Purpose

SHE HR Consulting (“SHE HR”, “the Organisation”, “we”, “us” or “our”) is committed to protecting the privacy of the information which the Organisation collects, holds and administers.

This Policy explains what personal information we collect, how and why we collect it, and how we use, store, disclose and protect it. It also explains how you can access or correct your information, or make a complaint.

Scope

This Policy applies to:

clients, prospective clients and their representatives;

recruitment candidates and referees;

website visitors, newsletter subscribers and anyone who contacts us; and

all SHE HR Consulting employees (including temporary, permanent and contract), volunteers, contractors, consultants and visitors.

This Policy applies to any location where duties are performed by individuals undertaking activities associated with SHE HR Consulting, including online and remote work.

Policy

SHE HR Consulting collects and administers a range of information to deliver human resources consulting, advisory and recruitment services to its clients, and to operate its business. The Organisation is committed to protecting the privacy of the individuals whose information it collects, holds and administers.

SHE HR Consulting recognises the essential right of individuals to have their information administered in ways which they would reasonably expect: protected on one hand, and made accessible to them on the other. The Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs), regulates the handling, holding, use, access and collection of personal information (including sensitive information) about individuals. SHE HR Consulting takes its obligations under the Privacy Act seriously when handling all personal information, including sensitive information about clients, candidates and employees.

1. Responsibilities

1.1 CEO & Founder Responsibilities

Developing, adopting and reviewing this Policy, ensuring it aligns with the overall strategic direction and the Organisation’s vision and goals;

overseeing the development, implementation and enforcement of this Policy;

approving the recording, transcription and artificial intelligence (AI) tools used by the Organisation;

ensuring compliance with legal and regulatory standards; and

monitoring changes in privacy legislation, and advising on the need to review or revise this Policy when the need arises.

1.2 Manager Responsibilities

Implementing and enforcing this Policy within their team;

ensuring team members understand and adhere to this Policy;

providing guidance and clarification on this Policy to their team;

monitoring and managing compliance with this Policy in daily operations;

addressing any policy breaches and, where necessary, reporting them to the CEO & Founder; and

contributing to the policy review and providing feedback based on team and operational insights.

1.3 Employee and Contractor Responsibilities

Ensuring an understanding of all company policies relevant to their role and as a member of the Organisation;

seeking clarification on this Policy when needed;

complying with the standards outlined in this Policy;

only using recording, transcription and AI tools approved by the Organisation when handling personal information;

reporting any policy breaches, concerns or suspected data breaches to their direct manager or the CEO & Founder;

participating in policy training and updates as required; and

contributing to a safe and respectful work environment in line with all company policies, including this Policy.

2. Privacy Principles

SHE HR Consulting is bound by laws which impose specific obligations when it comes to handling information. The Organisation has adopted the following principles as minimum standards in relation to handling personal information:

collect only information which the Organisation requires for its primary function;

ensure that individuals are informed as to why we collect the information and how we administer the information gathered;

use and disclose personal information only for our primary functions or a directly related purpose, or for another purpose with the person’s consent;

store personal information securely, protecting it from unauthorised access;

provide individuals with access to their own information, and the right to seek its correction; and

take reasonable steps to ensure the information SHE HR Consulting collects is accurate, complete, up to date and relevant to the functions we perform.

3. Collection of Information

SHE HR Consulting will only collect information by lawful and fair means, directly from interactions with the individual whom the personal, sensitive or health information relates to. In some cases, where it is unreasonable or impracticable to obtain personal information directly from an individual, SHE HR Consulting will seek to obtain it from a publicly available source or a third party.

3.1 Information We Collect

Depending on how you interact with us, we may collect:

Contact and business details, such as your name, phone number, email address, role, business or organisation name, ABN, business address and website;

Enquiry and service details, such as the HR challenges you need support with, your budget, number of employees, how you heard about us and your responses to any pre-meeting questionnaire;

Meeting information, such as audio and video recordings, transcripts, and notes and summaries created with AI tools (see section 4);

Recruitment information, such as resumes, applications, interview notes, assessment results and referee details;

Information about other people that clients share with us to receive advice, such as details about their employees or candidates;

Payment and billing details, which are processed by third-party payment providers. We do not store full credit or debit card details; and

Marketing and website information, such as your subscription preferences, whether you open or click our emails, and how you use our website.

3.2 How We Collect Information

We collect information when you:

complete a form on our website, including enquiry, booking, questionnaire and newsletter sign-up forms;

book or pay for a service;

contact us by email, phone or social media;

attend a meeting, call or video conference with us;

apply for a role we are recruiting for, including through recruitment platforms; or

engage us to provide services, or provide information to us as part of those services.

3.3 Unsolicited Information

When unsolicited information is received, SHE HR Consulting will determine whether the personal information could have been collected in alignment with correct legislative practice. If it could have been, it will be treated in line with this Policy. If it could not have been, it will be destroyed or de-identified as soon as practicable, where it is lawful and reasonable to do so.

3.4 Personal Information

In addition to only collecting information that is necessary for SHE HR Consulting’s primary purpose, the Organisation will also:

notify individuals about why we collect the information and how it is administered;

collect personal information from the person themselves wherever possible; and

if collecting personal information from a third party, be able to advise the person whom the information concerns from whom their personal information has been collected.

3.5 Sensitive Information

SHE HR Consulting will collect sensitive information only with the person’s consent or if required or authorised by law.

SHE HR Consulting will also collect sensitive information about an individual if such collection is necessary to prevent or lessen a serious threat to the life, health or safety of any individual, where the individual whom the information concerns:

is physically or legally incapable of giving consent to the collection; or

physically cannot communicate consent to the collection.

Because of the nature of HR work, clients may share sensitive information about their employees or others with us (for example, during a workplace investigation or when seeking advice on a complaint). We ask clients to share only the information reasonably necessary for us to provide our services, and we handle all sensitive information with particular care.

3.6 Health Information

SHE HR Consulting does not provide health services. We will only collect health information about an individual where it is reasonably necessary to provide HR advice or services (for example, advice on leave, reasonable adjustments, return to work or workers’ compensation), and only:

with the individual’s consent; or

where the collection is required or authorised by or under law.

3.7 Information About Other People

If you provide us with personal information about another person (such as an employee, candidate or colleague), you are responsible for ensuring you are authorised to share it with us and, where required, that the person is aware it has been shared.

4. Meeting Recordings, Transcription and AI Tools

4.1 How We Use These Tools

SHE HR Consulting uses video conferencing platforms (such as Google Meet and Zoom), together with recording, transcription and AI note-taking tools, in meetings with clients, prospective clients and other stakeholders. This includes Clarity Calls (HR Hour of Power), consultations, advisory sessions and other service meetings.

4.2 Why We Use Them

We record and transcribe meetings, and use AI tools to create notes and summaries, so that we can:

keep an accurate record of what was discussed and agreed;

prepare written summaries, reports, advice and recommendations after the meeting;

give you our full attention during the meeting instead of taking manual notes; and

maintain the quality and continuity of our services.

4.3 How We Handle Recordings, Transcripts and Notes

Recordings, transcripts and AI-generated notes are only used for the purposes set out in section 4.2.

They are stored securely and can only be accessed by SHE HR Consulting personnel who need them to deliver our services.

They are never sold, published or shared publicly.

Any report, summary or advice created with the help of AI tools is reviewed by a member of the SHE HR Consulting team before it is relied on or sent to you.

4.4 AI Tool Providers

We choose recording, transcription and AI providers that apply reasonable security measures. Some of these providers may store or process information outside Australia (see section 7).

4.5 Retention of Recordings

We keep meeting recordings only for as long as reasonably needed to prepare your report and deliver our services, after which they are deleted or de-identified, unless we are required to keep them for legal or regulatory reasons. Transcripts, notes and reports may be kept as part of our client records.

4.6 Automated Decision-Making

SHE HR Consulting does not use computer programs or AI tools to make decisions that could significantly affect an individual’s rights or interests without human involvement. AI tools support our work, and all advice, recommendations and decisions are made or reviewed by a person.

5. Use and Disclosure

SHE HR Consulting will only use or disclose information for the primary purpose for which it was collected or a directly related secondary purpose. For other uses, SHE HR Consulting will obtain consent from the affected person.

5.1 Secondary Purpose

In relation to a secondary purpose, use or disclosure of the personal information will occur only where:

there is a direct relation to the primary purpose and the individual would reasonably have expected us to use it for that purpose;

the person has consented; or

certain other legal reasons exist, or disclosure is required to prevent a serious threat to life, health or safety.

5.2 Direct Marketing

In relation to personal information which has been collected from a person, SHE HR Consulting will use the personal information for direct marketing where the reasonable person would expect it to be used for this purpose, SHE HR Consulting has provided an opt-out and the opt-out has not been taken up.

If personal information has been collected other than from the person themselves, SHE HR Consulting will only use the personal information for direct marketing if the person whose personal information has been collected has consented (and they have not taken up the opt-out).

All marketing emails sent by SHE HR Consulting include an unsubscribe link, and we comply with the Spam Act 2003 (Cth). You can unsubscribe at any time.

5.3 Research and Statistics

If the disclosure of sensitive information is necessary for research or the compilation or analysis of statistics relevant to public health or public safety, and it is impracticable for SHE HR Consulting to seek the individual’s consent before the use or disclosure, and the use or disclosure is conducted in accordance with guidelines approved by the Information Commissioner under section 95A of the Privacy Act, the Organisation may make such a disclosure.

5.4 Unlawful Activity

If SHE HR Consulting has sufficient reason to believe that an unlawful activity has been, is being or may be engaged in, and the disclosure of personal information becomes a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities, the Organisation may make such disclosures.

SHE HR Consulting may further disclose personal information if its disclosure is mandated by an enforcement body or is required for the following:

the prevention, detection, investigation, prosecution or punishment of criminal offences, breaches of a law imposing a penalty or sanction or breaches of a prescribed law;

the enforcement of laws relating to the confiscation of the proceeds of crime;

the protection of the public revenue;

the prevention, detection, investigation or remedying of seriously improper conduct or prescribed conduct; or

the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of the orders of a court or tribunal.

6. Third-Party Service Providers

SHE HR Consulting uses trusted third-party providers to run its business and deliver its services. These include providers of:

customer relationship management, email marketing, booking and payment systems;

email, document storage and collaboration tools;

video conferencing, recording, transcription and AI note-taking tools;

AI tools used to help prepare reports and documents;

recruitment and applicant tracking platforms;

project management tools; and

accounting and payment processing services.

We only share the personal information these providers need to perform their services for us. SHE HR Consulting does not sell personal information to anyone.

7. Overseas Disclosure

Some of our third-party providers store or process information on servers located outside Australia, including in the United States and other countries where those providers operate. When this happens, SHE HR Consulting takes reasonable steps to ensure the information is handled in a way that is consistent with the Australian Privacy Principles.

8. Storage and Security of Information

SHE HR Consulting takes reasonable steps to protect information from misuse, interference and loss, and from unauthorised access, modification and disclosure. These steps include but are not limited to:

undertaking training and providing direction to all SHE HR Consulting employees and contractors who handle this information;

entering information into secure, password-protected systems, which are accessed on a ‘need-only basis’ and handled in a sensitive and secure way;

using multi-factor authentication and access controls where available;

destroying or de-identifying personal, sensitive or health information when SHE HR Consulting no longer requires the information for business purposes, unless the law requires it to be kept; and

archiving financial information in a secure location in accordance with the requirements of the Australian Taxation Office.

9. Data Breaches

If SHE HR Consulting becomes aware of a data breach involving personal information, we will act quickly to contain and assess it. Where a breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme.

10. Access and Correction

SHE HR Consulting takes reasonable steps to ensure that the personal information it collects, holds and uses is accurate, up to date and complete. SHE HR Consulting understands individuals have a right to seek access to information held about them and to correct it if inaccurate, incomplete, misleading or not up to date.

To request access to or correction of your personal information, please contact [email protected]. We will respond within a reasonable period, usually within 30 days.

If an individual and SHE HR Consulting disagree about whether the information is accurate, complete and up to date, and the individual asks SHE HR Consulting to associate with the information a statement claiming that the information is not accurate, complete or up to date, SHE HR Consulting will take reasonable steps to do so.

10.1 Withholding Access to Information

SHE HR Consulting can withhold the access of an individual to their information if:

providing access would pose a serious threat to the life, health or safety of any individual, or to public health or safety; or

providing access would have an unreasonable impact upon the privacy of other individuals; or

the request for access is frivolous or vexatious; or

the information relates to existing or anticipated legal proceedings between the Organisation and the individual, and the information would not be accessible by the process of discovery in those proceedings; or

providing access would reveal the intentions of the Organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations; or

providing access would be unlawful; or

providing access would be likely to prejudice an investigation of possible unlawful activity; or

an enforcement body performing a lawful security function asks SHE HR Consulting not to provide access to the information on the basis that providing access would be likely to cause damage to the security of Australia.

Where providing access would reveal evaluative information generated within the Organisation in connection with a commercially sensitive decision-making process, SHE HR Consulting may give the individual an explanation for the commercially sensitive decision rather than direct access to the information. SHE HR Consulting will provide the individual with its reasons for denial of access or a refusal to correct personal information.

11. Cookies and Website Analytics

Our website may use cookies and similar technologies to help it work properly and to understand how visitors use it. This information is generally collected in a way that does not identify you personally. You can set your browser to refuse cookies, although some parts of the website may not work as intended.

12. Complaints

If you have a question or concern about the way we have handled your personal information, or you believe we have not complied with our obligations under the Privacy Act, please contact us at [email protected]. We will acknowledge your complaint and aim to respond within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au.

13. Summary

All stakeholders associated with SHE HR Consulting must take their obligations under the Privacy Act seriously. This means handling any and all personal information in accordance with the Privacy Act and this Policy. Breaches of this Policy are taken seriously, and disciplinary action, including but not limited to termination, may be taken for such breaches.

If you are an employee or contractor and have any questions about this Policy or would like further information, please contact the CEO & Founder.

If you are external to the Organisation and have any questions or concerns about the way in which we have handled your personal information, please contact [email protected].

14. Review

This Privacy Policy is subject to review every two years, or sooner if there are changes to privacy laws or to the way SHE HR Consulting handles personal information. This review assesses the Policy’s effectiveness, relevance and compliance with current privacy laws, and takes into account employee feedback. Any changes will be published on our website and promptly communicated to all staff.

Definitions

AI Note-Taker

A software tool that uses artificial intelligence to transcribe a meeting and produce notes, summaries or action items from it.

Health Information

Includes all personal information relating to an individual’s physical or mental health, disability or services provided to them to support them in managing their health.

Personal Information

Includes information or an opinion about an identified individual, or an individual who is reasonably identifiable: whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not.

Recording

An audio or video record of a meeting, call or video conference, including any transcript created from it.

Sensitive Information

Includes information or opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record, provided the information or opinion otherwise meets the definition of personal information. It also includes health information and genetic and biometric information.

Unsolicited Information

Includes information that has been received by the Organisation where the Organisation has taken no active steps to collect the information.