating you, showing your documents and tasks, recording your submissions and signatures |
| WHS compliance | Maintaining the records your employer needs to meet their legal obligations, including proof that workers received and acknowledged safety documents |
| Notifications | Telling you when a document is assigned, an action is due or overdue, or a qualification is expiring; alerting the responsible people when a hazard or incident is reported |
| Compliance reporting | Producing the compliance scores, registers and reports your organisation relies on |
| Support and security | Responding to your requests, investigating issues, protecting against unauthorised access and misuse |
| Legal obligations | Meeting our own obligations under Australian and New Zealand law |
| Improving BizPort | Understanding how the platform is used so we can make it work better. We use aggregated or de-identified information for this wherever we can. |
07Who we disclose it to
- Your client organisation: your employer or PCBU, and their authorised personnel
- Safety advisors engaged by your organisation, limited to the clients they are assigned to, and only able to see HR information where your organisation has expressly granted it
- BizPort staff, where necessary to operate the platform or support your organisation, under confidentiality obligations and restricted access
- Service providers who help us run BizPort:
- Amazon Web Services: hosting, database and file storage
- Render: application hosting
- Amazon Simple Email Service: transactional email
- Expo, and Apple or Google push services: mobile push notification delivery
- Regulators, courts or law enforcement, where required or authorised by law, for example, a WorkSafe or SafeWork investigation into a notifiable incident
- A purchaser, if our business or its assets are sold, subject to equivalent privacy protections
08Storage and security
We store information in secure, access-controlled cloud infrastructure operated by Amazon Web Services and Render. Files and images, including profile pictures and photographs attached to reports, are stored in private storage and are never publicly accessible. They are served only through short-lived, signed links to people authorised to see them.
Our security measures include encryption of data in transit, hashed passwords, role-based access control enforced on the server, restricted administrative access, and audit logging of significant actions.
No system is perfectly secure. We cannot guarantee absolute security, but we take reasonable steps to protect your information from misuse, interference, loss and unauthorised access, modification or disclosure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and the New Zealand Privacy Commissioner where the NZ Privacy Act applies.
09Push notifications
If you allow notifications, we store a device token so we can send you alerts: a document assigned to you, an action falling due, a reminder about something overdue, or a hazard or incident reported at your site. You can turn notifications off at any time in your device settings. Doing so does not affect your ability to use the app, but you may miss time-sensitive safety information.
10How long we keep it
We keep personal information for as long as your client organisation maintains their account with us. After their account ends, we retain their data for three years, after which it is deleted or de-identified, unless a longer period is required by law or needed to resolve a dispute.
WHS records often must be retained for extended periods under work health and safety law. Records relating to incidents, hazardous exposures and training can carry retention obligations of many years. Your client organisation determines the retention period for their records, consistent with those obligations.
Completed compliance submissions are kept as permanent historical records and are not altered after they are submitted. This is deliberate: their evidentiary value depends on them remaining unchanged.
11Your rights
You may ask us to:
- Access the personal information we hold about you
- Correct anything inaccurate, out of date or incomplete
- Delete your information, subject to the legal retention obligations described above
- Complain about how we have handled your information
Because your information is generally controlled by your client organisation, please contact them first. They can usually act immediately. If you contact us, we will respond within a reasonable period, normally 30 days, and we may need to consult your organisation or refer your request to them.
We may need to verify your identity before acting. If we refuse a request, we will tell you why in writing.
12Account deletion
BizPort accounts are provisioned and administered by your client organisation, so account deletion is handled by them rather than in the app. To have your account deactivated or deleted:
- Ask your employer, PCBU or safety advisor to deactivate your account, or
- Email us at [email protected] and we will action or refer your request
When an account is deactivated, access ends immediately. Where WHS law requires the underlying compliance records to be retained, those records remain with your client organisation for the required period, after which they are deleted or de-identified.
13Overseas disclosure
We are open about where your information lives:
- Files and images, including profile pictures, uploaded documents and photographs attached to reports, are stored in Amazon Web Services in the Asia Pacific (Sydney) region, in Australia.
- Our application database, which holds account, employment, compliance and HR records, is currently hosted with Render in the United States (Oregon). This is an overseas disclosure for the purposes of Australian Privacy Principle 8.
Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles. Our providers are bound by contractual data-protection terms, and information is encrypted in transit and access-controlled at rest.
By using BizPort, you acknowledge that your information may be stored and processed outside Australia and New Zealand as described above. If our hosting regions change, we will update this policy.
14Children and young workers
BizPort is not directed at children and we do not knowingly collect information from anyone under 15 other than through a client organisation.
Young workers, including apprentices and trainees who may be under 18, can legitimately hold BizPort accounts because they are workers at a client organisation. Where an account is created for a young worker, their client organisation is responsible for obtaining any consent required by law.
15Cookies and analytics
Our web platform uses cookies that are necessary for it to work: keeping you signed in, remembering which company context you are viewing, and maintaining security. We do not use advertising cookies or third-party tracking cookies. Blocking essential cookies will prevent you from signing in.
16Links to other websites
BizPort may contain links to sites we do not operate, for example, a regulator's website or a document your organisation has linked to. If you follow one, you leave BizPort. We have no control over those sites and are not responsible for their content or privacy practices. We recommend reviewing the privacy policy of any site you visit.
17Changes to this policy
We may update this policy from time to time. The current version is always available at this address, and the effective date at the top shows when it last changed. If we make a significant change, we will take reasonable steps to notify client organisations. Continuing to use BizPort after a change means you accept the updated policy.
18Contact and complaints
For any privacy question, request or complaint, contact our Privacy Officer:
- Email: [email protected]
- Post: Privacy Officer, BIZPORT SERVICES PTY LTD, 9 Palmer St, Parramatta NSW 2151
- Phone: 1300 859 363
We will acknowledge your complaint promptly and aim to resolve it within 30 days.
If you are not satisfied with our response, you can escalate to:
- Australia: Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992
- New Zealand: Office of the Privacy Commissioner, privacy.org.nz, 0800 803 909