AS-POL-05 · Version 1.4
Privacy Policy
Added portal, uploads, location, notifications, automated checks and verified service-provider regions.
Approved 22 September 2026
About this policy
This policy explains how Aid Staffing Pty Ltd (Aid Staffing) handles personal information under Australian privacy law. It applies to our website, enquiries, recruitment, referrals, service delivery, the participant and family portal, worker administration, payments, feedback, complaints and incident management.
What we collect
We collect only information reasonably needed for our work. Public forms may collect contact details, suburb, work availability and qualifications, support interests, referral details, feedback or complaint information, and the message a person chooses to provide. Information about a referred person may be collected from a third party, such as a support coordinator, health professional or community worker. Public forms do not ask for identity documents, screening or licence numbers, diagnoses, medication details, a full NDIS plan or detailed medical records. If support or recruitment proceeds, we may collect identity and contact information, authority and consent records, support needs, health and safety information, plans, agreements, service records, worker screening and training evidence, employment or contractor information, tax and payment details, attendance and location evidence, timesheets, expenses, messages, incidents and complaints. We also collect account, session, device and security information needed to protect the portal.
Why we collect and use it
We use personal information to respond to enquiries and referrals; assess recruitment; onboard and manage workers; plan, provide and record safe supports; communicate with participants, authorised family members, guardians and workers; manage rosters, attendance, payroll, invoices and expenses; handle feedback, incidents and complaints; prevent misuse; and meet legal obligations. When we receive personal information about a referred person, we send them an APP 5 collection notice by email where possible or queue it for the Director to provide another way. We do not sell personal information or use it for unrelated marketing without permission.
Consent, authority and sensitive information
A referrer must confirm that the person being referred, or their authorised decision maker, agreed to the referral and to their details being provided to Aid Staffing. We seek consent before collecting sensitive information unless the law permits or requires otherwise. A participant, family member or guardian sees information only within recorded, current authority and the sharing choices made for that participant. You may withdraw consent for optional uses by contacting us. Withdrawal does not undo lawful handling that has already occurred and may mean we cannot provide a requested service where the information is necessary for safety or delivery.
Location and attendance information
A worker may choose to provide the phone's location when checking in or out. We use it to compare the attendance point with the recorded service location and to identify entries that need office review. The portal keeps the recorded coordinates, accuracy and time as attendance evidence. A worker can decline location access; the attendance is then marked for review rather than treated as verified. Location is not used for continuous tracking.
Files, photographs and malware scanning
Worker documents, expense receipt photos and worker profile photos are checked by a private malware scanner before storage, encrypted, and kept in private object storage. Access is limited by purpose. A worker and authorised office roles can access that worker's records. A worker profile photo is shown to a participant or authorised family member only when the worker has agreed, the participant has the relevant sharing permission and there is a current visit. Public website uploads are not accepted.
Who we disclose information to
Access is limited to authorised people who need the information for their work. We may disclose information to allocated workers, a participant's authorised family member or guardian within their recorded permissions, service providers that operate our systems, professional advisers, government or regulatory bodies, emergency services, or another person you authorise. Messages and notifications contain only the minimum information needed. Urgent worker text messages do not include a participant's name or street address. We require service providers to protect information and disclose only what is needed.
Where service providers handle information
The portal, database and private malware scanner are hosted by Railway in Singapore. Email is sent through Amazon Web Services in Sydney, Australia. Encrypted uploaded files are stored in Cloudflare R2 using its Asia-Pacific location; Cloudflare describes that location as a region and does not guarantee a particular country for a location hint. Privacy-safe error reports are handled by Sentry in its European Union region. Cloudflare Turnstile and the notification services used by a person's browser or phone may process limited device and network information in other countries where those providers operate. Contact us if you want more information about the service providers relevant to your information.
Security and access controls
We use role-based access, multi-factor authentication, encrypted connections, encryption for sensitive records and uploaded files, private storage, malware scanning, expiring download links, session controls, logging and other safeguards appropriate to the information. Access changes when a person's role, authority, allocation or engagement changes. No system is risk-free. Please contact us promptly if you think information has been accessed or disclosed incorrectly.
Automated checks and human decisions
The portal uses rules to check access, required evidence, scheduling conflicts, attendance distance, funding limits and due dates. These checks help prevent unsafe or unauthorised actions and identify matters for review. Decisions about employment, participant services, complaints, incidents, privacy events and exceptions remain with an authorised person.
Access and correction
You may ask to access or correct personal information we hold about you. You may also ask us to delete information when we are not legally required to keep it. Contact us using the details below. We may need to verify your identity. If we cannot provide access, make a requested correction or delete information, we will explain why where the law allows.
How long we keep records
Initial support enquiries, contact enquiries, referral enquiries and general feedback are retained for up to 24 months after they are received. Careers expressions of interest are retained for up to 12 months after they are received. If an enquiry, referral or expression of interest progresses to service delivery or recruitment, the resulting records follow the retention period for that record type. Participant service and support records are retained for at least seven years after the last service. Worker records are retained for at least seven years after employment or engagement ends. Records about a child are retained until the person turns 25, or seven years after the last service, whichever is later. Consent and access records are retained for at least seven years. Complaints are retained for at least seven years. A legal, safeguarding, complaint, incident, insurance or operational hold may require information to be kept longer.
Review and secure disposal
A retention date flags a record for authorised human review; it does not automatically delete it. An authorised person must confirm that no legal, safeguarding, complaint, incident, insurance or operational hold applies before secure destruction or de-identification. The decision is recorded.
Privacy incidents
We investigate suspected privacy incidents, take steps to contain harm and notify affected people and regulators when required, including under the Notifiable Data Breaches scheme.
Questions and complaints
Contact the Privacy Officer at admin@aidstaffing.com.au or call 0435 417 299. You may make a complaint online, including anonymously, or contact us directly. We will acknowledge and investigate privacy concerns. If you are not satisfied, you may contact the Office of the Australian Information Commissioner. A concern about NDIS supports may also be raised with the NDIS Quality and Safeguards Commission on 1800 035 544. You may use an advocate or trusted person and will not be disadvantaged for raising a concern.
Version history
- Version 1.4 — Added portal, uploads, location, notifications, automated checks and verified service-provider regions. Approved 22 September 2026.
- Version 1.3 — Added collection, use and retention information for general feedback, contact and third-party referrals. Approved 5 September 2026.
- Version 1.2 — Corrected the child-record retention wording and recorded the approved retention periods. Approved 5 September 2026.
- Version 1.1 — How Aid Staffing collects, uses, protects, retains and disposes of personal information, including support enquiries and careers expressions of interest. Approved 5 September 2026.
- Version 1.0 — How Aid Staffing collects, uses, protects, retains and disposes of personal information. Approved 2 September 2026.